From 1abd23cf94756607d3b024f296ea78e8f035147a Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 6 Jul 2026 11:21:09 +0200
Subject: [PATCH 01/35] fix(frontend): respect analytics config before
 initializing PostHog (#6812)

# Description of Changes

Please provide a summary of the changes, including:

- What was changed
- Moved PostHog startup out of `index.tsx` and into a config-aware
initializer inside `AppProviders`.
- Added a dedicated `usePosthogTracking` hook that only initializes
PostHog when `enableAnalytics` is explicitly `true` and `enablePosthog`
is not disabled.
- Kept cookie-consent handling in the same flow so consent is applied
only after PostHog is actually initialized.
- Removed the unconditional `PostHogProvider` and `posthog.init(...)`
bootstrap from the app entrypoint.
- Added targeted frontend tests covering analytics-disabled and
analytics-enabled startup behavior.

- Why the change was made
- The previous frontend bootstrap initialized PostHog before app config
was loaded, so disabling analytics in the UI or via environment settings
did not prevent PostHog network activity.
- This change makes analytics behavior follow the server-provided config
instead of always connecting on page load.

Closes #6358

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../src/core/components/AppProviders.tsx      |  7 ++
 .../core/hooks/usePosthogTracking.test.tsx    | 76 +++++++++++++++++
 .../src/core/hooks/usePosthogTracking.ts      | 83 +++++++++++++++++++
 frontend/editor/src/index.tsx                 | 37 +--------
 4 files changed, 169 insertions(+), 34 deletions(-)
 create mode 100644 frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
 create mode 100644 frontend/editor/src/core/hooks/usePosthogTracking.ts

diff --git a/frontend/editor/src/core/components/AppProviders.tsx b/frontend/editor/src/core/components/AppProviders.tsx
index ede9ed266a..f050ae7f9b 100644
--- a/frontend/editor/src/core/components/AppProviders.tsx
+++ b/frontend/editor/src/core/components/AppProviders.tsx
@@ -27,6 +27,7 @@ import { AdminTourOrchestrationProvider } from "@app/contexts/AdminTourOrchestra
 import { PageEditorProvider } from "@app/contexts/PageEditorContext";
 import { BannerProvider } from "@app/contexts/BannerContext";
 import ErrorBoundary from "@app/components/shared/ErrorBoundary";
+import { usePosthogTracking } from "@app/hooks/usePosthogTracking";
 import { useScarfTracking } from "@app/hooks/useScarfTracking";
 import { useAppInitialization } from "@app/hooks/useAppInitialization";
 import { useLogoAssets } from "@app/hooks/useLogoAssets";
@@ -43,6 +44,11 @@ function ScarfTrackingInitializer() {
   return null;
 }
 
+function PosthogTrackingInitializer() {
+  usePosthogTracking();
+  return null;
+}
+
 // Component to run app-level initialization (must be inside AppProviders for context access)
 function AppInitializer() {
   useAppInitialization();
@@ -122,6 +128,7 @@ export function AppProviders({
               retryOptions={appConfigRetryOptions}
               {...appConfigProviderProps}
             >
+              <PosthogTrackingInitializer />
               <ScarfTrackingInitializer />
               <AppConfigLoader />
               <ServerDefaultsSync />
diff --git a/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx b/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
new file mode 100644
index 0000000000..41f5fad7dc
--- /dev/null
+++ b/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
@@ -0,0 +1,76 @@
+import { ReactNode } from "react";
+import { renderHook, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+const posthogState = vi.hoisted(() => ({ loaded: false }));
+const posthogMock = vi.hoisted(() => ({
+  get __loaded() {
+    return posthogState.loaded;
+  },
+  init: vi.fn(() => {
+    posthogState.loaded = true;
+  }),
+  opt_out_capturing: vi.fn(),
+  opt_in_capturing: vi.fn(),
+  set_config: vi.fn(),
+  has_opted_in_capturing: vi.fn(() => false),
+}));
+
+vi.mock("posthog-js", () => ({
+  default: posthogMock,
+}));
+
+import { usePosthogTracking } from "@app/hooks/usePosthogTracking";
+
+describe("usePosthogTracking", () => {
+  beforeEach(() => {
+    posthogState.loaded = false;
+    posthogMock.init.mockClear();
+    posthogMock.opt_out_capturing.mockClear();
+    posthogMock.opt_in_capturing.mockClear();
+    posthogMock.set_config.mockClear();
+    vi.stubEnv("VITE_PUBLIC_POSTHOG_KEY", "test-key");
+    vi.stubEnv("VITE_PUBLIC_POSTHOG_HOST", "https://eu.i.posthog.com");
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("does not initialize PostHog when analytics is disabled", async () => {
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <AppConfigProvider
+        initialConfig={{ enableAnalytics: false }}
+        bootstrapMode="non-blocking"
+        autoFetch={false}
+      >
+        {children}
+      </AppConfigProvider>
+    );
+
+    renderHook(() => usePosthogTracking(), { wrapper });
+
+    await waitFor(() => {
+      expect(posthogMock.init).not.toHaveBeenCalled();
+    });
+  });
+
+  it("initializes PostHog when analytics is enabled", async () => {
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <AppConfigProvider
+        initialConfig={{ enableAnalytics: true }}
+        bootstrapMode="non-blocking"
+        autoFetch={false}
+      >
+        {children}
+      </AppConfigProvider>
+    );
+
+    renderHook(() => usePosthogTracking(), { wrapper });
+
+    await waitFor(() => {
+      expect(posthogMock.init).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/frontend/editor/src/core/hooks/usePosthogTracking.ts b/frontend/editor/src/core/hooks/usePosthogTracking.ts
new file mode 100644
index 0000000000..a8037ec4a7
--- /dev/null
+++ b/frontend/editor/src/core/hooks/usePosthogTracking.ts
@@ -0,0 +1,83 @@
+import { useEffect } from "react";
+import posthog from "posthog-js";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+
+function applyPosthogConsent(): void {
+  if (typeof window === "undefined" || !posthog.__loaded) {
+    return;
+  }
+
+  const optedIn =
+    window.CookieConsent?.acceptedService?.("posthog", "analytics") || false;
+
+  if (optedIn) {
+    posthog.set_config({ persistence: "localStorage+cookie" });
+    posthog.opt_in_capturing();
+    return;
+  }
+
+  posthog.opt_out_capturing();
+  posthog.set_config({ persistence: "memory" });
+}
+
+function ensurePosthogInitialized(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+
+  const posthogKey = import.meta.env.VITE_PUBLIC_POSTHOG_KEY;
+  const posthogHost = import.meta.env.VITE_PUBLIC_POSTHOG_HOST;
+
+  if (!posthogKey || !posthogHost) {
+    return false;
+  }
+
+  if (!posthog.__loaded) {
+    posthog.init(posthogKey, {
+      api_host: posthogHost,
+      defaults: "2025-05-24",
+      capture_exceptions: true,
+      debug: false,
+      opt_out_capturing_by_default: true,
+      persistence: "memory",
+      cross_subdomain_cookie: false,
+    });
+  }
+
+  return true;
+}
+
+export function usePosthogTracking(): void {
+  const { config } = useAppConfig();
+
+  useEffect(() => {
+    const analyticsEnabled = config?.enableAnalytics === true;
+    const posthogEnabled = analyticsEnabled && config?.enablePosthog !== false;
+
+    if (!posthogEnabled) {
+      if (posthog.__loaded) {
+        posthog.opt_out_capturing();
+        posthog.set_config({ persistence: "memory" });
+      }
+      return;
+    }
+
+    if (!ensurePosthogInitialized()) {
+      return;
+    }
+
+    applyPosthogConsent();
+
+    const handleConsentChange = () => {
+      applyPosthogConsent();
+    };
+
+    window.addEventListener("cc:onConsent", handleConsentChange);
+    window.addEventListener("cc:onChange", handleConsentChange);
+
+    return () => {
+      window.removeEventListener("cc:onConsent", handleConsentChange);
+      window.removeEventListener("cc:onChange", handleConsentChange);
+    };
+  }, [config?.enableAnalytics, config?.enablePosthog]);
+}
diff --git a/frontend/editor/src/index.tsx b/frontend/editor/src/index.tsx
index 017138cebc..d776918bd1 100644
--- a/frontend/editor/src/index.tsx
+++ b/frontend/editor/src/index.tsx
@@ -13,8 +13,6 @@ import { ColorSchemeScript } from "@mantine/core";
 import { BrowserRouter } from "react-router-dom";
 import App from "@app/App";
 import "@app/i18n"; // Initialize i18next
-import posthog from "posthog-js";
-import { PostHogProvider } from "@posthog/react";
 import { BASE_PATH } from "@app/constants/app";
 
 import { startEagerWasmCompilation } from "@app/services/wasmPrecompiler";
@@ -35,33 +33,6 @@ if (typeof window !== "undefined") {
   }
 }
 
-posthog.init(import.meta.env.VITE_PUBLIC_POSTHOG_KEY, {
-  api_host: import.meta.env.VITE_PUBLIC_POSTHOG_HOST,
-  defaults: "2025-05-24",
-  capture_exceptions: true, // This enables capturing exceptions using Error Tracking, set to false if you don't want this
-  debug: false,
-  opt_out_capturing_by_default: true, // Opt-out by default, controlled by cookie consent
-  persistence: "memory", // No cookies/localStorage written until user opts in
-  cross_subdomain_cookie: false,
-});
-
-function updatePosthogConsent() {
-  if (!posthog.__loaded) return;
-  const optIn =
-    window.CookieConsent?.acceptedService?.("posthog", "analytics") || false;
-  if (optIn) {
-    posthog.set_config({ persistence: "localStorage+cookie" });
-    posthog.opt_in_capturing();
-  } else {
-    posthog.opt_out_capturing();
-    posthog.set_config({ persistence: "memory" });
-  }
-  console.log("Updated PostHog consent: ", optIn ? "opted in" : "opted out");
-}
-
-window.addEventListener("cc:onConsent", updatePosthogConsent);
-window.addEventListener("cc:onChange", updatePosthogConsent);
-
 const container = document.getElementById("root");
 if (!container) {
   throw new Error("Root container missing in index.html");
@@ -71,10 +42,8 @@ const root = ReactDOM.createRoot(container); // Finds the root DOM element
 root.render(
   <React.StrictMode>
     <ColorSchemeScript />
-    <PostHogProvider client={posthog}>
-      <BrowserRouter basename={BASE_PATH}>
-        <App />
-      </BrowserRouter>
-    </PostHogProvider>
+    <BrowserRouter basename={BASE_PATH}>
+      <App />
+    </BrowserRouter>
   </React.StrictMode>,
 );

From 12563050a60ce3e07f02795bb3a50007400da89b Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 6 Jul 2026 11:21:41 +0200
Subject: [PATCH 02/35] Generate frontend license report on push (#6877)

# Description of Changes

`app/allowed-licenses.json` has been modified in preparation for when
"org.springframework.boot" is upgraded to version "4.0.7".

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../frontend-backend-licenses-update.yml      |  8 ++++++++
 app/allowed-licenses.json                     | 20 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 41d3f35c6e..cc9aa023e3 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -98,6 +98,13 @@ jobs:
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
+      - name: Generate frontend license report (Push only)
+        if: github.event_name == 'push'
+        env:
+          PR_IS_FORK: "false"
+        run: task frontend:licenses:generate
+
       - name: Generate frontend license report (internal PR)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
         env:
@@ -353,6 +360,7 @@ jobs:
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
       - name: Check licenses and generate report
         id: license-check
         run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
diff --git a/app/allowed-licenses.json b/app/allowed-licenses.json
index cd2fe06a3b..9f1ff96359 100644
--- a/app/allowed-licenses.json
+++ b/app/allowed-licenses.json
@@ -80,10 +80,18 @@
       "moduleName": ".*",
       "moduleLicense": "Apache License Version 2.0"
     },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "Apache License version 2.0"
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "Apache License, Version 2.0"
     },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "Apache License, version 2.0"
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "The Apache License, Version 2.0"
@@ -108,6 +116,10 @@
       "moduleName": ".*",
       "moduleLicense": "Mozilla Public License 2.0 (MPL-2.0)"
     },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "Mozilla Public License Version 2.0"
+    },
     {
       "moduleName": ".*",
       "moduleLicense": 	"CDDL+GPL License"
@@ -172,6 +184,14 @@
       "moduleName": ".*",
       "moduleLicense": "Eclipse Public License, Version 2.0"
     },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "EPL-2.0"
+    },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "LGPL-2.1-only"
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "Ubuntu Font Licence 1.0"

From a15e8227b4db9b07c158d08a7cf9e1ffa49f0b5f Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 6 Jul 2026 11:21:57 +0200
Subject: [PATCH 03/35] fix(ci): upload Playwright reports from the correct
 frontend directory (#6859)

# Description of Changes

This change fixes the artifact upload path used by the Playwright E2E
workflows after the frontend directory structure was updated.

### What was changed

- Updated the Playwright report artifact path from:
  - `frontend/editor/playwright-report/`
  - to `frontend/playwright-report/`
- Applied the fix to:
  - `build-enterprise.yml`
  - `e2e-stubbed.yml`
  - `nightly.yml`
- Renamed the nightly Playwright artifact from:
  - `playwright-nightly-${{ github.run_id }}`
  - to `playwright-report-nightly-${{ github.run_id }}`
  for consistency with the other workflows.

### Why the change was made

The workflows attempted to upload artifacts from a directory that no
longer exists, causing GitHub Actions to report:

> No files were found with the provided path:
`frontend/editor/playwright-report/`

Updating the upload path ensures Playwright reports are successfully
collected and available for debugging failed E2E runs.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/workflows/build-enterprise.yml   |  2 +-
 .github/workflows/build.yml              |  3 +++
 .github/workflows/coverage-aggregate.yml | 25 +++++++++++++++++-------
 .github/workflows/e2e-live.yml           |  2 +-
 .github/workflows/e2e-stubbed.yml        |  2 +-
 .github/workflows/nightly.yml            |  4 ++--
 6 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index d29002ac37..2db275284b 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -285,5 +285,5 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
           retention-days: 7
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7018a38120..0e0a702cc2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -202,6 +202,9 @@ jobs:
       contents: read
     uses: ./.github/workflows/coverage-aggregate.yml
     secrets: inherit
+    with:
+      frontend-validation-result: ${{ needs.frontend-validation.result }}
+      playwright-e2e-live-result: ${{ needs.playwright-e2e-live.result }}
 
   # Single status check that branch protection should mark as required.
   # Succeeds when every upstream job is either `success` or `skipped` (path-
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index bbfaf09363..ce792bcadc 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -13,6 +13,17 @@ name: Aggregate backend coverage
 #     producers themselves
 on:
   workflow_call:
+    inputs:
+      frontend-validation-result:
+        description: Result of the frontend-validation producer job
+        required: false
+        type: string
+        default: skipped
+      playwright-e2e-live-result:
+        description: Result of the playwright-e2e-live producer job
+        required: false
+        type: string
+        default: skipped
 
 permissions:
   contents: read
@@ -196,9 +207,9 @@ jobs:
       # --------------------------------------------------------------
       - name: Download vitest coverage artifact
         # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence so a backend-only PR still produces the matrix with
-        # just backend rows populated.
-        if: always()
+        # absence on backend-only runs by skipping the download entirely
+        # when the producer job was not part of this workflow run.
+        if: inputs.frontend-validation-result == 'success'
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
         with:
           name: frontend-coverage
@@ -206,12 +217,12 @@ jobs:
         continue-on-error: true
 
       - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
-        # Same tolerance as vitest - matrix script handles missing inputs.
-        if: always()
+        # e2e-live uploads the artifact with a stable name. Skip the
+        # download entirely when the producer job did not run.
+        if: inputs.playwright-e2e-live-result == 'success'
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
         with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
+          name: playwright-frontend-coverage
           path: matrix-inputs/playwright/
         continue-on-error: true
 
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index eb6d8d7be5..44d5443a73 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -169,7 +169,7 @@ jobs:
         if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
+          name: playwright-frontend-coverage
           path: |
             .test-state/playwright/coverage-pw-summary/
             .test-state/playwright/coverage-pw/
diff --git a/.github/workflows/e2e-stubbed.yml b/.github/workflows/e2e-stubbed.yml
index dd6bcc8ea7..33bb24ee4c 100644
--- a/.github/workflows/e2e-stubbed.yml
+++ b/.github/workflows/e2e-stubbed.yml
@@ -50,5 +50,5 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
           retention-days: 7
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 11a8ea2be5..1801876bcd 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -53,8 +53,8 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          name: playwright-report-nightly-${{ github.run_id }}
+          path: frontend/playwright-report/
           retention-days: 14
 
   # Builds all desktop platforms on a schedule so the Rust dependency cache is

From e630d6697b39235a785b2cc224f8f9e409cfa607 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 6 Jul 2026 10:22:41 +0100
Subject: [PATCH 04/35] Fix tooltip positioning on Add Page Numbers (#6885)

# Description of Changes
## Before

<img width="483" height="227" alt="image"
src="https://github.com/user-attachments/assets/4bf86eec-a9cc-4f63-84f0-4eb2bd535bab"
/>

## After

<img width="732" height="235" alt="image"
src="https://github.com/user-attachments/assets/101d2ea4-36e8-4e8f-990a-d72b33fa0ac2"
/>
---
 .../addPageNumbers/AddPageNumbersAppearanceSettings.tsx      | 5 +++++
 .../tools/addPageNumbers/AddPageNumbersPositionSettings.tsx  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
index 627f7c1b9e..11ca767bca 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
@@ -27,6 +27,7 @@ const AddPageNumbersAppearanceSettings = ({
   return (
     <Stack gap="md">
       <Tooltip
+        position="left"
         content={t(
           "marginTooltip",
           "Distance between the page number and the edge of the page.",
@@ -56,6 +57,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "fontSizeTooltip",
           "Size of the page number text in points. Larger numbers create bigger text.",
@@ -73,6 +75,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "addPageNumbers.zeroPadTooltip",
           "Zero-pad (Bates Stamp) page numbers to this width (e.g. 3 => 001). Set 0 to disable.",
@@ -90,6 +93,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "fontTypeTooltip",
           "Font family for the page numbers. Choose based on your document style.",
@@ -118,6 +122,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "customTextTooltip",
           'Optional custom format for page numbers. Use {n} as placeholder for the number. Example: "Page {n}" will show "Page 1", "Page 2", etc.',
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
index 735eda3e1c..b4b08e49c9 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
@@ -49,6 +49,7 @@ const AddPageNumbersPositionSettings = ({
         </Text>
 
         <Tooltip
+          position="left"
           content={t(
             "pageSelectionPrompt",
             "Custom Page Selection (Enter a comma-separated list of page numbers 1,5,6 or Functions like 2n+1)",
@@ -69,6 +70,7 @@ const AddPageNumbersPositionSettings = ({
         </Tooltip>
 
         <Tooltip
+          position="left"
           content={t(
             "startingNumberTooltip",
             "The first number to display. Subsequent pages will increment from this number.",

From b69b787d636d58f4b6f01d33c1aa98e1cb1b79f2 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 6 Jul 2026 10:25:46 +0100
Subject: [PATCH 05/35] Fix Playwright tests in Firefox and Safari (#6868)

# Description of Changes
Playwright tests currently fail in Firefox and Safari because of
inconsistent behaviour across the browsers. This is causing the
nightlies to fail every night. This PR fixes the test behaviour to work
consistently across browsers (most of the issues were to do with the
tests opening the file picker, which was being automatically suppressed
in Chromium, but not the other browsers).
---
 .../src/core/tests/helpers/stub-test-base.ts  |  2 +
 .../src/core/tests/helpers/test-base.ts       |  2 +
 .../src/core/tests/helpers/ui-helpers.ts      | 46 +++++++++++++++++--
 .../live/encrypted-unlock-then-tool.spec.ts   |  3 ++
 .../stubbed/certificate-validation.spec.ts    |  5 ++
 .../src/core/tests/stubbed/convert.spec.ts    | 14 ++++--
 .../stubbed/encrypted-pdf-unlock.spec.ts      | 12 ++++-
 .../stubbed/files-page-screenshots.spec.ts    | 13 +++++-
 .../tests/stubbed/pdf-text-search.spec.ts     |  5 +-
 .../stubbed/viewer-text-selection.spec.ts     | 16 +++++++
 10 files changed, 105 insertions(+), 13 deletions(-)

diff --git a/frontend/editor/src/core/tests/helpers/stub-test-base.ts b/frontend/editor/src/core/tests/helpers/stub-test-base.ts
index 5752108d42..e6ae98c6f7 100644
--- a/frontend/editor/src/core/tests/helpers/stub-test-base.ts
+++ b/frontend/editor/src/core/tests/helpers/stub-test-base.ts
@@ -6,6 +6,7 @@ import {
   skipOnboarding,
   type MockAppApiOptions,
 } from "@app/tests/helpers/api-stubs";
+import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
 /**
  * Custom Playwright fixture for backend-free specs.
@@ -57,6 +58,7 @@ export const test = base.extend<StubFixtures>({
   seedJwt: [false, { option: true }],
 
   page: async ({ page, stubOptions, autoGoto, seedJwt }, use) => {
+    suppressNativeFilePicker(page);
     await seedCookieConsent(page);
     if (seedJwt) {
       // Logged-in users hit the orchestrator path that surfaces the
diff --git a/frontend/editor/src/core/tests/helpers/test-base.ts b/frontend/editor/src/core/tests/helpers/test-base.ts
index 1659bc3abd..90de9432f9 100644
--- a/frontend/editor/src/core/tests/helpers/test-base.ts
+++ b/frontend/editor/src/core/tests/helpers/test-base.ts
@@ -1,6 +1,7 @@
 import { test as base, expect } from "@playwright/test";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
 /**
  * Custom test fixture that:
@@ -40,6 +41,7 @@ const COVERAGE_DIR = path.resolve(
 
 export const test = base.extend({
   page: async ({ page }, use, testInfo) => {
+    suppressNativeFilePicker(page);
     await page.context().addCookies([
       {
         name: "cc_cookie",
diff --git a/frontend/editor/src/core/tests/helpers/ui-helpers.ts b/frontend/editor/src/core/tests/helpers/ui-helpers.ts
index 7c08f93f60..353037c106 100644
--- a/frontend/editor/src/core/tests/helpers/ui-helpers.ts
+++ b/frontend/editor/src/core/tests/helpers/ui-helpers.ts
@@ -11,6 +11,37 @@ import { expect, type Page, type Locator } from "@playwright/test";
 
 const MANTINE_MODAL_OVERLAY = ".mantine-Modal-overlay";
 
+/**
+ * Suppress the native OS file picker for the whole page, on every browser.
+ *
+ * Several upload entry points (the FileSidebar "Open from computer" button,
+ * the Mantine `<FileInput>`, AddFileCard, etc.) open a file dialog by clicking
+ * a hidden `<input type="file">`. On firefox/webkit Playwright only intercepts
+ * that dialog while the page has a `filechooser` listener - it toggles
+ * `Page.setInterceptFileChooserDialog` off the event subscription. With no
+ * listener the real OS picker leaks onto the host and hangs the nightly run.
+ *
+ * Registering a (no-op) `filechooser` listener flips that interception on for
+ * every browser, so the dialog is suppressed at the browser level however it
+ * was triggered - a programmatic `.click()`, a `<label>` activation, or
+ * Playwright's own click. We deliberately don't set files in the handler: specs
+ * still drive uploads explicitly via `setInputFiles()`, which sets files
+ * through the protocol regardless of the pending intercepted chooser. This lets
+ * a spec click the real entry-point button while the picker stays mocked
+ * cross-browser - unlike a global `HTMLInputElement.prototype.click` override,
+ * which misses `<label>`-triggered pickers and never enables Playwright's own
+ * interception.
+ *
+ * Installed once per page by the shared test fixtures (stub + live), so no spec
+ * has to opt in.
+ */
+export function suppressNativeFilePicker(page: Page): void {
+  page.on("filechooser", () => {
+    // Interception alone suppresses the native dialog; specs provide the files
+    // themselves via setInputFiles() on the hidden input.
+  });
+}
+
 /**
  * Wait for a Mantine Modal overlay to appear or disappear. Most file pickers,
  * settings dialogs, encrypted-PDF unlock prompts and so on render through
@@ -39,8 +70,10 @@ export async function waitForModalClose(
 /**
  * Upload one or more files through the FileSidebar's "Open from computer"
  * action. The button is always rendered (collapsed or expanded sidebar) and
- * triggers the hidden `data-testid="file-input"` native picker directly -
- * there is no modal to wait for under the post-refactor design.
+ * fires the hidden `data-testid="file-input"`. Its native OS picker is mocked
+ * globally by `suppressNativeFilePicker` (installed by the test fixtures), so
+ * the click is safe on every browser; we then set the files directly on the
+ * input via `setInputFiles`.
  *
  * `setInputFiles` doesn't await the input's async onChange (which writes to
  * IndexedDB via `addFiles`), so without a sync point a caller that follows
@@ -73,8 +106,15 @@ export async function switchToEditorIfViewerMode(page: Page): Promise<void> {
   const goToEditor = page.getByRole("button", {
     name: /go to file editor/i,
   });
+  // The affordance only exists while the workbench is transiently in viewer
+  // mode after an upload. The app can auto-leave viewer mode and detach the
+  // button between our visibility check and the click - the transition timing
+  // differs on firefox/webkit, where the detached button hangs a plain
+  // `click()` for the full actionability timeout. Treat a vanished button as
+  // "already in editor mode": swallow the click failure and let the caller's
+  // run-button assertion catch any genuine regression.
   if (await goToEditor.isVisible({ timeout: 1_000 }).catch(() => false)) {
-    await goToEditor.click();
+    await goToEditor.click({ timeout: 5_000 }).catch(() => {});
   }
 }
 
diff --git a/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts b/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
index ef03c54369..de9d803d25 100644
--- a/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
+++ b/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
@@ -31,6 +31,9 @@ test.describe("Encrypted PDF: unlock then merge", () => {
     await page.goto("/merge");
     await page.waitForLoadState("domcontentloaded");
 
+    // `files-button`'s native picker is mocked globally
+    // (suppressNativeFilePicker), so the click is safe cross-browser; set the
+    // files on the hidden input directly.
     await page.getByTestId("files-button").click();
     await page
       .locator('[data-testid="file-input"]')
diff --git a/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts b/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
index 1f8886bab4..075464c587 100644
--- a/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
@@ -1,5 +1,6 @@
 import { test, expect, type Page } from "@playwright/test";
 import path from "path";
+import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
 // ---------------------------------------------------------------------------
 // Test fixtures — pre-generated keystores in test-fixtures/certs/
@@ -95,6 +96,10 @@ async function uploadCertFile(page: Page, filePath: string) {
 // ---------------------------------------------------------------------------
 test.describe("Certificate Validation — ParticipantView", () => {
   test.beforeEach(async ({ page }) => {
+    // Raw @playwright/test fixture: install the picker suppression directly so
+    // clicking the Mantine <FileInput> button is intercepted cross-browser
+    // (firefox/webkit otherwise leak the native dialog and close the page).
+    suppressNativeFilePicker(page);
     await mockParticipantApis(page);
   });
 
diff --git a/frontend/editor/src/core/tests/stubbed/convert.spec.ts b/frontend/editor/src/core/tests/stubbed/convert.spec.ts
index cd6a60884a..de8fa17a9c 100644
--- a/frontend/editor/src/core/tests/stubbed/convert.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/convert.spec.ts
@@ -8,6 +8,7 @@
 import { test, expect, type Page } from "@playwright/test";
 import path from "path";
 import { mockAppApis } from "@app/tests/helpers/api-stubs";
+import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
 const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
@@ -23,10 +24,10 @@ async function dismissTourTooltip(page: Page) {
 }
 
 // ---------------------------------------------------------------------------
-// Helper: upload a file via the FileSidebar's "Open from computer" action.
-// The button now triggers the native OS picker directly - no modal - and
-// the hidden `data-testid="file-input"` accepts `setInputFiles` in either
-// sidebar state.
+// Helper: upload a file via the FileSidebar's "Open from computer" action. The
+// button's native OS picker is mocked globally by `suppressNativeFilePicker`
+// (test fixtures), so the click is safe cross-browser; the hidden
+// `data-testid="file-input"` then accepts `setInputFiles` in either state.
 // ---------------------------------------------------------------------------
 async function uploadFile(page: Page, filePath: string) {
   await page.getByTestId("files-button").click();
@@ -60,6 +61,11 @@ async function selectToFormat(page: Page, toValue: string) {
 // ---------------------------------------------------------------------------
 test.describe("Convert Tool", () => {
   test.beforeEach(async ({ page }) => {
+    // These specs use the raw @playwright/test fixture, so they don't get the
+    // shared stub-test-base suppression - install it here so the picker click
+    // is intercepted cross-browser (firefox/webkit otherwise leak the native
+    // dialog onto the host and close the page).
+    suppressNativeFilePicker(page);
     await mockAppApis(page);
     await page.goto("/?bypassOnboarding=true");
     await page.waitForSelector('[data-testid="files-button"]', {
diff --git a/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts b/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
index 7e220a3bda..2a202b6cfe 100644
--- a/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
@@ -21,6 +21,7 @@ import { test, expect, type Page } from "@playwright/test";
 import path from "path";
 import fs from "fs";
 import { mockAppApis } from "@app/tests/helpers/api-stubs";
+import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
 const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
 const ENCRYPTED_PDF = path.join(FIXTURES_DIR, "encrypted.pdf");
@@ -63,8 +64,10 @@ function mockRemovePasswordWrongPassword(page: Page) {
 }
 
 async function uploadEncryptedFile(page: Page, filePath: string) {
+  // `files-button`'s native picker is mocked globally
+  // (suppressNativeFilePicker), so the click is safe cross-browser; set the
+  // files on the hidden input directly.
   await page.getByTestId("files-button").click();
-  // No modal flow - `files-button` triggers the native picker directly.
   await page.locator('[data-testid="file-input"]').setInputFiles(filePath);
 }
 
@@ -76,6 +79,10 @@ test.describe.configure({ mode: "serial" });
 
 test.describe("Encrypted PDF Unlock Modal", () => {
   test.beforeEach(async ({ page }) => {
+    // Raw @playwright/test fixture: install the picker suppression directly so
+    // the files-button click is intercepted cross-browser (firefox/webkit
+    // otherwise leak the native dialog onto the host and close the page).
+    suppressNativeFilePicker(page);
     await mockAppApis(page);
     await page.goto("/?bypassOnboarding=true");
     await page.waitForSelector('[data-testid="files-button"]', {
@@ -153,8 +160,9 @@ test.describe("Encrypted PDF Unlock Modal", () => {
   }) => {
     await mockRemovePasswordSuccess(page);
 
+    // `files-button`'s native picker is mocked globally; click it, then set
+    // the files on the hidden input directly.
     await page.getByTestId("files-button").click();
-    // No modal flow - `files-button` triggers the native picker directly.
     await page.locator('[data-testid="file-input"]').setInputFiles([
       {
         name: "encrypted-a.pdf",
diff --git a/frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts b/frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts
index fffa1b4b65..f4948945fe 100644
--- a/frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts
@@ -445,8 +445,17 @@ test.describe("Files page screenshots", () => {
       localStorage.setItem("i18nextLng", "ar-AR");
       localStorage.setItem("stirling-language", "ar-AR");
       localStorage.setItem("stirling-language-source", "user");
-      document.documentElement.setAttribute("dir", "rtl");
-      document.documentElement.setAttribute("lang", "ar-AR");
+      // On webkit, `document.documentElement` is still null when Playwright
+      // runs init scripts, so calling setAttribute directly throws - and that
+      // uncaught error aborts the *following* init script (the IndexedDB seed
+      // in seedFiles), leaving the grid stuck on skeletons. Guard the access
+      // and defer to DOMContentLoaded when the element isn't there yet.
+      const applyDir = () => {
+        document.documentElement.setAttribute("dir", "rtl");
+        document.documentElement.setAttribute("lang", "ar-AR");
+      };
+      if (document.documentElement) applyDir();
+      else document.addEventListener("DOMContentLoaded", applyDir);
     });
   }
 
diff --git a/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts b/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
index 5ba1599386..ce4bbce081 100644
--- a/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
@@ -16,8 +16,9 @@ test.describe("Reader - in-document text search", () => {
     await page.goto("/read");
     await page.waitForLoadState("domcontentloaded");
 
-    // Upload a PDF first so the reader has content. `files-button` now
-    // triggers the native picker directly - no modal flow involved.
+    // Upload a PDF first so the reader has content. The `files-button` native
+    // picker is mocked globally (suppressNativeFilePicker), so the click is
+    // safe cross-browser; set the files on the hidden input directly.
     await page.getByTestId("files-button").click();
     await page.locator('[data-testid="file-input"]').setInputFiles(SAMPLE_PDF);
 
diff --git a/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts b/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
index 573789aca3..1a7486e37a 100644
--- a/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
@@ -96,7 +96,15 @@ test("hovering over text changes the cursor to an I-beam", async ({ page }) => {
 test("Ctrl+C copies selected text to the clipboard", async ({
   page,
   context,
+  browserName,
 }) => {
+  // Reading the clipboard requires the `clipboard-read` permission, which only
+  // chromium supports via `grantPermissions` (firefox throws "Unknown
+  // permission"; webkit can't expose `navigator.clipboard.readText` in tests).
+  test.skip(
+    browserName !== "chromium",
+    "clipboard read/permissions are chromium-only in Playwright",
+  );
   test.setTimeout(60_000);
   await context.grantPermissions(["clipboard-read", "clipboard-write"]);
   const firstPage = await loadSampleAndOpenViewer(page);
@@ -169,7 +177,15 @@ test("right-click on the page does not surface the browser context menu", async
 test("floating Copy menu appears after drag-select and copies", async ({
   page,
   context,
+  browserName,
 }) => {
+  // Verifying the copy result reads the clipboard, which needs the
+  // `clipboard-read` permission - chromium-only in Playwright. The Copy menu's
+  // appearance is covered cross-browser by the right-click test above.
+  test.skip(
+    browserName !== "chromium",
+    "clipboard read/permissions are chromium-only in Playwright",
+  );
   test.setTimeout(60_000);
   await context.grantPermissions(["clipboard-read", "clipboard-write"]);
   const firstPage = await loadSampleAndOpenViewer(page);

From f201aa59152b7e79f2d74a633ea160580b3e6eef Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Mon, 6 Jul 2026 12:39:24 +0100
Subject: [PATCH 06/35] =?UTF-8?q?feat(account-link):=20Phase=202=20?=
 =?UTF-8?q?=E2=80=94=20instance=20metering=20+=20daily=20usage=20sync=20(#?=
 =?UTF-8?q?6839)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Account-link Phase 2: metering + daily usage sync

Phase 1 (already on main) let a self-hosted instance link a SaaS account
and blocked billable work when it was over its limit. It blocked, but it
never actually charged anything. This PR adds the metering + billing
half.

**It's off by default.** Everything sits behind
`stirling.billing.account-link.metering.enabled`, on top of the existing
`stirling.billing.account-link.enabled` master flag. Both have to be on
for any of it to run, so it can't touch production. The billing model
isn't going live yet — this is a dark merge.

### How it works
1. The instance classifies each billable request (API / AI / Automation
— manual PDF editing stays free) and counts it locally into a per-period
counter.
2. Once a day it reports its running totals to SaaS.
3. SaaS bills only the delta since the last report, reusing the existing
charge path (free grant + wallet ledger + Stripe meter). No new money
logic.
4. The portal shows current usage (synced spend plus anything not
reported yet), and when you subscribe it now reflects the new plan right
away instead of waiting for a cache to expire.

### What's worth a reviewer's eyes
- **It can't double-charge.** SaaS only ever bills the delta, refuses a
counter that goes backwards, dedups repeat/late reports on a monotonic
sequence number, and takes a row lock so a duplicate delivery can't
charge twice.
- **The cap is enforced at the instance gate**, not in the charge path
(same as the in-cloud flow). A $0 cap blocks all metered work.
- Page counts use jpdfium so the instance and the cloud agree on the
number that gets billed.
- New SaaS surface: `POST /api/v1/instance/sync`, migrations V25
(`payg_instance_usage`) and V26 (allow the `LINKED_INSTANCE` job
source), and a small `POST /api/v1/payg/wallet/refresh` the portal calls
after checkout.

### Companion PR
Stirling-PDF-SaaS #314 (on `v3`): the checkout edge function so the
embedded Stripe flow finishes in-page instead of reloading, plus a
`Deno.serve` migration so the edge functions actually deploy.

### Testing
Java unit tests (proprietary + saas), portal vitest, and the SaaS
edge-function tests all pass. Branch is merged up to date with main.

### Not done yet (doesn't block this merge — only matters once both
flags are on)
- V25 Supabase twin in the SaaS repo.
- Same in-page checkout fix for the editor's upgrade modal.
- A flags-on smoke test in staging (one real sync round-trip).

---------

Co-authored-by: James Brunton <james@stirlingpdf.com>
---
 .../accountlink/AccountLinkClient.java        | 128 +++++++++--
 .../accountlink/AccountLinkController.java    |  40 +++-
 .../accountlink/AccountLinkProperties.java    |  37 +++
 .../accountlink/AccountLinkSyncState.java     |  46 ++++
 .../AccountLinkSyncStateRepository.java       |   6 +
 .../BillableOperationClassifier.java          |  38 +++-
 .../accountlink/EntitlementCache.java         |  51 +++--
 .../proprietary/accountlink/GateDecision.java |   5 +
 .../accountlink/InstanceEntitlement.java      |  42 +++-
 .../accountlink/InstanceEntitlementGate.java  | 102 +++++++--
 .../InstanceEntitlementInterceptor.java       | 202 ++++++++++++++++-
 .../accountlink/LocalUsageService.java        |  59 +++++
 .../accountlink/MeteredInputSignature.java    |  73 ++++++
 .../MeteredInputSignatureRepository.java      |  15 ++
 .../proprietary/accountlink/UsageCounter.java | 105 +++++++++
 .../accountlink/UsageCounterRepository.java   |  57 +++++
 .../accountlink/UsageMeterService.java        | 115 ++++++++++
 .../accountlink/UsageSyncService.java         | 189 ++++++++++++++++
 .../proprietary/billing/BillingCategory.java  |  22 ++
 .../billing/BillingCategoryClassifier.java    |  29 +++
 .../proprietary/billing/ContentHasher.java    |  68 ++++++
 .../billing/DocumentUnitCalculator.java       |  76 +++++++
 .../proprietary/billing/UnitCalcPolicy.java   |  30 +++
 .../accountlink/AccountLinkClientTest.java    |  70 ++++++
 .../AccountLinkControllerTest.java            |  31 ++-
 .../BillableOperationClassifierTest.java      |  75 +++++--
 .../InstanceEntitlementGateTest.java          | 212 ++++++++++++++++--
 .../InstanceEntitlementGateWiringTest.java    |  14 +-
 .../InstanceEntitlementInterceptorTest.java   | 114 +++++++++-
 .../accountlink/LocalUsageServiceTest.java    |  75 +++++++
 .../accountlink/UsageMeterServiceTest.java    | 133 +++++++++++
 .../accountlink/UsageSyncServiceTest.java     | 171 ++++++++++++++
 .../BillingCategoryClassifierTest.java        |  30 +++
 .../saas/accountlink/InstanceController.java  | 124 +++++++++-
 .../saas/payg/api/PaygWalletController.java   |  27 +++
 .../payg/docs/DefaultDocumentClassifier.java  |  53 ++---
 .../instance/InstanceUsageIngestService.java  | 130 +++++++++++
 .../saas/payg/instance/PaygInstanceUsage.java |  74 ++++++
 .../lineage/ByteHashSignatureExtractor.java   |  35 +--
 .../software/saas/payg/model/JobSource.java   |   9 +-
 .../PaygInstanceUsageRepository.java          |  35 +++
 .../saas/V25__payg_instance_usage.sql         |  35 +++
 ...g_shadow_charge_linked_instance_source.sql |  19 ++
 .../accountlink/InstanceControllerTest.java   | 100 ++++++++-
 .../payg/api/PaygWalletControllerTest.java    |  46 ++++
 .../payg/charge/JobChargeServiceTest.java     |  46 ++++
 .../InstanceUsageIngestServiceTest.java       | 135 +++++++++++
 .../public/locales/en-US/translation.toml     |  14 +-
 frontend/editor/src/portal/api/billing.ts     |  12 +
 frontend/editor/src/portal/api/link.test.ts   |  11 +
 frontend/editor/src/portal/api/link.ts        |  22 ++
 frontend/editor/src/portal/billing/stripe.ts  |   5 +
 .../components/billing/FreePlanView.tsx       |  24 +-
 .../billing/PdfsProcessedCard.stories.tsx     |  14 ++
 .../components/billing/PdfsProcessedCard.tsx  |  27 ++-
 .../billing/StripeCheckoutModal.tsx           | 192 ++++++++++++----
 .../components/billing/SubscribedPlanView.tsx |  11 +-
 .../portal/components/billing/WalletMeter.tsx |  21 +-
 .../src/portal/components/billing/billing.css |  41 ++++
 .../editor/src/portal/mocks/handlers/link.ts  |  14 ++
 frontend/editor/src/portal/mocks/link.ts      |  34 +++
 frontend/editor/src/portal/views/Usage.tsx    |  86 ++++---
 62 files changed, 3552 insertions(+), 304 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncState.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncStateRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/LocalUsageService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignature.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignatureRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounter.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounterRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageMeterService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageSyncService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategory.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategoryClassifier.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/billing/ContentHasher.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/billing/DocumentUnitCalculator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/billing/UnitCalcPolicy.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/accountlink/LocalUsageServiceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageMeterServiceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageSyncServiceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/billing/BillingCategoryClassifierTest.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/instance/InstanceUsageIngestService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/instance/PaygInstanceUsage.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/repository/PaygInstanceUsageRepository.java
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
 create mode 100644 app/saas/src/test/java/stirling/software/saas/payg/instance/InstanceUsageIngestServiceTest.java

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkClient.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkClient.java
index a77f67f8a8..bdd9df10a8 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkClient.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkClient.java
@@ -6,6 +6,7 @@ import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.time.Duration;
+import java.time.LocalDateTime;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -14,25 +15,31 @@ import org.springframework.stereotype.Service;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.proprietary.billing.UnitCalcPolicy;
+
 import tools.jackson.databind.JsonNode;
 import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
 
 /**
  * Outbound calls from a self-hosted instance to its linked SaaS backend (combined-billing "Mode
  * A").
  *
- * <p>Two calls:
+ * <p>Calls:
  *
  * <ul>
  *   <li>{@link #register} — relays the admin's short-lived Supabase JWT to {@code POST
  *       /api/v1/account-link/register}; the SaaS side mints + returns a device credential.
  *   <li>{@link #fetchEntitlement} — authenticates with the stored device credential against {@code
  *       GET /api/v1/instance/entitlement}; what the local gate consults.
+ *   <li>{@link #reportUsage} — daily usage sync ({@code POST /api/v1/instance/sync}); reports
+ *       cumulative units and returns the refreshed entitlement.
+ *   <li>{@link #revokeSelf} — self-revokes the credential on local unlink ({@code POST
+ *       /api/v1/instance/revoke-self}).
  * </ul>
  *
- * <p>Uses {@code java.net.http.HttpClient} (the established self-hosted outbound pattern, see
- * {@code AiEngineClient}). The base URL + client are injectable so tests can stub the SaaS
- * endpoint.
+ * <p>Uses {@code java.net.http.HttpClient} (the established self-hosted outbound pattern; see
+ * {@code AiEngineClient}); base URL + client are injectable so tests can stub SaaS.
  */
 @Slf4j
 @Service
@@ -86,11 +93,9 @@ public class AccountLinkClient {
     }
 
     /**
-     * Authoritative deny (401/403) from the entitlement endpoint — the device credential is revoked
-     * or invalid. Distinct from a transport/server failure (which returns {@code null} and fails
-     * open): the cache must BLOCK billable work on this rather than serve a stale entitled
-     * snapshot. Unchecked so it propagates cleanly through {@link #fetchEntitlement}'s transport
-     * try/catch.
+     * Authoritative deny (401/403) — the device credential is revoked or invalid. Unlike a
+     * transport/server failure (which returns {@code null} and fails open), the cache must BLOCK on
+     * this. Unchecked so it propagates through {@link #fetchEntitlement}'s transport try/catch.
      */
     public static final class RevokedException extends RuntimeException {
         private final int status;
@@ -142,11 +147,9 @@ public class AccountLinkClient {
     }
 
     /**
-     * Revokes this instance's own credential on the SaaS side ({@code POST
-     * /api/v1/instance/revoke-self}), authenticated by the device credential — a credential is
-     * allowed to revoke its own identity. Best-effort: returns {@code false} if SaaS is unreachable
-     * or rejects the call, so the caller (local unlink) can still clear locally and log the orphan
-     * row for follow-up. Idempotent on SaaS (already-revoked → still 204).
+     * Revokes this instance's own credential on the SaaS side, authenticated by that credential.
+     * Best-effort: returns {@code false} if SaaS is unreachable or rejects, so the caller (local
+     * unlink) can still clear locally and log the orphan for follow-up. Idempotent on SaaS.
      */
     public boolean revokeSelf(String deviceId, String deviceSecret) {
         try {
@@ -218,6 +221,63 @@ public class AccountLinkClient {
         }
     }
 
+    /**
+     * Reports the period's cumulative per-category units to {@code POST /api/v1/instance/sync} and
+     * returns the fresh entitlement in the same reply — one round-trip both reports and refreshes.
+     * SaaS bills the delta against its last-seen cumulative, so resending the same totals is
+     * idempotent. Same three outcomes as {@link #fetchEntitlement}; on {@code null} the caller must
+     * not advance its last-synced markers so the usage retries next sync.
+     */
+    public InstanceEntitlement reportUsage(
+            String deviceId,
+            String deviceSecret,
+            long syncSeq,
+            LocalDateTime periodStart,
+            long apiUnits,
+            long aiUnits,
+            long automationUnits) {
+        HttpResponse<String> response;
+        try {
+            ObjectNode root = mapper.createObjectNode();
+            root.put("syncSeq", syncSeq);
+            // Explicit ISO-8601 string so it round-trips regardless of the mapper's time config.
+            root.put("periodStart", periodStart.toString());
+            ObjectNode units = root.putObject("cumulativeUnits");
+            units.put("api", apiUnits);
+            units.put("ai", aiUnits);
+            units.put("automation", automationUnits);
+            String body = mapper.writeValueAsString(root);
+            HttpRequest request =
+                    HttpRequest.newBuilder()
+                            .uri(uri("/api/v1/instance/sync"))
+                            .header(HEADER_DEVICE_ID, deviceId)
+                            .header(HEADER_DEVICE_SECRET, deviceSecret)
+                            .header("Content-Type", "application/json")
+                            .header("Accept", "application/json")
+                            .timeout(timeout())
+                            .POST(HttpRequest.BodyPublishers.ofString(body))
+                            .build();
+            response = send(request);
+        } catch (Exception e) {
+            log.debug("Usage sync failed: {}", e.getMessage());
+            return null;
+        }
+        int status = response.statusCode();
+        if (status == 401 || status == 403) {
+            throw new RevokedException(status);
+        }
+        if (status / 100 != 2) {
+            log.debug("Usage sync returned HTTP {}", status);
+            return null;
+        }
+        try {
+            return parseEntitlement(response.body());
+        } catch (IOException e) {
+            log.debug("Usage sync parse failed: {}", e.getMessage());
+            return null;
+        }
+    }
+
     private InstanceEntitlement parseEntitlement(String body) throws IOException {
         JsonNode root = mapper.readTree(body);
         boolean subscribed = root.path("subscribed").asBoolean(false);
@@ -226,7 +286,45 @@ public class AccountLinkClient {
         Long periodCap =
                 root.hasNonNull("periodCapUnits") ? root.get("periodCapUnits").asLong() : null;
         EntitlementState state = mapState(root.path("state").asText(null));
-        return new InstanceEntitlement(subscribed, freeRemaining, periodSpend, periodCap, state);
+        return new InstanceEntitlement(
+                subscribed,
+                freeRemaining,
+                periodSpend,
+                periodCap,
+                state,
+                parseUnitCalcPolicy(root),
+                parseDateTime(root, "periodStart"),
+                parseDateTime(root, "periodEnd"));
+    }
+
+    /** Parses the nested unit-calc policy; null if absent or any knob is invalid (e.g. zero). */
+    private static UnitCalcPolicy parseUnitCalcPolicy(JsonNode root) {
+        if (!root.hasNonNull("unitCalcPolicy")) {
+            return null;
+        }
+        JsonNode node = root.get("unitCalcPolicy");
+        try {
+            return new UnitCalcPolicy(
+                    node.path("docPagesPerUnit").asInt(),
+                    node.path("docBytesPerUnit").asLong(),
+                    node.path("minChargeUnits").asInt(),
+                    node.path("fileUnitCap").asInt());
+        } catch (RuntimeException e) {
+            // Malformed policy → degrade to "none" rather than fail the whole entitlement parse.
+            return null;
+        }
+    }
+
+    /** ISO date-time field → LocalDateTime; null if absent or unparseable. */
+    private static LocalDateTime parseDateTime(JsonNode root, String field) {
+        if (!root.hasNonNull(field)) {
+            return null;
+        }
+        try {
+            return LocalDateTime.parse(root.get(field).asText(null));
+        } catch (RuntimeException e) {
+            return null;
+        }
     }
 
     /** Maps the SaaS state string to our coarse enum; unrecognised → UNKNOWN. */
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkController.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkController.java
index 1d1a8aa77d..52af366df4 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkController.java
@@ -2,6 +2,7 @@ package stirling.software.proprietary.accountlink;
 
 import java.io.IOException;
 
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Profile;
 import org.springframework.http.HttpStatus;
@@ -23,7 +24,9 @@ import lombok.extern.slf4j.Slf4j;
  * <p>The portal (served from this same origin, admin authenticated by the existing self-hosted
  * security chain) calls these. {@code POST /link} relays the admin's Supabase JWT to the SaaS
  * backend, which mints + returns a device credential we store locally. {@code GET /status} backs
- * the portal's link card.
+ * the portal's link card; {@code GET /usage} exposes locally-accrued unsynced usage the portal adds
+ * to SaaS-synced spend; {@code POST /sync-now} forces an immediate usage sync (ops "reconcile now"
+ * / test aid).
  *
  * <p>Admin-only, {@code @Profile("!saas")}, gated behind {@code
  * stirling.billing.account-link.enabled} — off → bean absent → 404.
@@ -38,9 +41,17 @@ import lombok.extern.slf4j.Slf4j;
 public class AccountLinkController {
 
     private final AccountLinkService service;
+    private final LocalUsageService localUsageService;
+    // Present only when metering is on (its own flag); absent → /sync-now reports 409.
+    private final ObjectProvider<UsageSyncService> syncServiceProvider;
 
-    public AccountLinkController(AccountLinkService service) {
+    public AccountLinkController(
+            AccountLinkService service,
+            LocalUsageService localUsageService,
+            ObjectProvider<UsageSyncService> syncServiceProvider) {
         this.service = service;
+        this.localUsageService = localUsageService;
+        this.syncServiceProvider = syncServiceProvider;
     }
 
     /** {@code supabaseJwt} is the admin's short-lived token the portal already holds. */
@@ -85,4 +96,29 @@ public class AccountLinkController {
         service.unlink();
         return ResponseEntity.noContent().build();
     }
+
+    /**
+     * Locally accrued usage not yet reported to SaaS — the portal adds it to the SaaS-synced spend
+     * so "current usage" includes work done since the last daily sync.
+     */
+    @GetMapping("/usage")
+    public ResponseEntity<LocalUsageService.LocalUsage> usage() {
+        return ResponseEntity.ok(localUsageService.currentPeriodUnsynced());
+    }
+
+    /**
+     * Forces an immediate usage sync to SaaS — the same work the daily scheduler does. An admin
+     * "reconcile now" action (and a test aid so you don't wait on the scheduler). Idempotent:
+     * re-reports the current cumulative, so a repeat trigger bills nothing. {@code 204} once run;
+     * {@code 409} when metering is off (the sync bean is absent).
+     */
+    @PostMapping("/sync-now")
+    public ResponseEntity<Void> syncNow() {
+        UsageSyncService sync = syncServiceProvider.getIfAvailable();
+        if (sync == null) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        }
+        sync.syncNow();
+        return ResponseEntity.noContent().build();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkProperties.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkProperties.java
index c12e56f06d..6d1f1fb151 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkProperties.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkProperties.java
@@ -1,5 +1,7 @@
 package stirling.software.proprietary.accountlink;
 
+import java.time.Duration;
+
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.stereotype.Component;
 
@@ -36,4 +38,39 @@ public class AccountLinkProperties {
 
     /** Connect/read timeout for the outbound SaaS calls. */
     private int requestTimeoutSeconds = 10;
+
+    /** Phase 2 usage metering + daily sync. Keyed under {@code …account-link.metering.*}. */
+    private final Metering metering = new Metering();
+
+    /**
+     * Dedicated billing switch, <b>separate</b> from {@link #enabled} so the link plumbing can be
+     * enabled (e.g. to test linking) without ever turning on real usage metering, reporting, or cap
+     * enforcement. Both default off; metering requires the master flag too. This is the production
+     * safety key — flipping it on is what actually bills linked instances.
+     */
+    @Getter
+    @Setter
+    public static class Metering {
+
+        /** Turns on usage metering, the daily sync, and cap enforcement. Default off. */
+        private boolean enabled = false;
+
+        /**
+         * How often the instance syncs usage + refreshes entitlement (matches the licence sync).
+         */
+        private int syncIntervalHours = 24;
+
+        /**
+         * Block billable work after this many days with no successful sync (fail-open → closed).
+         */
+        private int graceDays = 3;
+
+        /**
+         * Dedup window for identical input sets. A re-run of the same inputs within this window is
+         * treated as workflow chaining and not re-charged; the same inputs run again after it are
+         * billed afresh. Mirrors the cloud's {@code payg.lineage.workflow-window} so the same op
+         * costs the same on the instance and in the cloud.
+         */
+        private Duration workflowWindow = Duration.ofMinutes(5);
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncState.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncState.java
new file mode 100644
index 0000000000..fbac6a8603
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncState.java
@@ -0,0 +1,46 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * Singleton row holding this instance's daily-sync bookkeeping (combined-billing "Mode A").
+ *
+ * <p>{@link #lastSyncSeq} is reserved (incremented + persisted) <em>before</em> each report so it
+ * is strictly monotonic across restarts and partial failures — SaaS dedups replays by comparing it,
+ * so a never-decreasing seq is the contract. {@link #lastSuccessAt} is the wall-clock of the last
+ * sync SaaS accepted and drives the fail-open→closed grace window.
+ *
+ * <p>Auto-created by Hibernate ({@code ddl-auto=update}); written only by the flag-gated sync.
+ */
+@Entity
+@Table(name = "account_link_sync_state")
+@Getter
+@Setter
+@NoArgsConstructor
+public class AccountLinkSyncState {
+
+    /** One instance links to one team → one bookkeeping row. */
+    public static final long SINGLETON_ID = 1L;
+
+    @Id private Long id;
+
+    // columnDefinition default keeps the ddl-auto ADD COLUMN safe on a populated external Postgres.
+    @Column(
+            name = "last_sync_seq",
+            nullable = false,
+            columnDefinition = "bigint not null default 0")
+    private long lastSyncSeq;
+
+    /** Null until the first sync SaaS accepts. */
+    @Column(name = "last_success_at")
+    private LocalDateTime lastSuccessAt;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncStateRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncStateRepository.java
new file mode 100644
index 0000000000..15b5e3842d
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/AccountLinkSyncStateRepository.java
@@ -0,0 +1,6 @@
+package stirling.software.proprietary.accountlink;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+/** Persistence for the singleton {@link AccountLinkSyncState} (combined-billing "Mode A"). */
+public interface AccountLinkSyncStateRepository extends JpaRepository<AccountLinkSyncState, Long> {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/BillableOperationClassifier.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/BillableOperationClassifier.java
index 136e4c3214..476fbd111a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/BillableOperationClassifier.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/BillableOperationClassifier.java
@@ -3,14 +3,26 @@ package stirling.software.proprietary.accountlink;
 import jakarta.servlet.http.HttpServletRequest;
 
 import stirling.software.common.service.InternalApiClient;
+import stirling.software.proprietary.billing.BillingCategory;
+import stirling.software.proprietary.billing.BillingCategoryClassifier;
 
 /**
- * Classifies a request as <b>billable</b> (AI / automation) or free (a manual tool).
+ * Buckets a request into a {@link BillingCategory} for the account-link gate + meter, using only
+ * HTTP-level signals (no dependency on the saas module):
  *
- * <p>Mirrors the saas billing categorisation at a coarse level, without depending on the saas
- * module: billable = the AI surface ({@code /api/v1/ai/**}) or any request carrying the automation
- * marker header ({@link InternalApiClient#AUTOMATION_HEADER}, set on pipeline / workflow / policy
- * sub-steps). Everything else — interactive manual PDF tools — is always free.
+ * <ul>
+ *   <li><b>AUTOMATION</b> — the automation marker header ({@link
+ *       InternalApiClient#AUTOMATION_HEADER}, set on pipeline / workflow / policy sub-steps);
+ *   <li><b>AI</b> — the AI surface ({@code /api/v1/ai/**});
+ *   <li><b>API</b> — an API-key authenticated tool call;
+ *   <li><b>BYPASSED</b> — a manual interactive tool call, never billed.
+ * </ul>
+ *
+ * <p>Same precedence as the SaaS classifier (AUTOMATION → AI → API → BYPASSED) via the shared
+ * {@link BillingCategoryClassifier}; the AI signal is resolved by path prefix rather than the
+ * saas-only {@code @RequiresFeature} annotation. The {@code apiKey} signal is supplied by the
+ * caller (resolved from the security context), so this class stays free of any security-type
+ * dependency.
  */
 public final class BillableOperationClassifier {
 
@@ -18,16 +30,22 @@ public final class BillableOperationClassifier {
 
     private BillableOperationClassifier() {}
 
-    public static boolean isBillable(HttpServletRequest request) {
-        if (request.getHeader(InternalApiClient.AUTOMATION_HEADER) != null) {
-            return true;
-        }
+    /**
+     * @param apiKey whether the request authenticated via an API key (an {@code
+     *     ApiKeyAuthenticationToken} principal), resolved by the caller from the security context.
+     */
+    public static BillingCategory categorize(HttpServletRequest request, boolean apiKey) {
+        boolean automation = request.getHeader(InternalApiClient.AUTOMATION_HEADER) != null;
+        return BillingCategoryClassifier.classify(automation, isAiSurface(request), apiKey);
+    }
+
+    private static boolean isAiSurface(HttpServletRequest request) {
         String uri = request.getRequestURI();
         if (uri == null) {
             return false;
         }
         // Prefix-match the AI surface (not a loose substring contains), stripping a deployment
-        // context path so /<ctx>/api/v1/ai/** still classifies as billable.
+        // context path so /<ctx>/api/v1/ai/** still classifies as AI.
         String ctx = request.getContextPath();
         String path =
                 ctx != null && !ctx.isEmpty() && uri.startsWith(ctx)
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/EntitlementCache.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/EntitlementCache.java
index 63818c1f98..898fb54b3a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/EntitlementCache.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/EntitlementCache.java
@@ -12,18 +12,13 @@ import org.springframework.stereotype.Service;
 import lombok.extern.slf4j.Slf4j;
 
 /**
- * Caches the linked team's entitlement so the request-time gate does not call the SaaS backend on
- * every billable request. Single-slot (one instance = one linked team), TTL-based.
+ * Caches the linked team's entitlement so the request-time gate needn't call SaaS on every billable
+ * request. Single-slot (one instance = one linked team), TTL-based.
  *
- * <p>Fail-open friendly for TRANSPORT failures: {@link #current()} returns the freshest snapshot it
- * has, even if a refresh just failed; it returns {@link Optional#empty()} only when nothing has
- * ever been fetched <i>and</i> the latest refresh failed (the gate treats empty as "unknown →
- * allow").
- *
- * <p>But an AUTHORITATIVE deny (revoked/invalid credential → {@link
- * AccountLinkClient.RevokedException}) is NOT a transport failure: the snapshot is replaced with a
- * {@link EntitlementState#REVOKED} blocked entitlement so the gate stops billable work immediately
- * rather than serving a stale entitled snapshot.
+ * <p>A transport failure fails open — {@link #current()} keeps serving the freshest snapshot it has
+ * and returns {@link Optional#empty()} ("unknown → allow") only when nothing was ever fetched. An
+ * authoritative deny ({@link AccountLinkClient.RevokedException}) does not: the snapshot is
+ * replaced with a {@link EntitlementState#REVOKED} entitlement so the gate blocks immediately.
  */
 @Slf4j
 @Service
@@ -63,9 +58,8 @@ public class EntitlementCache {
      * not linked or the SaaS side is unreachable and we have no prior snapshot.
      */
     public Optional<InstanceEntitlement> current() {
-        // Single-flight: when stale, exactly one thread refreshes (blocking on the SaaS
-        // call) while concurrent callers serve the last snapshot — no thundering herd of
-        // synchronous round-trips on the billable hot path. Safe because the gate fails open.
+        // Single-flight: when stale, exactly one thread refreshes while concurrent callers serve
+        // the last snapshot — no thundering herd of round-trips on the billable hot path.
         if (isStale(snapshot) && refreshing.compareAndSet(false, true)) {
             try {
                 refresh();
@@ -77,16 +71,15 @@ public class EntitlementCache {
     }
 
     private boolean isStale(Snapshot snap) {
-        // fetchedAt is the last *attempt* time (stamped on success AND failure), so a failed
-        // fetch backs off for a full TTL instead of every billable request re-triggering a
-        // blocking round-trip against a dead/slow SaaS endpoint.
+        // fetchedAt is the last *attempt* time (stamped on success and failure), so a failed fetch
+        // backs off a full TTL instead of every request re-triggering a round-trip to a dead SaaS.
         return Duration.between(snap.fetchedAt(), Instant.now()).compareTo(ttl) >= 0;
     }
 
     /**
-     * Pulls a fresh snapshot. Keeps the previous entitlement on a TRANSPORT failure (fail-open) but
-     * still stamps the attempt time so re-fetches throttle to the TTL; on an AUTHORITATIVE deny
-     * (revoked credential) replaces it with a blocked snapshot so the gate stops billable work.
+     * Pulls a fresh snapshot. On a transport failure keeps the previous entitlement but stamps the
+     * attempt time so re-fetches throttle to the TTL; on an authoritative deny replaces it with a
+     * blocked snapshot.
      */
     void refresh() {
         Optional<DeviceCredential> cred = credentialStore.get();
@@ -101,15 +94,15 @@ public class EntitlementCache {
             if (fresh != null) {
                 snapshot = new Snapshot(fresh, Instant.now());
             } else {
-                // Unreachable / server error: keep the last known entitlement (may be null) but
-                // stamp the attempt so we don't hammer SaaS; the gate fails open in the meantime.
+                // Unreachable / server error: keep the last known entitlement but stamp the attempt
+                // so we don't hammer SaaS; the gate fails open meanwhile.
                 log.debug(
                         "Entitlement refresh failed; reusing last known snapshot, backing off a TTL");
                 snapshot = new Snapshot(snapshot.entitlement(), Instant.now());
             }
         } catch (AccountLinkClient.RevokedException e) {
-            // Authoritative deny — credential revoked/invalid. Do NOT fail open: block immediately
-            // rather than serving the stale entitled snapshot until the next unlink.
+            // Authoritative deny — block immediately rather than serving the stale entitled
+            // snapshot.
             log.info(
                     "Entitlement denied (HTTP {}); blocking billable work for the revoked credential",
                     e.status());
@@ -121,4 +114,14 @@ public class EntitlementCache {
     public void invalidate() {
         snapshot = new Snapshot(snapshot.entitlement(), Instant.EPOCH);
     }
+
+    /**
+     * Seeds the cache with an entitlement obtained out-of-band (the sync reply carries a fresh
+     * one), saving a redundant fetch. No-op on null.
+     */
+    public void accept(InstanceEntitlement fresh) {
+        if (fresh != null) {
+            snapshot = new Snapshot(fresh, Instant.now());
+        }
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/GateDecision.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/GateDecision.java
index 677183278b..87b4ddcde9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/GateDecision.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/GateDecision.java
@@ -16,6 +16,11 @@ public record GateDecision(boolean allowed, Reason reason) {
         ENTITLED,
         /** Entitlement source unreachable — fail open, allow. */
         FAIL_OPEN,
+        /**
+         * Linked + metering, but SaaS has been unreachable past the grace window — block (the
+         * fail-open backstop expired) so unbounded free/unbilled billable work can't continue.
+         */
+        GRACE_EXPIRED,
         /** Not linked — block billable work; FE should prompt to link. */
         NOT_LINKED,
         /** Linked but over the limit / no subscription — block billable work. */
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlement.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlement.java
index 6445d886e9..8760239957 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlement.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlement.java
@@ -1,19 +1,53 @@
 package stirling.software.proprietary.accountlink;
 
+import java.time.LocalDateTime;
+
+import stirling.software.proprietary.billing.UnitCalcPolicy;
+
 /**
- * Cached, proprietary-local view of the SaaS {@code GET /api/v1/instance/entitlement} response —
- * just the fields the gate needs. Mirrors the saas {@code EntitlementResponse} shape but carries no
- * saas types.
+ * Cached, proprietary-local view of the SaaS {@code GET /api/v1/instance/entitlement} response.
+ * Mirrors the saas {@code EntitlementResponse} shape but carries no saas types.
+ *
+ * <p>The first five fields are what the <b>gate</b> enforces against; the trailing three are the
+ * metering inputs (Phase 2) the instance uses to cost + bucket its own usage and reset its
+ * per-period counters. The 5-arg constructor builds a gate-only view (metering fields null) for the
+ * revoked sentinel and unit tests that don't exercise metering.
  *
  * @param subscribed team has an active subscription
  * @param freeRemainingUnits remaining free-pool units (>0 means free work is available)
  * @param periodSpendUnits paid units spent this period
  * @param periodCapUnits paid cap for the period; {@code null} = uncapped
  * @param state coarse state classification (see {@link EntitlementState})
+ * @param unitCalcPolicy doc-unit pricing knobs for local unit computation; {@code null} if not
+ *     supplied (older SaaS / gate-only sentinel)
+ * @param periodStart inclusive start of the current billing period; {@code null} if not supplied
+ * @param periodEnd exclusive end of the current billing period; {@code null} if not supplied
  */
 public record InstanceEntitlement(
         boolean subscribed,
         long freeRemainingUnits,
         long periodSpendUnits,
         Long periodCapUnits,
-        EntitlementState state) {}
+        EntitlementState state,
+        UnitCalcPolicy unitCalcPolicy,
+        LocalDateTime periodStart,
+        LocalDateTime periodEnd) {
+
+    /** Gate-only view with no metering config — used by the revoked sentinel and gate tests. */
+    public InstanceEntitlement(
+            boolean subscribed,
+            long freeRemainingUnits,
+            long periodSpendUnits,
+            Long periodCapUnits,
+            EntitlementState state) {
+        this(
+                subscribed,
+                freeRemainingUnits,
+                periodSpendUnits,
+                periodCapUnits,
+                state,
+                null,
+                null,
+                null);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementGate.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementGate.java
index c975bad055..018684b73f 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementGate.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementGate.java
@@ -1,5 +1,6 @@
 package stirling.software.proprietary.accountlink;
 
+import java.time.LocalDateTime;
 import java.util.Optional;
 
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -15,14 +16,17 @@ import org.springframework.stereotype.Service;
  *   <li>Flag off → always allow (feature inert).
  *   <li>Manual tool → always allow (manual tools are free, never metered).
  *   <li>Billable + not linked → block with {@code NOT_LINKED} ("link to activate").
- *   <li>Billable + linked + entitlement unknown (unreachable) → <b>fail open</b>, allow.
+ *   <li>Billable + linked + entitlement unknown (unreachable) → <b>fail open</b>, allow — unless
+ *       metering is on and SaaS has been unreachable past the grace window, then block with {@code
+ *       GRACE_EXPIRED} so the fail-open can't grant unbounded free/unbilled work forever.
  *   <li>Billable + linked + entitled → allow.
  *   <li>Billable + linked + credential revoked → block with {@code REVOKED}.
  *   <li>Billable + linked + over limit → block with {@code OVER_LIMIT}.
  * </ol>
  *
- * <p>The decision logic is the pure static {@link #decide}; the Spring wrapper just supplies the
- * live flag / linked-state / entitlement. This is the unit-tested core.
+ * <p>The decision logic is the pure static {@link #decide}; the Spring wrapper supplies the live
+ * flag / linked-state / entitlement and computes whether the grace window has expired. This is the
+ * unit-tested core.
  */
 @Service
 @Profile("!saas")
@@ -32,14 +36,20 @@ public class InstanceEntitlementGate {
     private final AccountLinkProperties properties;
     private final DeviceCredentialStore credentialStore;
     private final EntitlementCache entitlementCache;
+    private final AccountLinkSyncStateRepository syncStateRepository;
+    private final LocalUsageService localUsageService;
 
     public InstanceEntitlementGate(
             AccountLinkProperties properties,
             DeviceCredentialStore credentialStore,
-            EntitlementCache entitlementCache) {
+            EntitlementCache entitlementCache,
+            AccountLinkSyncStateRepository syncStateRepository,
+            LocalUsageService localUsageService) {
         this.properties = properties;
         this.credentialStore = credentialStore;
         this.entitlementCache = entitlementCache;
+        this.syncStateRepository = syncStateRepository;
+        this.localUsageService = localUsageService;
     }
 
     /** Evaluates the gate for a request, resolving live state from the store + cache. */
@@ -53,18 +63,39 @@ public class InstanceEntitlementGate {
         boolean linked = credentialStore.isLinked();
         Optional<InstanceEntitlement> entitlement =
                 linked ? entitlementCache.current() : Optional.empty();
-        return decide(true, true, linked, entitlement);
+        boolean graceExpired = linked && entitlement.isEmpty() && isGraceExpired();
+        // Deplete the applicable ceiling — free grant (unsubscribed) or spend cap (capped
+        // subscription) — by local usage not yet synced, so the gate stops in real time instead of
+        // overshooting until the next sync. An uncapped subscription has no ceiling to deplete → 0.
+        long pendingUnsynced =
+                entitlement.map(InstanceEntitlementGate::depletesCeiling).orElse(false)
+                        ? localUsageService.currentPeriodUnsynced().totalUnsyncedUnits()
+                        : 0L;
+        return decide(true, true, linked, entitlement, graceExpired, pendingUnsynced);
+    }
+
+    /** Whether local unsynced usage pushes against a real ceiling (free grant or a spend cap). */
+    private static boolean depletesCeiling(InstanceEntitlement e) {
+        return !e.subscribed() || e.periodCapUnits() != null;
     }
 
     /**
      * Pure decision function — no Spring, no I/O. {@code entitlement} empty means "unknown"
-     * (unreachable): when linked, that fails open.
+     * (unreachable): when linked, that fails open unless {@code graceExpired} (the metering grace
+     * window elapsed with no authoritative contact), in which case it blocks.
+     *
+     * @param pendingUnsyncedUnits billable units accrued locally since the last sync — depletes the
+     *     free grant (unsubscribed) or the spend cap (capped subscription) in real time so the gate
+     *     stops without waiting for the next sync (0 for uncapped-subscribed / unknown-entitlement
+     *     cases, where it has no effect).
      */
     public static GateDecision decide(
             boolean flagEnabled,
             boolean billable,
             boolean linked,
-            Optional<InstanceEntitlement> entitlement) {
+            Optional<InstanceEntitlement> entitlement,
+            boolean graceExpired,
+            long pendingUnsyncedUnits) {
         if (!flagEnabled) {
             return GateDecision.allow(GateDecision.Reason.FLAG_OFF);
         }
@@ -75,30 +106,69 @@ public class InstanceEntitlementGate {
             return GateDecision.block(GateDecision.Reason.NOT_LINKED);
         }
         if (entitlement.isEmpty()) {
-            // Linked but entitlement source unreachable — never hard-block billable work on our
-            // inability to reach billing.
-            return GateDecision.allow(GateDecision.Reason.FAIL_OPEN);
+            // Linked but entitlement unreachable: fail open, unless the grace window has expired
+            // (so
+            // the fail-open can't grant unbounded unbilled work forever).
+            return graceExpired
+                    ? GateDecision.block(GateDecision.Reason.GRACE_EXPIRED)
+                    : GateDecision.allow(GateDecision.Reason.FAIL_OPEN);
         }
         InstanceEntitlement e = entitlement.get();
         if (e.state() == EntitlementState.REVOKED) {
             // Credential revoked/invalid (authoritative deny) — block, distinct from over-limit.
             return GateDecision.block(GateDecision.Reason.REVOKED);
         }
-        return entitled(e)
+        return entitled(e, pendingUnsyncedUnits)
                 ? GateDecision.allow(GateDecision.Reason.ENTITLED)
                 : GateDecision.block(GateDecision.Reason.OVER_LIMIT);
     }
 
+    /**
+     * True when metering is on and it's been {@code graceDays} since the last authoritative contact
+     * (last successful sync, or link time if never synced). {@code graceDays <= 0} or metering off
+     * disables the backstop.
+     */
+    private boolean isGraceExpired() {
+        AccountLinkProperties.Metering metering = properties.getMetering();
+        if (!metering.isEnabled() || metering.getGraceDays() <= 0) {
+            return false;
+        }
+        LocalDateTime reference = lastAuthoritativeContact();
+        if (reference == null) {
+            return false; // can't determine elapsed time → fail open
+        }
+        return reference.plusDays(metering.getGraceDays()).isBefore(LocalDateTime.now());
+    }
+
+    private LocalDateTime lastAuthoritativeContact() {
+        LocalDateTime lastSuccess =
+                syncStateRepository
+                        .findById(AccountLinkSyncState.SINGLETON_ID)
+                        .map(AccountLinkSyncState::getLastSuccessAt)
+                        .orElse(null);
+        if (lastSuccess != null) {
+            return lastSuccess;
+        }
+        return credentialStore.get().map(DeviceCredential::getLinkedAt).orElse(null);
+    }
+
     /** True when the snapshot permits billable work (subscribed, free pool left, or within cap). */
-    private static boolean entitled(InstanceEntitlement e) {
+    private static boolean entitled(InstanceEntitlement e, long pendingUnsyncedUnits) {
         if (e.state() == EntitlementState.OVER_LIMIT || e.state() == EntitlementState.REVOKED) {
             return false;
         }
         if (e.subscribed()) {
-            // Subscribed: allowed unless a period cap is set and exceeded.
-            return e.periodCapUnits() == null || e.periodSpendUnits() < e.periodCapUnits();
+            if (e.periodCapUnits() == null) {
+                return true; // uncapped subscription
+            }
+            // Project the cap the way the grant is projected: synced paid spend plus the paid part
+            // of local usage not yet synced (free grant is consumed first, so only the excess
+            // bills) — stops at the cap in real time instead of overshooting until the next sync.
+            long pendingPaid = Math.max(0, pendingUnsyncedUnits - e.freeRemainingUnits());
+            return e.periodSpendUnits() + pendingPaid < e.periodCapUnits();
         }
-        // Unsubscribed: only the free pool covers billable work.
-        return e.freeRemainingUnits() > 0;
+        // Unsubscribed: free pool must cover SaaS-charged usage (in freeRemainingUnits) plus local
+        // usage not yet synced — deplete by the pending delta so we stop at the grant in real time.
+        return e.freeRemainingUnits() - pendingUnsyncedUnits > 0;
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
index 8597813a85..285943ee49 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
@@ -1,27 +1,51 @@
 package stirling.software.proprietary.accountlink;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Profile;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.multipart.MultipartHttpServletRequest;
 import org.springframework.web.servlet.HandlerInterceptor;
+import org.springframework.web.util.WebUtils;
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.jpdfium.PdfDocument;
+import stirling.software.proprietary.billing.BillingCategory;
+import stirling.software.proprietary.billing.ContentHasher;
+import stirling.software.proprietary.billing.DocumentUnitCalculator;
+import stirling.software.proprietary.billing.DocumentUnitCalculator.FileSize;
+import stirling.software.proprietary.billing.UnitCalcPolicy;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
+
 /**
- * Request-time gate for combined-billing "Mode A". Runs before billable (AI / automation) work and
- * blocks it when the instance is unlinked or over its limit; manual tools pass straight through.
+ * Request-time gate + meter for combined-billing "Mode A". {@code preHandle} blocks billable (API /
+ * AI / automation) work when the instance is unlinked or over its limit; manual tools pass through.
+ * {@code afterCompletion} meters a successful billable op into the per-period cumulative counter.
  *
- * <p>Blocking responds {@code 402 Payment Required} with a small machine-readable body — {@code
- * {"error":"ACCOUNT_LINK_REQUIRED","reason":"NOT_LINKED"}} — that the FE maps to a "link to
- * activate" prompt (the same DownstreamEntitlementError-style envelope already used for saas limit
- * responses). Fail-open and flag-off both let the request continue.
- *
- * <p>Gated + {@code @Profile("!saas")}; when the flag is off the bean is absent and the {@link
- * AccountLinkWebMvcConfig} never registers it, so there is no per-request cost.
+ * <p>Blocking responds {@code 402} with a machine-readable body the FE maps to a "link to activate"
+ * prompt; fail-open and flag-off both let the request continue. Metering is separately gated behind
+ * {@code …metering.enabled} via {@link ObjectProvider} — switch off means the {@link
+ * UsageMeterService} bean is absent and nothing accrues, while the gate still works.
  */
 @Slf4j
 @Component
@@ -29,10 +53,23 @@ import lombok.extern.slf4j.Slf4j;
 @ConditionalOnProperty(name = "stirling.billing.account-link.enabled", havingValue = "true")
 public class InstanceEntitlementInterceptor implements HandlerInterceptor {
 
-    private final InstanceEntitlementGate gate;
+    private static final String ATTR_CATEGORY =
+            InstanceEntitlementInterceptor.class.getName() + ".category";
 
-    public InstanceEntitlementInterceptor(InstanceEntitlementGate gate) {
+    private final InstanceEntitlementGate gate;
+    private final EntitlementCache entitlementCache;
+    private final ObjectProvider<UsageMeterService> meterProvider;
+    private final TempFileManager tempFileManager;
+
+    public InstanceEntitlementInterceptor(
+            InstanceEntitlementGate gate,
+            EntitlementCache entitlementCache,
+            ObjectProvider<UsageMeterService> meterProvider,
+            TempFileManager tempFileManager) {
         this.gate = gate;
+        this.entitlementCache = entitlementCache;
+        this.meterProvider = meterProvider;
+        this.tempFileManager = tempFileManager;
     }
 
     @Override
@@ -41,7 +78,13 @@ public class InstanceEntitlementInterceptor implements HandlerInterceptor {
             throws Exception {
         GateDecision decision;
         try {
-            decision = gate.evaluate(BillableOperationClassifier.isBillable(request));
+            // API-key tool calls are billable (category API); stash the category for the meter.
+            boolean apiKey =
+                    SecurityContextHolder.getContext().getAuthentication()
+                            instanceof ApiKeyAuthenticationToken;
+            BillingCategory category = BillableOperationClassifier.categorize(request, apiKey);
+            request.setAttribute(ATTR_CATEGORY, category);
+            decision = gate.evaluate(category != BillingCategory.BYPASSED);
         } catch (RuntimeException e) {
             // Fail open: an inability to resolve entitlement (e.g. a DB or SaaS blip) must never
             // turn into a hard block on billable work.
@@ -62,4 +105,139 @@ public class InstanceEntitlementInterceptor implements HandlerInterceptor {
                                 + "\"}");
         return false;
     }
+
+    @Override
+    public void afterCompletion(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            Object handler,
+            Exception ex) {
+        // Meter successful billable ops only.
+        if (ex != null || response.getStatus() >= 400) {
+            return;
+        }
+        UsageMeterService meter = meterProvider.getIfAvailable();
+        if (meter == null) {
+            return; // metering switch off
+        }
+        if (!(request.getAttribute(ATTR_CATEGORY) instanceof BillingCategory category)
+                || category == BillingCategory.BYPASSED) {
+            return;
+        }
+        try {
+            InstanceEntitlement ent = entitlementCache.current().orElse(null);
+            if (ent == null || ent.unitCalcPolicy() == null || ent.periodStart() == null) {
+                // Not yet synced (no policy/period) — can't compute units; skip until next sync.
+                return;
+            }
+            meterRequest(request, category, ent, meter);
+        } catch (RuntimeException e) {
+            // Metering must never affect the response that already completed.
+            log.debug("Usage metering failed for {}", request.getRequestURI(), e);
+        }
+    }
+
+    /**
+     * Computes doc-units (page + byte axes) and the input-set signature, then accrues. The instance
+     * is authoritative for units (SaaS bills the delta and never sees the file), so a page-heavy
+     * but small PDF must be page-counted or it under-bills. A fileless op has no input identity —
+     * null signature (no dedup), billed the 1-unit floor each time.
+     */
+    private void meterRequest(
+            HttpServletRequest request,
+            BillingCategory category,
+            InstanceEntitlement ent,
+            UsageMeterService meter) {
+        UnitCalcPolicy policy = ent.unitCalcPolicy();
+        MultipartHttpServletRequest mreq =
+                WebUtils.getNativeRequest(request, MultipartHttpServletRequest.class);
+        if (mreq == null) {
+            long fileless = DocumentUnitCalculator.unitsForFile(0, 0, policy);
+            meter.accrue(ent.periodStart(), category, fileless, null);
+            return;
+        }
+        List<TempFile> temps = new ArrayList<>();
+        try {
+            List<FileSize> sizes = new ArrayList<>();
+            List<String> hashes = new ArrayList<>();
+            int fileCount = 0;
+            for (List<MultipartFile> files : mreq.getMultiFileMap().values()) {
+                for (MultipartFile f : files) {
+                    fileCount++;
+                    try {
+                        TempFile temp = tempFileManager.createManagedTempFile(".bin");
+                        temps.add(temp);
+                        // Hash in the same pass that writes the temp file — one read of the upload,
+                        // not a second full read just to fingerprint it.
+                        MessageDigest digest = ContentHasher.newSha256();
+                        try (InputStream in = f.getInputStream();
+                                DigestOutputStream out =
+                                        new DigestOutputStream(
+                                                Files.newOutputStream(temp.getPath()), digest)) {
+                            in.transferTo(out);
+                        }
+                        sizes.add(new FileSize(pageCount(temp.getPath(), f), f.getSize()));
+                        hashes.add(ContentHasher.toHex(digest.digest()));
+                    } catch (IOException | RuntimeException perFile) {
+                        // Couldn't materialise/hash this input — bill on bytes only and, by leaving
+                        // it out of `hashes`, drop dedup for the whole op rather than risk a
+                        // mismatch.
+                        log.debug(
+                                "Metering materialise/hash failed for {}; bytes-only",
+                                f.getOriginalFilename());
+                        sizes.add(new FileSize(0, f.getSize()));
+                    }
+                }
+            }
+            long units =
+                    sizes.isEmpty()
+                            ? DocumentUnitCalculator.unitsForFile(0, 0, policy)
+                            : DocumentUnitCalculator.unitsForGroup(sizes, policy);
+            // Only dedup when every input hashed; a partial signature could collide with a
+            // different input set, so fall back to no-dedup (bill it) if any file failed.
+            String opSignature =
+                    fileCount > 0 && hashes.size() == fileCount ? opSignature(hashes) : null;
+            meter.accrue(ent.periodStart(), category, units, opSignature);
+        } finally {
+            for (TempFile temp : temps) {
+                try {
+                    temp.close();
+                } catch (RuntimeException cleanup) {
+                    log.debug("Temp file cleanup failed: {}", cleanup.getMessage());
+                }
+            }
+        }
+    }
+
+    /** Page count via jpdfium (parser-identical to SaaS); 0 for non-PDF / unreadable inputs. */
+    private static int pageCount(Path path, MultipartFile file) {
+        if (!isPdf(file)) {
+            return 0;
+        }
+        try (PdfDocument doc = PdfDocument.open(path)) {
+            return doc.pageCount();
+        } catch (RuntimeException e) {
+            // Malformed / encrypted → byte axis only, matching the SaaS classifier.
+            log.debug(
+                    "Page count unavailable for {}; metering on bytes only",
+                    file.getOriginalFilename());
+            return 0;
+        }
+    }
+
+    /** Order-independent signature of the input set: sorted per-file hashes, hashed together. */
+    private static String opSignature(List<String> hashes) {
+        List<String> sorted = new ArrayList<>(hashes);
+        Collections.sort(sorted);
+        return ContentHasher.sha256(String.join("\n", sorted).getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static boolean isPdf(MultipartFile file) {
+        String contentType = file.getContentType();
+        if (contentType != null && contentType.toLowerCase().contains("pdf")) {
+            return true;
+        }
+        String name = file.getOriginalFilename();
+        return name != null && name.toLowerCase().endsWith(".pdf");
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/LocalUsageService.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/LocalUsageService.java
new file mode 100644
index 0000000000..58d365fe28
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/LocalUsageService.java
@@ -0,0 +1,59 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+import java.util.EnumMap;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+
+import stirling.software.proprietary.billing.BillingCategory;
+
+/**
+ * Reads this instance's locally accrued but not-yet-synced usage for the current period. The portal
+ * adds this on top of SaaS-synced spend so "current usage" reflects work done since the last sync.
+ *
+ * <p>Unsynced per category = {@code cumulativeUnits − lastSyncedUnits} (floored at 0), scoped to
+ * the current period so prior-period leftovers don't inflate it. Zeros when the period is unknown
+ * or metering is off.
+ */
+@Service
+@Profile("!saas")
+@ConditionalOnProperty(name = "stirling.billing.account-link.enabled", havingValue = "true")
+public class LocalUsageService {
+
+    private final UsageCounterRepository counters;
+    private final EntitlementCache entitlementCache;
+
+    public LocalUsageService(UsageCounterRepository counters, EntitlementCache entitlementCache) {
+        this.counters = counters;
+        this.entitlementCache = entitlementCache;
+    }
+
+    /** Per-category unsynced units for the current period; {@code periodStart} null = unknown. */
+    public record LocalUsage(
+            LocalDateTime periodStart,
+            long apiUnsyncedUnits,
+            long aiUnsyncedUnits,
+            long automationUnsyncedUnits,
+            long totalUnsyncedUnits) {}
+
+    public LocalUsage currentPeriodUnsynced() {
+        LocalDateTime period =
+                entitlementCache.current().map(InstanceEntitlement::periodStart).orElse(null);
+        if (period == null) {
+            return new LocalUsage(null, 0, 0, 0, 0);
+        }
+        EnumMap<BillingCategory, Long> unsynced = new EnumMap<>(BillingCategory.class);
+        for (UsageCounter c : counters.findByPeriodStart(period)) {
+            BillingCategory cat = c.billingCategory();
+            if (cat != null && cat != BillingCategory.BYPASSED) {
+                unsynced.merge(cat, c.unsyncedUnits(), Long::sum);
+            }
+        }
+        long api = unsynced.getOrDefault(BillingCategory.API, 0L);
+        long ai = unsynced.getOrDefault(BillingCategory.AI, 0L);
+        long automation = unsynced.getOrDefault(BillingCategory.AUTOMATION, 0L);
+        return new LocalUsage(period, api, ai, automation, api + ai + automation);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignature.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignature.java
new file mode 100644
index 0000000000..1ed49d6a8b
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignature.java
@@ -0,0 +1,73 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.UniqueConstraint;
+
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+/**
+ * The last time the instance metered a given input set this period — the local equivalent of the
+ * cloud's lineage join (combined-billing "Mode A"). The meter dedups on a rolling <b>workflow
+ * window</b>: an identical input set re-submitted within the window (see {@link
+ * AccountLinkProperties.Metering}) is treated as workflow chaining and not re-charged, while the
+ * same inputs run again after the window are billed afresh — matching the cloud's 5-minute open-job
+ * window so the same operation costs the same on the instance and in the cloud.
+ *
+ * <p>{@code lastMeteredAt} is refreshed on every sighting (the window slides, as recording a cloud
+ * artifact touches its job). One row per {@code (period, signature)}; the unique constraint also
+ * makes the first-sighting insert an atomic claim under concurrency.
+ *
+ * <p>Auto-created by Hibernate ({@code ddl-auto=update}); written only by the flag-gated meter.
+ */
+@Entity
+@Table(
+        name = "account_link_metered_signature",
+        uniqueConstraints =
+                @UniqueConstraint(
+                        name = "uk_account_link_metered_signature",
+                        columnNames = {"period_start", "signature"}))
+@Getter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class MeteredInputSignature {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "period_start", nullable = false)
+    private LocalDateTime periodStart;
+
+    /** SHA-256 hex of the op's input set (64 chars); the dedup key within a period. */
+    @Column(name = "signature", nullable = false, length = 64)
+    private String signature;
+
+    @Column(name = "created_at", nullable = false)
+    private LocalDateTime createdAt;
+
+    /**
+     * When this input set was last metered — the anchor the workflow-window dedup compares against.
+     */
+    @Column(name = "last_metered_at")
+    private LocalDateTime lastMeteredAt;
+
+    public MeteredInputSignature(LocalDateTime periodStart, String signature, LocalDateTime at) {
+        this.periodStart = periodStart;
+        this.signature = signature;
+        this.createdAt = at;
+        this.lastMeteredAt = at;
+    }
+
+    /** Slides the window forward — the input set was seen again. */
+    public void touch(LocalDateTime at) {
+        this.lastMeteredAt = at;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignatureRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignatureRepository.java
new file mode 100644
index 0000000000..863f503f61
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/MeteredInputSignatureRepository.java
@@ -0,0 +1,15 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+/** Persistence for the per-period metered input-set signatures (combined-billing "Mode A"). */
+public interface MeteredInputSignatureRepository
+        extends JpaRepository<MeteredInputSignature, Long> {
+
+    /** The existing row for a seen input set, so the meter can apply the workflow-window check. */
+    Optional<MeteredInputSignature> findByPeriodStartAndSignature(
+            LocalDateTime periodStart, String signature);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounter.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounter.java
new file mode 100644
index 0000000000..b90af07958
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounter.java
@@ -0,0 +1,105 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.UniqueConstraint;
+
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+import stirling.software.proprietary.billing.BillingCategory;
+
+/**
+ * Durable per-(billing period, category) cumulative usage counter for combined-billing "Mode A".
+ * Each successful billable op increments its row; the daily sync reports the cumulative totals and
+ * SaaS bills the delta since the last sync. The cumulative model is idempotent (a resend bills
+ * nothing) and tamper-evident (a counter that drops is a signal). One row per {@code (period_start,
+ * category)}, auto-created by Hibernate; only the flag-gated {@link UsageMeterService} writes it.
+ */
+@Entity
+@Table(
+        name = "account_link_usage_counter",
+        uniqueConstraints =
+                @UniqueConstraint(
+                        name = "uk_usage_counter_period_category",
+                        columnNames = {"period_start", "category"}))
+@Getter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class UsageCounter {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    /**
+     * Inclusive start of the billing period this counter belongs to (from the entitlement sync).
+     */
+    @Column(name = "period_start", nullable = false)
+    private LocalDateTime periodStart;
+
+    /** {@code BillingCategory} name — API / AI / AUTOMATION (never BYPASSED). */
+    @Column(name = "category", nullable = false, length = 32)
+    private String category;
+
+    /** Running total of metered units in this period+category. */
+    @Column(name = "cumulative_units", nullable = false)
+    private long cumulativeUnits;
+
+    /**
+     * {@link #cumulativeUnits} as of the last sync SaaS accepted; the difference is the unreported
+     * usage the portal shows on top of SaaS-synced spend. The {@code columnDefinition} default
+     * keeps the {@code ddl-auto=update} ADD COLUMN safe against a table an earlier build already
+     * populated (NOT NULL with no default would fail the ALTER).
+     */
+    @Column(
+            name = "last_synced_units",
+            nullable = false,
+            columnDefinition = "bigint not null default 0")
+    private long lastSyncedUnits;
+
+    @Column(name = "updated_at", nullable = false)
+    private LocalDateTime updatedAt;
+
+    /** Fresh-accrual row: nothing synced yet. */
+    public UsageCounter(
+            LocalDateTime periodStart,
+            String category,
+            long cumulativeUnits,
+            LocalDateTime updatedAt) {
+        this(periodStart, category, cumulativeUnits, 0L, updatedAt);
+    }
+
+    public UsageCounter(
+            LocalDateTime periodStart,
+            String category,
+            long cumulativeUnits,
+            long lastSyncedUnits,
+            LocalDateTime updatedAt) {
+        this.periodStart = periodStart;
+        this.category = category;
+        this.cumulativeUnits = cumulativeUnits;
+        this.lastSyncedUnits = lastSyncedUnits;
+        this.updatedAt = updatedAt;
+    }
+
+    /** This row's category as the enum, or {@code null} for an unrecognised stored value. */
+    public BillingCategory billingCategory() {
+        try {
+            return BillingCategory.valueOf(category);
+        } catch (IllegalArgumentException unknown) {
+            return null;
+        }
+    }
+
+    /** Units accrued but not yet accepted by SaaS (floored at 0). */
+    public long unsyncedUnits() {
+        return Math.max(0, cumulativeUnits - lastSyncedUnits);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounterRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounterRepository.java
new file mode 100644
index 0000000000..2140775abc
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageCounterRepository.java
@@ -0,0 +1,57 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.transaction.annotation.Transactional;
+
+/** Persistence for the per-period/per-category usage counters (combined-billing "Mode A"). */
+public interface UsageCounterRepository extends JpaRepository<UsageCounter, Long> {
+
+    /**
+     * Atomically adds {@code delta} to an existing counter row. Returns the number of rows updated
+     * (0 when the row doesn't exist yet — the caller then inserts). Doing the add in SQL avoids a
+     * read-modify-write race between concurrent billable requests.
+     */
+    @Modifying
+    @Transactional
+    @Query(
+            "UPDATE UsageCounter c SET c.cumulativeUnits = c.cumulativeUnits + :delta,"
+                    + " c.updatedAt = :now"
+                    + " WHERE c.periodStart = :periodStart AND c.category = :category")
+    int increment(
+            @Param("periodStart") LocalDateTime periodStart,
+            @Param("category") String category,
+            @Param("delta") long delta,
+            @Param("now") LocalDateTime now);
+
+    /** All counters for a period — the daily sync reads these to report cumulative totals. */
+    List<UsageCounter> findByPeriodStart(LocalDateTime periodStart);
+
+    /**
+     * Periods (oldest first) that still hold usage not yet accepted by SaaS. The sync reports each
+     * so end-of-period usage isn't stranded when the billing period rolls over between syncs.
+     */
+    @Query(
+            "SELECT DISTINCT c.periodStart FROM UsageCounter c"
+                    + " WHERE c.cumulativeUnits > c.lastSyncedUnits ORDER BY c.periodStart")
+    List<LocalDateTime> findPeriodsWithUnsyncedUsage();
+
+    /**
+     * Marks a counter synced up to {@code syncedUnits} (the cumulative value just accepted by
+     * SaaS), not the live cumulative — concurrent accruals during the sync stay correctly unsynced.
+     */
+    @Modifying
+    @Transactional
+    @Query(
+            "UPDATE UsageCounter c SET c.lastSyncedUnits = :syncedUnits"
+                    + " WHERE c.periodStart = :periodStart AND c.category = :category")
+    int markSynced(
+            @Param("periodStart") LocalDateTime periodStart,
+            @Param("category") String category,
+            @Param("syncedUnits") long syncedUnits);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageMeterService.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageMeterService.java
new file mode 100644
index 0000000000..6aa93606fb
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageMeterService.java
@@ -0,0 +1,115 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.Duration;
+import java.time.LocalDateTime;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Profile;
+import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.billing.BillingCategory;
+
+/**
+ * Accrues metered usage into the durable per-(period, category) {@link UsageCounter}; the daily
+ * sync later reports the cumulative totals to SaaS.
+ *
+ * <p>Workflow-window dedup: an identical input set re-submitted within {@code metering.workflow-
+ * window} is treated as chaining and not re-charged; the same inputs run again after the window are
+ * billed afresh — matching the cloud's open-job lineage window so the same op costs the same on the
+ * instance and in the cloud. Fileless ops pass a null signature and always accrue. {@link #accrue}
+ * is best-effort: callers need not handle persistence errors.
+ */
+@Slf4j
+@Service
+@Profile("!saas")
+@ConditionalOnProperty(
+        name = "stirling.billing.account-link.metering.enabled",
+        havingValue = "true")
+public class UsageMeterService {
+
+    private final UsageCounterRepository repo;
+    private final MeteredInputSignatureRepository signatureRepo;
+    private final Duration workflowWindow;
+
+    public UsageMeterService(
+            UsageCounterRepository repo,
+            MeteredInputSignatureRepository signatureRepo,
+            AccountLinkProperties properties) {
+        this.repo = repo;
+        this.signatureRepo = signatureRepo;
+        this.workflowWindow = properties.getMetering().getWorkflowWindow();
+    }
+
+    /**
+     * Adds {@code units} to the {@code (periodStart, category)} counter (creating the row on first
+     * use), unless {@code opSignature} was already metered this period. No-ops for non-billable
+     * categories, non-positive units, or a missing period.
+     */
+    public void accrue(
+            LocalDateTime periodStart, BillingCategory category, long units, String opSignature) {
+        if (periodStart == null
+                || category == null
+                || category == BillingCategory.BYPASSED
+                || units <= 0) {
+            return;
+        }
+        if (opSignature != null && !shouldCharge(periodStart, opSignature)) {
+            return; // identical inputs seen within the workflow window — chaining, already billed
+        }
+        incrementOrInsert(periodStart, category.name(), units);
+    }
+
+    /**
+     * True when this input set should be charged: unseen this period, or last seen outside the
+     * workflow window. Records a first sighting (an atomic insert-as-claim under concurrency) and
+     * slides the window on a repeat. Fails toward charging so a store hiccup never drops a charge.
+     */
+    private boolean shouldCharge(LocalDateTime periodStart, String opSignature) {
+        LocalDateTime now = LocalDateTime.now();
+        MeteredInputSignature seen =
+                signatureRepo.findByPeriodStartAndSignature(periodStart, opSignature).orElse(null);
+        if (seen == null) {
+            try {
+                signatureRepo.saveAndFlush(
+                        new MeteredInputSignature(periodStart, opSignature, now));
+                return true; // first sighting this period
+            } catch (DataIntegrityViolationException raced) {
+                return false; // a concurrent op just claimed it — within window → chaining
+            } catch (RuntimeException e) {
+                log.debug("Signature claim failed for {}: {}", periodStart, e.getMessage());
+                return true;
+            }
+        }
+        LocalDateTime last = seen.getLastMeteredAt() != null ? seen.getLastMeteredAt() : now;
+        boolean withinWindow = last.isAfter(now.minus(workflowWindow));
+        try {
+            seen.touch(now);
+            signatureRepo.save(seen);
+        } catch (RuntimeException e) {
+            log.debug("Signature touch failed for {}: {}", periodStart, e.getMessage());
+        }
+        return !withinWindow;
+    }
+
+    private void incrementOrInsert(LocalDateTime periodStart, String category, long units) {
+        LocalDateTime now = LocalDateTime.now();
+        try {
+            if (repo.increment(periodStart, category, units, now) > 0) {
+                return;
+            }
+            try {
+                repo.saveAndFlush(new UsageCounter(periodStart, category, units, now));
+            } catch (DataIntegrityViolationException raceLostInsert) {
+                // A concurrent request inserted the row first — increment the now-existing row.
+                repo.increment(periodStart, category, units, now);
+            }
+        } catch (RuntimeException e) {
+            // Metering must never break the request it rode in on; a lost accrual self-heals on the
+            // next increment and the daily sync reports the cumulative total either way.
+            log.debug("Usage accrual failed for {}/{}: {}", periodStart, category, e.getMessage());
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageSyncService.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageSyncService.java
new file mode 100644
index 0000000000..4c4ce2377c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/UsageSyncService.java
@@ -0,0 +1,189 @@
+package stirling.software.proprietary.accountlink;
+
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.util.EnumMap;
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Profile;
+import org.springframework.scheduling.annotation.SchedulingConfigurer;
+import org.springframework.scheduling.config.FixedDelayTask;
+import org.springframework.scheduling.config.ScheduledTaskRegistrar;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.billing.BillingCategory;
+
+/**
+ * Daily usage sender for combined-billing "Mode A". Reports each period's cumulative per-category
+ * usage to SaaS, which bills the delta against its own last-seen totals.
+ *
+ * <p>Resilience: the sync seq is persisted before the report so it never regresses across
+ * restarts/failures; a transport failure leaves the {@code lastSyncedUnits} markers untouched so
+ * usage rolls into the next sync; and reporting the same cumulative twice bills nothing. All
+ * periods with unsynced usage are reported so nothing is stranded when the period rolls over
+ * between syncs.
+ */
+@Slf4j
+@Service
+@Profile("!saas")
+@ConditionalOnProperty(
+        name = "stirling.billing.account-link.metering.enabled",
+        havingValue = "true")
+public class UsageSyncService implements SchedulingConfigurer {
+
+    // First run waits out startup churn; then every interval.
+    private static final Duration INITIAL_DELAY = Duration.ofMinutes(5);
+
+    private final UsageCounterRepository counters;
+    private final AccountLinkSyncStateRepository syncState;
+    private final DeviceCredentialStore credentialStore;
+    private final AccountLinkClient client;
+    private final EntitlementCache entitlementCache;
+    private final AccountLinkProperties properties;
+
+    public UsageSyncService(
+            UsageCounterRepository counters,
+            AccountLinkSyncStateRepository syncState,
+            DeviceCredentialStore credentialStore,
+            AccountLinkClient client,
+            EntitlementCache entitlementCache,
+            AccountLinkProperties properties) {
+        this.counters = counters;
+        this.syncState = syncState;
+        this.credentialStore = credentialStore;
+        this.client = client;
+        this.entitlementCache = entitlementCache;
+        this.properties = properties;
+    }
+
+    /**
+     * Registers the daily sync, binding the interval from {@code metering.sync-interval-hours} in
+     * code rather than a {@code @Scheduled} SpEL string so a bad interval fails at boot/test rather
+     * than only on a flags-on run.
+     */
+    @Override
+    public void configureTasks(ScheduledTaskRegistrar registrar) {
+        Duration interval = Duration.ofHours(properties.getMetering().getSyncIntervalHours());
+        registrar.addFixedDelayTask(
+                new FixedDelayTask(this::scheduledSync, interval, INITIAL_DELAY));
+    }
+
+    public void scheduledSync() {
+        try {
+            syncNow();
+        } catch (RuntimeException e) {
+            log.debug("Scheduled usage sync failed", e);
+        }
+    }
+
+    /**
+     * Reports every period with unsynced usage and refreshes the cached entitlement from the reply.
+     * Single daily caller (non-reentrant {@code fixedDelay}), so no internal locking. No-op when
+     * unlinked or when nothing is pending.
+     */
+    public void syncNow() {
+        Optional<DeviceCredential> cred = credentialStore.get();
+        if (cred.isEmpty()) {
+            return; // not linked
+        }
+        List<LocalDateTime> periods = counters.findPeriodsWithUnsyncedUsage();
+        if (periods.isEmpty()) {
+            // Nothing to report, but a sync is also our cue to pick up an out-of-band entitlement
+            // change (e.g. the admin just subscribed) that otherwise wouldn't surface until the
+            // cache TTL lapses. Force an immediate refresh so the gate reflects the new plan now.
+            entitlementCache.invalidate();
+            entitlementCache.current();
+            return;
+        }
+        InstanceEntitlement latest = null;
+        try {
+            for (LocalDateTime period : periods) {
+                InstanceEntitlement fresh = syncPeriod(cred.get(), period);
+                if (fresh != null) {
+                    latest = fresh;
+                }
+            }
+        } catch (AccountLinkClient.RevokedException e) {
+            // Authoritative deny — stop reporting; the entitlement cache blocks billable work on
+            // its
+            // own next refresh, so we don't synthesise the blocked state here.
+            log.info(
+                    "Usage sync denied (HTTP {}); credential revoked/invalid — gate blocks on next"
+                            + " refresh",
+                    e.status());
+            return;
+        }
+        // Adopt the freshest entitlement the sync returned, saving the cache a redundant fetch.
+        entitlementCache.accept(latest);
+    }
+
+    /** Reports one period; returns the fresh entitlement, or null on a transport/server failure. */
+    private InstanceEntitlement syncPeriod(DeviceCredential cred, LocalDateTime period) {
+        EnumMap<BillingCategory, Long> cumulative = new EnumMap<>(BillingCategory.class);
+        for (UsageCounter c : counters.findByPeriodStart(period)) {
+            BillingCategory cat = c.billingCategory();
+            if (cat != null && cat != BillingCategory.BYPASSED) {
+                cumulative.merge(cat, c.getCumulativeUnits(), Long::sum);
+            }
+        }
+        AccountLinkSyncState state = loadState();
+        long seq = reserveNextSeq(state);
+        InstanceEntitlement fresh =
+                client.reportUsage(
+                        cred.getDeviceId(),
+                        cred.getDeviceSecret(),
+                        seq,
+                        period,
+                        cumulative.getOrDefault(BillingCategory.API, 0L),
+                        cumulative.getOrDefault(BillingCategory.AI, 0L),
+                        cumulative.getOrDefault(BillingCategory.AUTOMATION, 0L));
+        if (fresh == null) {
+            // Transport/server failure: leave the synced markers untouched. The burned seq is
+            // harmless (seqs need only be monotonic) and the delta bills on the next successful
+            // sync.
+            return null;
+        }
+        recordSuccess(period, cumulative, state);
+        return fresh;
+    }
+
+    /** Reserves and persists the next strictly-increasing sequence before the report goes out. */
+    private long reserveNextSeq(AccountLinkSyncState state) {
+        long next = state.getLastSyncSeq() + 1;
+        state.setLastSyncSeq(next);
+        syncState.save(state);
+        return next;
+    }
+
+    /**
+     * Advances the per-category synced markers to the reported totals + stamps the success time.
+     */
+    private void recordSuccess(
+            LocalDateTime period,
+            EnumMap<BillingCategory, Long> cumulative,
+            AccountLinkSyncState state) {
+        cumulative.forEach(
+                (category, units) -> {
+                    if (units > 0) {
+                        counters.markSynced(period, category.name(), units);
+                    }
+                });
+        state.setLastSuccessAt(LocalDateTime.now());
+        syncState.save(state);
+    }
+
+    private AccountLinkSyncState loadState() {
+        return syncState
+                .findById(AccountLinkSyncState.SINGLETON_ID)
+                .orElseGet(
+                        () -> {
+                            AccountLinkSyncState s = new AccountLinkSyncState();
+                            s.setId(AccountLinkSyncState.SINGLETON_ID);
+                            return s;
+                        });
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategory.java b/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategory.java
new file mode 100644
index 0000000000..51ca47ad64
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategory.java
@@ -0,0 +1,22 @@
+package stirling.software.proprietary.billing;
+
+/**
+ * The billing / analytics axis for a metered operation. PAYG runs on a single flat-priced meter, so
+ * category is metadata only and never affects price.
+ *
+ * <p>Classification precedence is {@code AUTOMATION → AI → API → BYPASSED} (see {@link
+ * BillingCategoryClassifier}); {@link #BYPASSED} is a manual interactive tool call that is never
+ * billed.
+ *
+ * <p>Mirrors the value set of the SaaS {@code payg.model.BillingCategory}. A linked self-hosted
+ * instance reports usage per category to SaaS as the lower-case names ({@code api} / {@code ai} /
+ * {@code automation}) in the daily sync, and SaaS maps them back — so the two enums must keep the
+ * same names. (We deliberately do not share one enum across the modules: that would drag the SaaS
+ * billing enum through ~20 hot-path files for what is JSON-string metadata on the wire.)
+ */
+public enum BillingCategory {
+    BYPASSED,
+    API,
+    AI,
+    AUTOMATION
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategoryClassifier.java b/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategoryClassifier.java
new file mode 100644
index 0000000000..95b3abb99c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/billing/BillingCategoryClassifier.java
@@ -0,0 +1,29 @@
+package stirling.software.proprietary.billing;
+
+/**
+ * Pure precedence for bucketing a request into a {@link BillingCategory}, so the SaaS engine and a
+ * linked self-hosted instance classify identically. Each backend resolves the three signals from
+ * its own types — the automation marker header; an AI-surface signal (a {@code @RequiresFeature}
+ * annotation / route on SaaS, a path prefix on the instance); API-key authentication — and this
+ * applies the order {@code AUTOMATION → AI → API → BYPASSED}.
+ *
+ * <p>An AI tool dispatched inside a pipeline / workflow therefore bills as {@code AUTOMATION} (the
+ * automation header dominates), while a direct call to it bills as {@code AI}.
+ */
+public final class BillingCategoryClassifier {
+
+    private BillingCategoryClassifier() {}
+
+    public static BillingCategory classify(boolean automation, boolean ai, boolean apiKey) {
+        if (automation) {
+            return BillingCategory.AUTOMATION;
+        }
+        if (ai) {
+            return BillingCategory.AI;
+        }
+        if (apiKey) {
+            return BillingCategory.API;
+        }
+        return BillingCategory.BYPASSED;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/billing/ContentHasher.java b/app/proprietary/src/main/java/stirling/software/proprietary/billing/ContentHasher.java
new file mode 100644
index 0000000000..232dd499dc
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/billing/ContentHasher.java
@@ -0,0 +1,68 @@
+package stirling.software.proprietary.billing;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.DigestInputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+
+/**
+ * SHA-256 content fingerprint shared by the SaaS charge path and the linked self-hosted instance's
+ * meter (combined-billing "Mode A"), so both derive an <em>identical</em> signature for the same
+ * bytes — the basis for lineage dedup. Pure, no Spring: fixed 64 KiB buffer (allocation independent
+ * of file size), hardware-accelerated by the JVM where available.
+ *
+ * <p>Lives in {@code :proprietary} (not {@code :common}) so it stays out of the community core
+ * build yet is reachable from {@code :saas} (which depends on {@code :proprietary}).
+ */
+public final class ContentHasher {
+
+    private static final String ALGORITHM = "SHA-256";
+    private static final int BUFFER_SIZE = 64 * 1024;
+
+    private ContentHasher() {}
+
+    /** Lower-case hex SHA-256 of the file's bytes. */
+    public static String sha256(Path file) throws IOException {
+        MessageDigest digest = newDigest();
+        try (InputStream raw = Files.newInputStream(file);
+                DigestInputStream in = new DigestInputStream(raw, digest)) {
+            byte[] buf = new byte[BUFFER_SIZE];
+            while (in.read(buf) != -1) {
+                // drain through the digest; we only want the side effect
+            }
+        }
+        return HexFormat.of().formatHex(digest.digest());
+    }
+
+    /** Lower-case hex SHA-256 of the given bytes (e.g. to combine per-file hashes into one key). */
+    public static String sha256(byte[] bytes) {
+        return HexFormat.of().formatHex(newDigest().digest(bytes));
+    }
+
+    /**
+     * A fresh SHA-256 digest, for callers that stream bytes through a {@link
+     * java.security.DigestOutputStream} to hash in the same pass that writes the file — avoiding a
+     * second full read just to fingerprint it. Pair with {@link #toHex(byte[])}.
+     */
+    public static MessageDigest newSha256() {
+        return newDigest();
+    }
+
+    /** Lower-case hex of a completed digest — the same format {@link #sha256(Path)} produces. */
+    public static String toHex(byte[] digest) {
+        return HexFormat.of().formatHex(digest);
+    }
+
+    private static MessageDigest newDigest() {
+        try {
+            return MessageDigest.getInstance(ALGORITHM);
+        } catch (NoSuchAlgorithmException e) {
+            // SHA-256 is mandated by every JDK; unreachable in practice.
+            throw new IllegalStateException(ALGORITHM + " unavailable — JDK is misconfigured", e);
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/billing/DocumentUnitCalculator.java b/app/proprietary/src/main/java/stirling/software/proprietary/billing/DocumentUnitCalculator.java
new file mode 100644
index 0000000000..2cc22daf41
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/billing/DocumentUnitCalculator.java
@@ -0,0 +1,76 @@
+package stirling.software.proprietary.billing;
+
+import java.util.List;
+
+/**
+ * Pure doc-unit math shared by the SaaS billing engine and a linked self-hosted instance, so both
+ * cost an operation identically. No Spring, no IO: callers supply page/byte facts (read however
+ * their backend reads them — e.g. jpdfium for PDFs) plus a {@link UnitCalcPolicy}.
+ *
+ * <p>Raw units for one file = the larger of {@code ceil(pages / docPagesPerUnit)} and {@code
+ * ceil(bytes / docBytesPerUnit)} (non-PDF inputs pass {@code pages = 0}, so only the bytes axis
+ * contributes). A single file is clamped to {@code [1, fileUnitCap]}; a multi-file group is the
+ * <em>raw</em> per-file sum clamped to {@code [1, fileUnitCap * file_count]} (summing raw, not
+ * per-file-clamped, units so the group cap can actually bind).
+ *
+ * <p>{@link UnitCalcPolicy#minChargeUnits()} is applied by the charge layer, not here; this
+ * enforces only an absolute floor of {@link #MIN_UNITS_PER_NONEMPTY_FILE} so callers can rely on
+ * "non-empty input → at least 1 unit". Extracted verbatim from the SaaS {@code
+ * DefaultDocumentClassifier} to preserve behaviour.
+ */
+public final class DocumentUnitCalculator {
+
+    /** Floor for non-empty input. Distinct from {@link UnitCalcPolicy#minChargeUnits()}. */
+    public static final int MIN_UNITS_PER_NONEMPTY_FILE = 1;
+
+    private DocumentUnitCalculator() {}
+
+    /** One file's page count (0 for non-PDF / unreadable) and byte size. */
+    public record FileSize(int pages, long bytes) {}
+
+    /** Raw (unclamped) units for one file. */
+    public static long rawUnits(int pages, long bytes, UnitCalcPolicy policy) {
+        long pageUnits = pages > 0 ? ceilDiv(pages, policy.docPagesPerUnit()) : 0L;
+        long byteUnits = ceilDiv(bytes, policy.docBytesPerUnit());
+        return Math.max(pageUnits, byteUnits);
+    }
+
+    /** Units for a single file, clamped to {@code [1, fileUnitCap]}. */
+    public static int unitsForFile(int pages, long bytes, UnitCalcPolicy policy) {
+        long raw = rawUnits(pages, bytes, policy);
+        // toIntExact: fail loud on overflow rather than silently wrapping a billing number.
+        return Math.toIntExact(
+                Math.max(MIN_UNITS_PER_NONEMPTY_FILE, Math.min(policy.fileUnitCap(), raw)));
+    }
+
+    /**
+     * Units for a multi-file group: raw per-file sum clamped to {@code [1, fileUnitCap * count]}.
+     */
+    public static int unitsForGroup(List<FileSize> files, UnitCalcPolicy policy) {
+        if (files.isEmpty()) {
+            throw new IllegalArgumentException("files must not be empty");
+        }
+        long rawSum = 0;
+        for (FileSize f : files) {
+            rawSum = saturatedAdd(rawSum, rawUnits(f.pages(), f.bytes(), policy));
+        }
+        long groupCap = (long) policy.fileUnitCap() * files.size();
+        return Math.toIntExact(
+                Math.max((long) MIN_UNITS_PER_NONEMPTY_FILE, Math.min(groupCap, rawSum)));
+    }
+
+    private static long ceilDiv(long numerator, long divisor) {
+        if (numerator <= 0) {
+            return 0;
+        }
+        return (numerator + divisor - 1) / divisor;
+    }
+
+    private static long saturatedAdd(long a, long b) {
+        try {
+            return Math.addExact(a, b);
+        } catch (ArithmeticException e) {
+            return Long.MAX_VALUE;
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/billing/UnitCalcPolicy.java b/app/proprietary/src/main/java/stirling/software/proprietary/billing/UnitCalcPolicy.java
new file mode 100644
index 0000000000..b7d773d465
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/billing/UnitCalcPolicy.java
@@ -0,0 +1,30 @@
+package stirling.software.proprietary.billing;
+
+/**
+ * The four billing knobs the doc-unit math needs, split out of the SaaS {@code PricingPolicy} JPA
+ * entity so the calculation ({@link DocumentUnitCalculator}) can live in {@code :proprietary} and
+ * be shared by the SaaS billing engine and a linked self-hosted instance — both then cost an
+ * operation identically.
+ *
+ * <p>The SaaS engine builds one from its persisted {@code PricingPolicy}; a linked instance
+ * receives these values in the daily entitlement sync. {@code minChargeUnits} is carried here for
+ * the charge layer; {@link DocumentUnitCalculator} itself does not apply it (see its docs).
+ */
+public record UnitCalcPolicy(
+        int docPagesPerUnit, long docBytesPerUnit, int minChargeUnits, int fileUnitCap) {
+
+    public UnitCalcPolicy {
+        if (docPagesPerUnit <= 0) {
+            throw new IllegalArgumentException("docPagesPerUnit must be > 0");
+        }
+        if (docBytesPerUnit <= 0) {
+            throw new IllegalArgumentException("docBytesPerUnit must be > 0");
+        }
+        if (minChargeUnits < 1) {
+            throw new IllegalArgumentException("minChargeUnits must be >= 1");
+        }
+        if (fileUnitCap < 1) {
+            throw new IllegalArgumentException("fileUnitCap must be >= 1");
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkClientTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkClientTest.java
index 7d954a4398..969111e9f5 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkClientTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkClientTest.java
@@ -12,6 +12,7 @@ import java.net.ConnectException;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
+import java.time.LocalDateTime;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -189,4 +190,73 @@ class AccountLinkClientTest {
                 .thenThrow(new ConnectException("refused"));
         assertEquals(false, client.revokeSelf("dev-1", "sec-1"));
     }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void reportUsagePostsToSyncWithDeviceHeadersAndParsesFreshEntitlement() throws Exception {
+        HttpResponse<String> resp =
+                response(
+                        200,
+                        "{\"subscribed\":true,\"freeRemainingUnits\":0,\"periodSpendUnits\":42,\"periodCapUnits\":100,\"state\":\"OK\"}");
+        ArgumentCaptor<HttpRequest> captor = ArgumentCaptor.forClass(HttpRequest.class);
+        when(httpClient.send(captor.capture(), any(HttpResponse.BodyHandler.class)))
+                .thenReturn(resp);
+
+        InstanceEntitlement e =
+                client.reportUsage(
+                        "dev-1", "sec-1", 7L, LocalDateTime.of(2026, 6, 1, 0, 0), 12, 4, 8);
+
+        assertNotNull(e);
+        assertEquals(42, e.periodSpendUnits());
+        assertEquals(EntitlementState.OK, e.state());
+
+        HttpRequest sent = captor.getValue();
+        assertEquals("https://saas.example.com/api/v1/instance/sync", sent.uri().toString());
+        assertEquals("POST", sent.method());
+        assertEquals("dev-1", sent.headers().firstValue("X-Device-Id").orElse(null));
+        assertEquals("sec-1", sent.headers().firstValue("X-Device-Secret").orElse(null));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void reportUsageThrowsRevokedOnDeny() throws Exception {
+        for (int status : new int[] {401, 403}) {
+            HttpResponse<String> resp = response(status, "{}");
+            when(httpClient.send(any(), any(HttpResponse.BodyHandler.class))).thenReturn(resp);
+            AccountLinkClient.RevokedException ex =
+                    assertThrows(
+                            AccountLinkClient.RevokedException.class,
+                            () ->
+                                    client.reportUsage(
+                                            "dev-1",
+                                            "sec-1",
+                                            1L,
+                                            LocalDateTime.of(2026, 6, 1, 0, 0),
+                                            1,
+                                            0,
+                                            0));
+            assertEquals(status, ex.status());
+        }
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void reportUsageReturnsNullWhenUnreachable() throws Exception {
+        when(httpClient.send(any(), any(HttpResponse.BodyHandler.class)))
+                .thenThrow(new ConnectException("refused"));
+        // Null = don't advance synced markers; the usage retries on the next sync.
+        assertNull(
+                client.reportUsage(
+                        "dev-1", "sec-1", 1L, LocalDateTime.of(2026, 6, 1, 0, 0), 1, 0, 0));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void reportUsageReturnsNullOnServerError() throws Exception {
+        HttpResponse<String> resp = response(503, "{}");
+        when(httpClient.send(any(), any(HttpResponse.BodyHandler.class))).thenReturn(resp);
+        assertNull(
+                client.reportUsage(
+                        "dev-1", "sec-1", 1L, LocalDateTime.of(2026, 6, 1, 0, 0), 1, 0, 0));
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkControllerTest.java
index 6e4a816bb0..41f544de7e 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/AccountLinkControllerTest.java
@@ -2,12 +2,15 @@ package stirling.software.proprietary.accountlink;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import java.io.IOException;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 
@@ -21,12 +24,18 @@ import stirling.software.proprietary.accountlink.AccountLinkController.LinkReque
 class AccountLinkControllerTest {
 
     private AccountLinkService service;
+    private UsageSyncService syncService;
+    private ObjectProvider<UsageSyncService> syncProvider;
     private AccountLinkController controller;
 
     @BeforeEach
+    @SuppressWarnings("unchecked")
     void setUp() {
         service = mock(AccountLinkService.class);
-        controller = new AccountLinkController(service);
+        syncService = mock(UsageSyncService.class);
+        syncProvider = mock(ObjectProvider.class);
+        controller =
+                new AccountLinkController(service, mock(LocalUsageService.class), syncProvider);
     }
 
     @Test
@@ -65,4 +74,24 @@ class AccountLinkControllerTest {
         ResponseEntity<?> resp = controller.link(new LinkRequest("jwt", null));
         assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.BAD_GATEWAY);
     }
+
+    @Test
+    void syncNow_triggersSyncWhenMeteringOn() {
+        when(syncProvider.getIfAvailable()).thenReturn(syncService);
+
+        ResponseEntity<Void> resp = controller.syncNow();
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+        verify(syncService).syncNow();
+    }
+
+    @Test
+    void syncNow_returns409WhenMeteringOff() {
+        when(syncProvider.getIfAvailable()).thenReturn(null); // metering disabled → bean absent
+
+        ResponseEntity<Void> resp = controller.syncNow();
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.CONFLICT);
+        verify(syncService, never()).syncNow();
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/BillableOperationClassifierTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/BillableOperationClassifierTest.java
index 275026794a..0b43069ee9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/BillableOperationClassifierTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/BillableOperationClassifierTest.java
@@ -1,49 +1,78 @@
 package stirling.software.proprietary.accountlink;
 
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 
 import org.junit.jupiter.api.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 
 import stirling.software.common.service.InternalApiClient;
+import stirling.software.proprietary.billing.BillingCategory;
 
 class BillableOperationClassifierTest {
 
-    @Test
-    void aiPathIsBillable() {
-        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/ai/tools/foo");
-        assertTrue(BillableOperationClassifier.isBillable(req));
+    private static MockHttpServletRequest req(String uri) {
+        return new MockHttpServletRequest("POST", uri);
     }
 
     @Test
-    void automationHeaderIsBillable() {
-        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/merge");
+    void aiPathIsAi() {
+        assertEquals(
+                BillingCategory.AI,
+                BillableOperationClassifier.categorize(req("/api/v1/ai/tools/foo"), false));
+    }
+
+    @Test
+    void automationHeaderIsAutomation() {
+        MockHttpServletRequest req = req("/api/v1/general/merge");
         req.addHeader(InternalApiClient.AUTOMATION_HEADER, "1");
-        assertTrue(BillableOperationClassifier.isBillable(req));
+        assertEquals(
+                BillingCategory.AUTOMATION, BillableOperationClassifier.categorize(req, false));
     }
 
     @Test
-    void plainManualToolIsFree() {
-        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/merge");
-        assertFalse(BillableOperationClassifier.isBillable(req));
+    void apiKeyToolCallIsApi() {
+        assertEquals(
+                BillingCategory.API,
+                BillableOperationClassifier.categorize(req("/api/v1/general/merge"), true));
     }
 
     @Test
-    void aiSegmentNotAtPathStartIsFree() {
-        // Tightened from substring to prefix: the AI segment appearing mid-path (e.g. behind a
-        // proxy prefix) must NOT classify a manual tool as billable.
-        MockHttpServletRequest req =
-                new MockHttpServletRequest("POST", "/proxy/api/v1/ai/tools/foo");
-        assertFalse(BillableOperationClassifier.isBillable(req));
+    void plainManualToolIsBypassed() {
+        assertEquals(
+                BillingCategory.BYPASSED,
+                BillableOperationClassifier.categorize(req("/api/v1/general/merge"), false));
     }
 
     @Test
-    void aiPathUnderContextPathIsBillable() {
-        // A real context-path deployment still classifies: /<ctx>/api/v1/ai/** is billable.
-        MockHttpServletRequest req =
-                new MockHttpServletRequest("POST", "/stirling/api/v1/ai/tools/foo");
+    void automationDominatesAiAndApiKey() {
+        // An AI tool dispatched inside a workflow (automation header) + API-key auth → AUTOMATION.
+        MockHttpServletRequest req = req("/api/v1/ai/tools/foo");
+        req.addHeader(InternalApiClient.AUTOMATION_HEADER, "true");
+        assertEquals(BillingCategory.AUTOMATION, BillableOperationClassifier.categorize(req, true));
+    }
+
+    @Test
+    void aiDominatesApiKey() {
+        // A direct API-key call to an AI tool bills as AI, not API.
+        assertEquals(
+                BillingCategory.AI,
+                BillableOperationClassifier.categorize(req("/api/v1/ai/tools/foo"), true));
+    }
+
+    @Test
+    void aiSegmentNotAtPathStartIsBypassed() {
+        // Tightened from substring to prefix: the AI segment mid-path (e.g. behind a proxy prefix)
+        // must NOT classify a manual tool as AI.
+        assertEquals(
+                BillingCategory.BYPASSED,
+                BillableOperationClassifier.categorize(req("/proxy/api/v1/ai/tools/foo"), false));
+    }
+
+    @Test
+    void aiPathUnderContextPathIsAi() {
+        // A real context-path deployment still classifies: /<ctx>/api/v1/ai/** is AI.
+        MockHttpServletRequest req = req("/stirling/api/v1/ai/tools/foo");
         req.setContextPath("/stirling");
-        assertTrue(BillableOperationClassifier.isBillable(req));
+        assertEquals(BillingCategory.AI, BillableOperationClassifier.categorize(req, false));
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateTest.java
index 0c250fd3e9..1838034a9a 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateTest.java
@@ -3,20 +3,32 @@ package stirling.software.proprietary.accountlink;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.when;
 
+import java.time.LocalDateTime;
 import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
 
 import stirling.software.proprietary.accountlink.GateDecision.Reason;
 
 /**
- * Covers the gate decision matrix: flag-off, manual-free, unlinked, fail-open, linked-free, and
- * over-limit. Exercises the pure {@link InstanceEntitlementGate#decide} so no Spring / I/O is
- * needed.
+ * Covers the gate decision matrix: flag-off, manual-free, unlinked, fail-open, grace-expired,
+ * linked-free, and over-limit. The pure {@link InstanceEntitlementGate#decide} cases need no
+ * Spring; the grace-window reference computation is exercised through {@link
+ * InstanceEntitlementGate#evaluate} with mocked collaborators.
  */
+@ExtendWith(MockitoExtension.class)
 class InstanceEntitlementGateTest {
 
+    @Mock private DeviceCredentialStore credentialStore;
+    @Mock private EntitlementCache entitlementCache;
+    @Mock private AccountLinkSyncStateRepository syncStateRepository;
+    @Mock private LocalUsageService localUsageService;
+
     private static InstanceEntitlement free() {
         return new InstanceEntitlement(false, 100, 0, null, EntitlementState.OK);
     }
@@ -35,35 +47,67 @@ class InstanceEntitlementGateTest {
 
     @Test
     void flagOff_allowsEverything_evenBillableUnlinked() {
-        GateDecision d = InstanceEntitlementGate.decide(false, true, false, Optional.empty());
+        GateDecision d =
+                InstanceEntitlementGate.decide(false, true, false, Optional.empty(), false, 0L);
         assertTrue(d.allowed());
         assertEquals(Reason.FLAG_OFF, d.reason());
     }
 
     @Test
     void manualTool_alwaysFree_evenUnlinked() {
-        GateDecision d = InstanceEntitlementGate.decide(true, false, false, Optional.empty());
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, false, false, Optional.empty(), false, 0L);
         assertTrue(d.allowed());
         assertEquals(Reason.MANUAL_FREE, d.reason());
     }
 
     @Test
     void billable_notLinked_blocksWithLinkSignal() {
-        GateDecision d = InstanceEntitlementGate.decide(true, true, false, Optional.empty());
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, false, Optional.empty(), false, 0L);
         assertFalse(d.allowed());
         assertEquals(Reason.NOT_LINKED, d.reason());
     }
 
     @Test
-    void billable_linked_entitlementUnreachable_failsOpen() {
-        GateDecision d = InstanceEntitlementGate.decide(true, true, true, Optional.empty());
+    void billable_linked_entitlementUnreachable_withinGrace_failsOpen() {
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.empty(), false, 0L);
         assertTrue(d.allowed());
         assertEquals(Reason.FAIL_OPEN, d.reason());
     }
 
+    @Test
+    void billable_linked_entitlementUnreachable_graceExpired_blocks() {
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.empty(), true, 0L);
+        assertFalse(d.allowed());
+        assertEquals(Reason.GRACE_EXPIRED, d.reason());
+    }
+
     @Test
     void billable_linked_freePoolAvailable_allows() {
-        GateDecision d = InstanceEntitlementGate.decide(true, true, true, Optional.of(free()));
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.of(free()), false, 0L);
+        assertTrue(d.allowed());
+        assertEquals(Reason.ENTITLED, d.reason());
+    }
+
+    @Test
+    void billable_linked_unsubscribed_pendingLocalUsageDepletesGrant_blocks() {
+        // free() has 100 free units left per the last sync; 100 accrued locally since would exhaust
+        // it once charged, so the gate stops here in real time rather than waiting for the sync.
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.of(free()), false, 100L);
+        assertFalse(d.allowed());
+        assertEquals(Reason.OVER_LIMIT, d.reason());
+    }
+
+    @Test
+    void billable_linked_unsubscribed_pendingLocalUsageLeavesRoom_allows() {
+        // 99 pending against 100 remaining → one unit of grant still projected free → allow.
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.of(free()), false, 99L);
         assertTrue(d.allowed());
         assertEquals(Reason.ENTITLED, d.reason());
     }
@@ -72,7 +116,7 @@ class InstanceEntitlementGateTest {
     void billable_linked_unsubscribedAndExhausted_blocksOverLimit() {
         GateDecision d =
                 InstanceEntitlementGate.decide(
-                        true, true, true, Optional.of(exhaustedUnsubscribed()));
+                        true, true, true, Optional.of(exhaustedUnsubscribed()), false, 0L);
         assertFalse(d.allowed());
         assertEquals(Reason.OVER_LIMIT, d.reason());
     }
@@ -81,7 +125,7 @@ class InstanceEntitlementGateTest {
     void billable_linked_subscribedWithinCap_allows() {
         GateDecision d =
                 InstanceEntitlementGate.decide(
-                        true, true, true, Optional.of(subscribedWithinCap()));
+                        true, true, true, Optional.of(subscribedWithinCap()), false, 0L);
         assertTrue(d.allowed());
         assertEquals(Reason.ENTITLED, d.reason());
     }
@@ -89,18 +133,67 @@ class InstanceEntitlementGateTest {
     @Test
     void billable_linked_subscribedOverCap_blocks() {
         GateDecision d =
-                InstanceEntitlementGate.decide(true, true, true, Optional.of(subscribedOverCap()));
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(subscribedOverCap()), false, 0L);
         assertFalse(d.allowed());
         assertEquals(Reason.OVER_LIMIT, d.reason());
     }
 
+    @Test
+    void billable_linked_subscribedCapped_pendingLocalUsageWouldExceedCap_blocks() {
+        // Within cap per the last sync (spend 10 / cap 100), but 95 accrued locally since would
+        // push
+        // projected spend to 105 → the gate stops now, not after the next sync reconciles.
+        GateDecision d =
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(subscribedWithinCap()), false, 95L);
+        assertFalse(d.allowed());
+        assertEquals(Reason.OVER_LIMIT, d.reason());
+    }
+
+    @Test
+    void billable_linked_subscribedCapped_pendingLeavesCapRoom_allows() {
+        // 10 synced + 80 pending = 90 < 100 cap → still room.
+        GateDecision d =
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(subscribedWithinCap()), false, 80L);
+        assertTrue(d.allowed());
+        assertEquals(Reason.ENTITLED, d.reason());
+    }
+
+    @Test
+    void billable_linked_subscribedCapped_freeGrantAbsorbsPending_allows() {
+        // 50 free units remain, so 40 pending is entirely free → 0 projected paid < 100 cap →
+        // allow.
+        InstanceEntitlement subscribedWithGrant =
+                new InstanceEntitlement(true, 50, 0, 100L, EntitlementState.OK);
+        GateDecision d =
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(subscribedWithGrant), false, 40L);
+        assertTrue(d.allowed());
+        assertEquals(Reason.ENTITLED, d.reason());
+    }
+
+    @Test
+    void billable_linked_subscribedUncapped_pendingIgnored_allows() {
+        // No cap → local pending has no ceiling to hit → always allowed.
+        InstanceEntitlement uncapped =
+                new InstanceEntitlement(true, 0, 999, null, EntitlementState.OK);
+        GateDecision d =
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(uncapped), false, 500L);
+        assertTrue(d.allowed());
+        assertEquals(Reason.ENTITLED, d.reason());
+    }
+
     @Test
     void billable_linked_revoked_blocksWithRevokedSignal() {
         // Authoritative deny (revoked/invalid credential) surfaced by the cache as REVOKED —
         // blocks distinctly from over-limit, even though the snapshot is "present".
         InstanceEntitlement revoked =
                 new InstanceEntitlement(false, 0, 0, null, EntitlementState.REVOKED);
-        GateDecision d = InstanceEntitlementGate.decide(true, true, true, Optional.of(revoked));
+        GateDecision d =
+                InstanceEntitlementGate.decide(true, true, true, Optional.of(revoked), false, 0L);
         assertFalse(d.allowed());
         assertEquals(Reason.REVOKED, d.reason());
     }
@@ -110,7 +203,98 @@ class InstanceEntitlementGateTest {
         // Defensive: an explicit OVER_LIMIT state blocks even if a stale free count looks positive.
         InstanceEntitlement conflicting =
                 new InstanceEntitlement(false, 5, 0, null, EntitlementState.OVER_LIMIT);
-        GateDecision d = InstanceEntitlementGate.decide(true, true, true, Optional.of(conflicting));
+        GateDecision d =
+                InstanceEntitlementGate.decide(
+                        true, true, true, Optional.of(conflicting), false, 0L);
+        assertFalse(d.allowed());
+        assertEquals(Reason.OVER_LIMIT, d.reason());
+    }
+
+    // --- grace window (evaluate()) ---------------------------------------------------------------
+
+    private InstanceEntitlementGate gate(AccountLinkProperties props) {
+        return new InstanceEntitlementGate(
+                props, credentialStore, entitlementCache, syncStateRepository, localUsageService);
+    }
+
+    private static AccountLinkProperties props(boolean meteringEnabled, int graceDays) {
+        AccountLinkProperties p = new AccountLinkProperties();
+        p.setEnabled(true);
+        p.getMetering().setEnabled(meteringEnabled);
+        p.getMetering().setGraceDays(graceDays);
+        return p;
+    }
+
+    @Test
+    void evaluate_meteringOff_unreachable_failsOpen_neverGraceBlocks() {
+        when(credentialStore.isLinked()).thenReturn(true);
+        when(entitlementCache.current()).thenReturn(Optional.empty());
+
+        GateDecision d = gate(props(false, 3)).evaluate(true);
+
+        // Metering off → grace never applies, even if a sync is ancient.
+        assertTrue(d.allowed());
+        assertEquals(Reason.FAIL_OPEN, d.reason());
+    }
+
+    @Test
+    void evaluate_neverSynced_pastGraceSinceLink_blocks() {
+        when(credentialStore.isLinked()).thenReturn(true);
+        when(entitlementCache.current()).thenReturn(Optional.empty());
+        when(syncStateRepository.findById(AccountLinkSyncState.SINGLETON_ID))
+                .thenReturn(Optional.empty());
+        DeviceCredential cred = new DeviceCredential();
+        cred.setLinkedAt(LocalDateTime.now().minusDays(5));
+        when(credentialStore.get()).thenReturn(Optional.of(cred));
+
+        GateDecision d = gate(props(true, 3)).evaluate(true);
+
+        assertFalse(d.allowed());
+        assertEquals(Reason.GRACE_EXPIRED, d.reason());
+    }
+
+    @Test
+    void evaluate_recentSync_withinGrace_failsOpen() {
+        when(credentialStore.isLinked()).thenReturn(true);
+        when(entitlementCache.current()).thenReturn(Optional.empty());
+        AccountLinkSyncState state = new AccountLinkSyncState();
+        state.setLastSuccessAt(LocalDateTime.now().minusDays(1));
+        when(syncStateRepository.findById(AccountLinkSyncState.SINGLETON_ID))
+                .thenReturn(Optional.of(state));
+
+        GateDecision d = gate(props(true, 3)).evaluate(true);
+
+        assertTrue(d.allowed());
+        assertEquals(Reason.FAIL_OPEN, d.reason());
+    }
+
+    @Test
+    void evaluate_unsubscribed_localUsageWouldExceedGrant_blocksInRealTime() {
+        // 100 free units remaining per the last sync, but 100 already accrued locally since — the
+        // gate subtracts the pending delta and blocks now, not after the next sync reconciles.
+        when(credentialStore.isLinked()).thenReturn(true);
+        when(entitlementCache.current()).thenReturn(Optional.of(free()));
+        when(localUsageService.currentPeriodUnsynced())
+                .thenReturn(new LocalUsageService.LocalUsage(LocalDateTime.now(), 100, 0, 0, 100));
+
+        GateDecision d = gate(props(true, 3)).evaluate(true);
+
+        assertFalse(d.allowed());
+        assertEquals(Reason.OVER_LIMIT, d.reason());
+    }
+
+    @Test
+    void evaluate_subscribedCapped_localUsageWouldExceedCap_blocksInRealTime() {
+        // Subscribed within cap per the last sync (spend 10 / cap 100), but 90 accrued locally
+        // since — evaluate() now depletes the cap by pending usage for capped subscriptions too, so
+        // the gate stops now instead of overshooting the cap until the next sync.
+        when(credentialStore.isLinked()).thenReturn(true);
+        when(entitlementCache.current()).thenReturn(Optional.of(subscribedWithinCap()));
+        when(localUsageService.currentPeriodUnsynced())
+                .thenReturn(new LocalUsageService.LocalUsage(LocalDateTime.now(), 0, 90, 0, 90));
+
+        GateDecision d = gate(props(true, 3)).evaluate(true);
+
         assertFalse(d.allowed());
         assertEquals(Reason.OVER_LIMIT, d.reason());
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateWiringTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateWiringTest.java
index f764f5e836..06b99e0eb5 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateWiringTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementGateWiringTest.java
@@ -19,6 +19,7 @@ class InstanceEntitlementGateWiringTest {
     private AccountLinkProperties properties;
     private DeviceCredentialStore store;
     private EntitlementCache cache;
+    private LocalUsageService localUsage;
     private InstanceEntitlementGate gate;
 
     @BeforeEach
@@ -27,7 +28,14 @@ class InstanceEntitlementGateWiringTest {
         properties.setEnabled(true);
         store = mock(DeviceCredentialStore.class);
         cache = mock(EntitlementCache.class);
-        gate = new InstanceEntitlementGate(properties, store, cache);
+        localUsage = mock(LocalUsageService.class);
+        gate =
+                new InstanceEntitlementGate(
+                        properties,
+                        store,
+                        cache,
+                        mock(AccountLinkSyncStateRepository.class),
+                        localUsage);
     }
 
     @Test
@@ -55,6 +63,10 @@ class InstanceEntitlementGateWiringTest {
                 .thenReturn(
                         Optional.of(
                                 new InstanceEntitlement(false, 5, 0, null, EntitlementState.OK)));
+        // Unsubscribed → the gate reads local unsynced usage to deplete the grant in real time;
+        // nothing pending here, so the 5 free units still allow the request.
+        when(localUsage.currentPeriodUnsynced())
+                .thenReturn(new LocalUsageService.LocalUsage(null, 0, 0, 0, 0));
         GateDecision d = gate.evaluate(true);
         assertTrue(d.allowed());
         assertEquals(GateDecision.Reason.ENTITLED, d.reason());
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
index 709e3c0866..13a2606105 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
@@ -3,24 +3,55 @@ package stirling.software.proprietary.accountlink;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.ArgumentMatchers.notNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 
+import java.io.ByteArrayOutputStream;
+import java.nio.file.Path;
+import java.time.LocalDateTime;
+import java.util.Optional;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.mock.web.MockMultipartHttpServletRequest;
+
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.proprietary.billing.BillingCategory;
+import stirling.software.proprietary.billing.UnitCalcPolicy;
 
 @ExtendWith(MockitoExtension.class)
 class InstanceEntitlementInterceptorTest {
 
     @Mock private InstanceEntitlementGate gate;
+    @Mock private EntitlementCache entitlementCache;
+    @Mock private ObjectProvider<UsageMeterService> meterProvider;
+    @Mock private TempFileManager tempFileManager;
+
+    private InstanceEntitlementInterceptor interceptor() {
+        return new InstanceEntitlementInterceptor(
+                gate, entitlementCache, meterProvider, tempFileManager);
+    }
 
     private boolean preHandle(MockHttpServletResponse response) throws Exception {
-        return new InstanceEntitlementInterceptor(gate)
+        return interceptor()
                 .preHandle(
                         new MockHttpServletRequest("GET", "/api/v1/ai/x"), response, new Object());
     }
@@ -58,4 +89,85 @@ class InstanceEntitlementInterceptorTest {
         assertTrue(preHandle(response));
         assertEquals(200, response.getStatus());
     }
+
+    @Test
+    void metersSuccessfulBillableOp() throws Exception {
+        when(gate.evaluate(anyBoolean()))
+                .thenReturn(GateDecision.allow(GateDecision.Reason.ENTITLED));
+        UsageMeterService meter = mock(UsageMeterService.class);
+        when(meterProvider.getIfAvailable()).thenReturn(meter);
+        UnitCalcPolicy policy = new UnitCalcPolicy(1, 1_048_576L, 1, 1000);
+        LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+        when(entitlementCache.current()).thenReturn(Optional.of(entitled(policy, period)));
+
+        InstanceEntitlementInterceptor interceptor = interceptor();
+        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/ai/x");
+        MockHttpServletResponse resp = new MockHttpServletResponse();
+        interceptor.preHandle(req, resp, new Object()); // stashes AI category
+        interceptor.afterCompletion(req, resp, new Object(), null);
+
+        // No uploaded files → bytes axis → the 1-unit floor; no input identity → null signature.
+        verify(meter).accrue(eq(period), eq(BillingCategory.AI), eq(1L), isNull());
+    }
+
+    @Test
+    void metersPdfByPageCountNotJustBytes(@TempDir Path tmp) throws Exception {
+        when(gate.evaluate(anyBoolean()))
+                .thenReturn(GateDecision.allow(GateDecision.Reason.ENTITLED));
+        UsageMeterService meter = mock(UsageMeterService.class);
+        when(meterProvider.getIfAvailable()).thenReturn(meter);
+        // docPagesPerUnit=1, docBytesPerUnit=1MB → a tiny 5-page PDF costs 5 on the page axis but
+        // only 1 on the byte axis: page-counting (via jpdfium) is what makes this bill correctly.
+        UnitCalcPolicy policy = new UnitCalcPolicy(1, 1_048_576L, 1, 1000);
+        LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+        when(entitlementCache.current()).thenReturn(Optional.of(entitled(policy, period)));
+        // Materialise to a real path under @TempDir; the interceptor writes the upload there and
+        // jpdfium + the hasher read it back.
+        TempFile temp = mock(TempFile.class);
+        when(temp.getPath()).thenReturn(tmp.resolve("input.bin"));
+        when(tempFileManager.createManagedTempFile(any())).thenReturn(temp);
+
+        InstanceEntitlementInterceptor interceptor = interceptor();
+        MockMultipartHttpServletRequest req = new MockMultipartHttpServletRequest();
+        req.setRequestURI("/api/v1/ai/x");
+        req.addFile(new MockMultipartFile("file", "doc.pdf", "application/pdf", fivePagePdf()));
+        MockHttpServletResponse resp = new MockHttpServletResponse();
+        interceptor.preHandle(req, resp, new Object());
+        interceptor.afterCompletion(req, resp, new Object(), null);
+
+        // 5 pages + a non-null input-set signature (file ops carry a dedup key).
+        verify(meter).accrue(eq(period), eq(BillingCategory.AI), eq(5L), notNull());
+    }
+
+    @Test
+    void doesNotMeterWhenMeteringSwitchOff() throws Exception {
+        when(gate.evaluate(anyBoolean()))
+                .thenReturn(GateDecision.allow(GateDecision.Reason.ENTITLED));
+        when(meterProvider.getIfAvailable()).thenReturn(null); // metering.enabled = false
+
+        InstanceEntitlementInterceptor interceptor = interceptor();
+        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/ai/x");
+        MockHttpServletResponse resp = new MockHttpServletResponse();
+        interceptor.preHandle(req, resp, new Object());
+        interceptor.afterCompletion(req, resp, new Object(), null);
+
+        // Meter absent → no entitlement lookup, no accrual.
+        verifyNoInteractions(entitlementCache);
+    }
+
+    private static InstanceEntitlement entitled(UnitCalcPolicy policy, LocalDateTime period) {
+        return new InstanceEntitlement(
+                true, 0, 0, 100L, EntitlementState.OK, policy, period, period.plusMonths(1));
+    }
+
+    private static byte[] fivePagePdf() throws Exception {
+        try (PDDocument doc = new PDDocument();
+                ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+            for (int i = 0; i < 5; i++) {
+                doc.addPage(new PDPage());
+            }
+            doc.save(out);
+            return out.toByteArray();
+        }
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/LocalUsageServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/LocalUsageServiceTest.java
new file mode 100644
index 0000000000..4605348666
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/LocalUsageServiceTest.java
@@ -0,0 +1,75 @@
+package stirling.software.proprietary.accountlink;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class LocalUsageServiceTest {
+
+    @Mock private UsageCounterRepository counters;
+    @Mock private EntitlementCache entitlementCache;
+
+    private LocalUsageService service;
+    private final LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+
+    @BeforeEach
+    void setUp() {
+        service = new LocalUsageService(counters, entitlementCache);
+    }
+
+    private static UsageCounter counter(
+            LocalDateTime period, String category, long cumulative, long synced) {
+        return new UsageCounter(period, category, cumulative, synced, LocalDateTime.now());
+    }
+
+    private static InstanceEntitlement entitledFor(LocalDateTime periodStart) {
+        return new InstanceEntitlement(
+                true,
+                0,
+                0,
+                null,
+                EntitlementState.OK,
+                null,
+                periodStart,
+                periodStart.plusMonths(1));
+    }
+
+    @Test
+    void unknownPeriodReturnsZeros() {
+        when(entitlementCache.current()).thenReturn(Optional.empty());
+
+        LocalUsageService.LocalUsage usage = service.currentPeriodUnsynced();
+
+        assertThat(usage.periodStart()).isNull();
+        assertThat(usage.totalUnsyncedUnits()).isZero();
+    }
+
+    @Test
+    void sumsPerCategoryUnsyncedDeltaForCurrentPeriod() {
+        when(entitlementCache.current()).thenReturn(Optional.of(entitledFor(period)));
+        when(counters.findByPeriodStart(period))
+                .thenReturn(
+                        List.of(
+                                counter(period, "API", 30L, 10L), // 20 unsynced
+                                counter(period, "AI", 4L, 4L), // 0 unsynced (all reported)
+                                counter(period, "AUTOMATION", 7L, 2L))); // 5 unsynced
+
+        LocalUsageService.LocalUsage usage = service.currentPeriodUnsynced();
+
+        assertThat(usage.periodStart()).isEqualTo(period);
+        assertThat(usage.apiUnsyncedUnits()).isEqualTo(20L);
+        assertThat(usage.aiUnsyncedUnits()).isEqualTo(0L);
+        assertThat(usage.automationUnsyncedUnits()).isEqualTo(5L);
+        assertThat(usage.totalUnsyncedUnits()).isEqualTo(25L);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageMeterServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageMeterServiceTest.java
new file mode 100644
index 0000000000..0c9ad2c62e
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageMeterServiceTest.java
@@ -0,0 +1,133 @@
+package stirling.software.proprietary.accountlink;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.time.LocalDateTime;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.dao.DataIntegrityViolationException;
+
+import stirling.software.proprietary.billing.BillingCategory;
+
+@ExtendWith(MockitoExtension.class)
+class UsageMeterServiceTest {
+
+    @Mock private UsageCounterRepository repo;
+    @Mock private MeteredInputSignatureRepository signatureRepo;
+
+    private UsageMeterService service;
+    private final LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+
+    @BeforeEach
+    void setUp() {
+        service = new UsageMeterService(repo, signatureRepo, new AccountLinkProperties());
+    }
+
+    @Test
+    void incrementsExistingCounter() {
+        when(repo.increment(eq(period), eq("AI"), eq(5L), any())).thenReturn(1);
+
+        service.accrue(period, BillingCategory.AI, 5, null);
+
+        verify(repo).increment(eq(period), eq("AI"), eq(5L), any());
+        verify(repo, never()).saveAndFlush(any());
+    }
+
+    @Test
+    void insertsWhenNoRowExists() {
+        when(repo.increment(eq(period), eq("API"), eq(3L), any())).thenReturn(0);
+
+        service.accrue(period, BillingCategory.API, 3, null);
+
+        verify(repo).saveAndFlush(any(UsageCounter.class));
+    }
+
+    @Test
+    void retriesIncrementWhenInsertLosesRace() {
+        // First increment misses (no row); insert loses the race to a concurrent thread; the
+        // second increment then succeeds against the row that thread created.
+        when(repo.increment(eq(period), eq("AUTOMATION"), eq(2L), any())).thenReturn(0, 1);
+        when(repo.saveAndFlush(any())).thenThrow(new DataIntegrityViolationException("dup"));
+
+        service.accrue(period, BillingCategory.AUTOMATION, 2, null);
+
+        verify(repo, times(2)).increment(eq(period), eq("AUTOMATION"), eq(2L), any());
+    }
+
+    @Test
+    void skipsBypassedNonPositiveAndNullPeriod() {
+        service.accrue(period, BillingCategory.BYPASSED, 5, null);
+        service.accrue(period, BillingCategory.AI, 0, null);
+        service.accrue(null, BillingCategory.AI, 5, null);
+
+        verifyNoInteractions(repo, signatureRepo);
+    }
+
+    @Test
+    void chargesNewSignatureThenAccrues() {
+        when(signatureRepo.findByPeriodStartAndSignature(period, "op-sig-new"))
+                .thenReturn(Optional.empty());
+        when(repo.increment(eq(period), eq("AI"), eq(5L), any())).thenReturn(1);
+
+        service.accrue(period, BillingCategory.AI, 5, "op-sig-new");
+
+        verify(signatureRepo).saveAndFlush(any(MeteredInputSignature.class));
+        verify(repo).increment(eq(period), eq("AI"), eq(5L), any());
+    }
+
+    @Test
+    void skipsConcurrentDuplicateClaim() {
+        // Unseen this period, but a concurrent op wins the insert first → treated as within-window
+        // chaining, not re-charged.
+        when(signatureRepo.findByPeriodStartAndSignature(period, "op-sig-race"))
+                .thenReturn(Optional.empty());
+        when(signatureRepo.saveAndFlush(any()))
+                .thenThrow(new DataIntegrityViolationException("dup"));
+
+        service.accrue(period, BillingCategory.AI, 5, "op-sig-race");
+
+        verify(repo, never()).increment(any(), any(), anyLong(), any());
+        verify(repo, never()).saveAndFlush(any());
+    }
+
+    @Test
+    void skipsRepeatWithinWorkflowWindow() {
+        // Same input set seen moments ago → chaining → not re-charged; the window slides.
+        MeteredInputSignature recent =
+                new MeteredInputSignature(period, "op-sig", LocalDateTime.now());
+        when(signatureRepo.findByPeriodStartAndSignature(period, "op-sig"))
+                .thenReturn(Optional.of(recent));
+
+        service.accrue(period, BillingCategory.AI, 5, "op-sig");
+
+        verify(repo, never()).increment(any(), any(), anyLong(), any());
+        verify(signatureRepo).save(recent); // window touched
+    }
+
+    @Test
+    void chargesRepeatOutsideWorkflowWindow() {
+        // Same input set last seen well past the 5-minute window → an independent re-run → charged.
+        MeteredInputSignature stale =
+                new MeteredInputSignature(period, "op-sig", LocalDateTime.now().minusMinutes(10));
+        when(signatureRepo.findByPeriodStartAndSignature(period, "op-sig"))
+                .thenReturn(Optional.of(stale));
+        when(repo.increment(eq(period), eq("AI"), eq(5L), any())).thenReturn(1);
+
+        service.accrue(period, BillingCategory.AI, 5, "op-sig");
+
+        verify(repo).increment(eq(period), eq("AI"), eq(5L), any());
+        verify(signatureRepo).save(stale); // window touched
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageSyncServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageSyncServiceTest.java
new file mode 100644
index 0000000000..1b1ade7e80
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/UsageSyncServiceTest.java
@@ -0,0 +1,171 @@
+package stirling.software.proprietary.accountlink;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.scheduling.config.ScheduledTaskRegistrar;
+
+@ExtendWith(MockitoExtension.class)
+class UsageSyncServiceTest {
+
+    @Mock private UsageCounterRepository counters;
+    @Mock private AccountLinkSyncStateRepository syncState;
+    @Mock private DeviceCredentialStore credentialStore;
+    @Mock private AccountLinkClient client;
+    @Mock private EntitlementCache entitlementCache;
+
+    private UsageSyncService service;
+    private final LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+
+    @BeforeEach
+    void setUp() {
+        service =
+                new UsageSyncService(
+                        counters,
+                        syncState,
+                        credentialStore,
+                        client,
+                        entitlementCache,
+                        new AccountLinkProperties());
+    }
+
+    @Test
+    void registersFixedDelayTaskWithConfiguredInterval() {
+        AccountLinkProperties props = new AccountLinkProperties();
+        props.getMetering().setSyncIntervalHours(6);
+        UsageSyncService svc =
+                new UsageSyncService(
+                        counters, syncState, credentialStore, client, entitlementCache, props);
+
+        ScheduledTaskRegistrar registrar = new ScheduledTaskRegistrar();
+        svc.configureTasks(registrar);
+
+        // Pins the interval binding in CI — the old @Scheduled SpEL only resolved at flags-on boot.
+        assertThat(registrar.getFixedDelayTaskList()).hasSize(1);
+        assertThat(registrar.getFixedDelayTaskList().get(0).getIntervalDuration())
+                .isEqualTo(Duration.ofHours(6));
+    }
+
+    private static DeviceCredential credential() {
+        DeviceCredential c = new DeviceCredential();
+        c.setDeviceId("dev-1");
+        c.setDeviceSecret("sec-1");
+        return c;
+    }
+
+    private static UsageCounter counter(LocalDateTime period, String category, long cumulative) {
+        return new UsageCounter(period, category, cumulative, LocalDateTime.now());
+    }
+
+    private static InstanceEntitlement entitled() {
+        return new InstanceEntitlement(true, 0, 0, null, EntitlementState.OK);
+    }
+
+    @Test
+    void notLinkedSkipsEntirely() {
+        when(credentialStore.get()).thenReturn(Optional.empty());
+
+        service.syncNow();
+
+        verifyNoInteractions(client, entitlementCache);
+        verify(counters, never()).findPeriodsWithUnsyncedUsage();
+    }
+
+    @Test
+    void nothingPendingStillForcesEntitlementRefresh() {
+        when(credentialStore.get()).thenReturn(Optional.of(credential()));
+        when(counters.findPeriodsWithUnsyncedUsage()).thenReturn(List.of());
+
+        service.syncNow();
+
+        // No usage to report, so nothing is sent and no markers advance — but the sync still forces
+        // an entitlement refresh so an out-of-band plan change (e.g. a just-completed subscription)
+        // surfaces on the gate immediately instead of waiting out the entitlement-cache TTL.
+        verifyNoInteractions(client);
+        verify(syncState, never()).save(any());
+        verify(entitlementCache, never()).accept(any());
+        verify(entitlementCache).invalidate();
+        verify(entitlementCache).current();
+    }
+
+    @Test
+    void reportsCumulativePerCategoryAndAdvancesSyncedMarkers() {
+        AccountLinkSyncState state = new AccountLinkSyncState();
+        state.setId(AccountLinkSyncState.SINGLETON_ID);
+        state.setLastSyncSeq(5L);
+        when(credentialStore.get()).thenReturn(Optional.of(credential()));
+        when(counters.findPeriodsWithUnsyncedUsage()).thenReturn(List.of(period));
+        when(counters.findByPeriodStart(period))
+                .thenReturn(List.of(counter(period, "API", 12L), counter(period, "AI", 4L)));
+        when(syncState.findById(AccountLinkSyncState.SINGLETON_ID)).thenReturn(Optional.of(state));
+        InstanceEntitlement fresh = entitled();
+        when(client.reportUsage(
+                        eq("dev-1"), eq("sec-1"), eq(6L), eq(period), eq(12L), eq(4L), eq(0L)))
+                .thenReturn(fresh);
+
+        service.syncNow();
+
+        // Seq advanced from 5 → 6 and the report carried the per-category cumulative.
+        verify(client)
+                .reportUsage(eq("dev-1"), eq("sec-1"), eq(6L), eq(period), eq(12L), eq(4L), eq(0L));
+        // Only categories with usage are marked; AUTOMATION (0) is skipped.
+        verify(counters).markSynced(period, "API", 12L);
+        verify(counters).markSynced(period, "AI", 4L);
+        verify(counters, never()).markSynced(eq(period), eq("AUTOMATION"), anyLong());
+        // Two saves: the pre-report seq reservation + the post-success timestamp.
+        verify(syncState, times(2)).save(state);
+        verify(entitlementCache).accept(fresh);
+    }
+
+    @Test
+    void transportFailureReservesSeqButLeavesMarkersUntouched() {
+        AccountLinkSyncState state = new AccountLinkSyncState();
+        state.setId(AccountLinkSyncState.SINGLETON_ID);
+        when(credentialStore.get()).thenReturn(Optional.of(credential()));
+        when(counters.findPeriodsWithUnsyncedUsage()).thenReturn(List.of(period));
+        when(counters.findByPeriodStart(period)).thenReturn(List.of(counter(period, "API", 12L)));
+        when(syncState.findById(AccountLinkSyncState.SINGLETON_ID)).thenReturn(Optional.of(state));
+        when(client.reportUsage(any(), any(), anyLong(), any(), anyLong(), anyLong(), anyLong()))
+                .thenReturn(null);
+
+        service.syncNow();
+
+        verify(counters, never()).markSynced(any(), any(), anyLong());
+        verify(syncState, times(1)).save(state); // seq reserved, success not recorded
+        verify(entitlementCache).accept(null); // nothing fresh adopted
+    }
+
+    @Test
+    void revokedAbortsWithoutMarkingOrAdoptingEntitlement() {
+        AccountLinkSyncState state = new AccountLinkSyncState();
+        state.setId(AccountLinkSyncState.SINGLETON_ID);
+        when(credentialStore.get()).thenReturn(Optional.of(credential()));
+        when(counters.findPeriodsWithUnsyncedUsage()).thenReturn(List.of(period));
+        when(counters.findByPeriodStart(period)).thenReturn(List.of(counter(period, "API", 12L)));
+        when(syncState.findById(AccountLinkSyncState.SINGLETON_ID)).thenReturn(Optional.of(state));
+        when(client.reportUsage(any(), any(), anyLong(), any(), anyLong(), anyLong(), anyLong()))
+                .thenThrow(new AccountLinkClient.RevokedException(403));
+
+        service.syncNow();
+
+        verify(counters, never()).markSynced(any(), any(), anyLong());
+        verify(entitlementCache, never()).accept(any());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/billing/BillingCategoryClassifierTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/billing/BillingCategoryClassifierTest.java
new file mode 100644
index 0000000000..1eb6c3360a
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/billing/BillingCategoryClassifierTest.java
@@ -0,0 +1,30 @@
+package stirling.software.proprietary.billing;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.Test;
+
+class BillingCategoryClassifierTest {
+
+    @Test
+    void automationWinsOverEverything() {
+        assertEquals(
+                BillingCategory.AUTOMATION, BillingCategoryClassifier.classify(true, true, true));
+    }
+
+    @Test
+    void aiWinsOverApiKey() {
+        assertEquals(BillingCategory.AI, BillingCategoryClassifier.classify(false, true, true));
+    }
+
+    @Test
+    void apiKeyWhenNotAutomationOrAi() {
+        assertEquals(BillingCategory.API, BillingCategoryClassifier.classify(false, false, true));
+    }
+
+    @Test
+    void bypassedWhenNoSignal() {
+        assertEquals(
+                BillingCategory.BYPASSED, BillingCategoryClassifier.classify(false, false, false));
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/accountlink/InstanceController.java b/app/saas/src/main/java/stirling/software/saas/accountlink/InstanceController.java
index 7392eb928a..7c98d5e59b 100644
--- a/app/saas/src/main/java/stirling/software/saas/accountlink/InstanceController.java
+++ b/app/saas/src/main/java/stirling/software/saas/accountlink/InstanceController.java
@@ -1,5 +1,8 @@
 package stirling.software.saas.accountlink;
 
+import java.time.LocalDateTime;
+import java.util.Map;
+
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Profile;
 import org.springframework.http.HttpStatus;
@@ -9,6 +12,7 @@ import org.springframework.security.core.Authentication;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -16,11 +20,16 @@ import io.swagger.v3.oas.annotations.Hidden;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.proprietary.billing.UnitCalcPolicy;
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
 import stirling.software.saas.payg.entitlement.EntitlementService;
 import stirling.software.saas.payg.entitlement.EntitlementSnapshot;
+import stirling.software.saas.payg.instance.InstanceUsageIngestService;
+import stirling.software.saas.payg.model.BillingCategory;
 import stirling.software.saas.payg.model.EntitlementState;
+import stirling.software.saas.payg.policy.PricingPolicy;
+import stirling.software.saas.payg.policy.PricingPolicyService;
 
 /**
  * Instance-facing surface (combined-billing "Mode A"), authenticated by the <b>device
@@ -46,14 +55,23 @@ public class InstanceController {
     private final EntitlementService entitlementService;
     private final TeamBillingService billingService;
     private final AccountLinkService accountLinkService;
+    private final PricingPolicyService pricingPolicyService;
+    private final InstanceUsageIngestService usageIngestService;
+    private final LinkedInstanceRepository linkedInstanceRepository;
 
     public InstanceController(
             EntitlementService entitlementService,
             TeamBillingService billingService,
-            AccountLinkService accountLinkService) {
+            AccountLinkService accountLinkService,
+            PricingPolicyService pricingPolicyService,
+            InstanceUsageIngestService usageIngestService,
+            LinkedInstanceRepository linkedInstanceRepository) {
         this.entitlementService = entitlementService;
         this.billingService = billingService;
         this.accountLinkService = accountLinkService;
+        this.pricingPolicyService = pricingPolicyService;
+        this.usageIngestService = usageIngestService;
+        this.linkedInstanceRepository = linkedInstanceRepository;
     }
 
     public record WhoAmIResponse(Long instanceId, Long teamId) {}
@@ -68,7 +86,13 @@ public class InstanceController {
             long freeRemainingUnits,
             long periodSpendUnits,
             Long periodCapUnits,
-            String state) {}
+            String state,
+            // Metering inputs the instance needs to cost + bucket its own usage (Phase 2). The
+            // instance computes units locally with this policy and resets its per-period cumulative
+            // counters on the [periodStart, periodEnd) boundary.
+            UnitCalcPolicy unitCalcPolicy,
+            LocalDateTime periodStart,
+            LocalDateTime periodEnd) {}
 
     @GetMapping("/whoami")
     @PreAuthorize("hasRole('LINKED_INSTANCE')")
@@ -103,20 +127,96 @@ public class InstanceController {
         if (!(auth instanceof LinkedInstanceAuthenticationToken token)) {
             return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
         }
-        Long teamId = token.getTeamId();
+        // Drop the cached snapshot first: this low-frequency read gates real-time billable work, so
+        // it must reflect a just-changed subscription/cap at once (the flip is a DB-function write
+        // with no Java event to invalidate on).
+        entitlementService.invalidate(token.getTeamId());
+        return ResponseEntity.ok(buildEntitlement(token.getTeamId()));
+    }
 
+    /** Body for {@code POST /sync}: the instance's cumulative units per category this period. */
+    public record UsageSyncRequest(
+            long syncSeq, LocalDateTime periodStart, CategoryUnits cumulativeUnits) {
+        public record CategoryUnits(long api, long ai, long automation) {}
+    }
+
+    /**
+     * Daily usage sync: the instance reports its cumulative per-category unit totals for the
+     * period; SaaS bills the delta since the last sync (reusing the standard charge path) and
+     * returns the fresh entitlement — so one round-trip both reports usage and refreshes the gate
+     * state.
+     */
+    @PostMapping("/sync")
+    @PreAuthorize("hasRole('LINKED_INSTANCE')")
+    @Transactional
+    public ResponseEntity<EntitlementResponse> sync(
+            Authentication auth, @RequestBody UsageSyncRequest req) {
+        if (!(auth instanceof LinkedInstanceAuthenticationToken token)) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        }
+        if (req == null || req.periodStart() == null || req.cumulativeUnits() == null) {
+            return ResponseEntity.badRequest().build();
+        }
+        Long teamId = token.getTeamId();
+        // periodStart is the dedup/regression partition key, so bound a fabricated value to the
+        // snapshot window (current or immediately-prior period, never future).
+        EntitlementSnapshot snap = entitlementService.getSnapshot(teamId);
+        LocalDateTime reported = req.periodStart();
+        if (!reported.isBefore(snap.periodEnd())
+                || reported.isBefore(snap.periodStart().minusMonths(1))) {
+            log.warn(
+                    "Instance sync for team {} reported implausible periodStart {} (authoritative"
+                            + " {}..{}); rejecting.",
+                    teamId,
+                    reported,
+                    snap.periodStart(),
+                    snap.periodEnd());
+            return ResponseEntity.badRequest().build();
+        }
+        // Attribute the charge to the admin who linked the instance (the device credential carries
+        // no user). Null is tolerated by the ingest service (it skips + retries next sync).
+        Long actorUserId =
+                linkedInstanceRepository
+                        .findById(token.getInstanceId())
+                        .map(LinkedInstance::getCreatedByUserId)
+                        .orElse(null);
+        UsageSyncRequest.CategoryUnits c = req.cumulativeUnits();
+        usageIngestService.ingest(
+                teamId,
+                actorUserId,
+                req.syncSeq(),
+                req.periodStart(),
+                Map.of(
+                        BillingCategory.API, c.api(),
+                        BillingCategory.AI, c.ai(),
+                        BillingCategory.AUTOMATION, c.automation()));
+        // Drop the cache so the buildEntitlement below (and the portal's next read) reflect the
+        // just-charged delta + moved free-grant balance now, not after the TTL.
+        entitlementService.invalidate(teamId);
+        return ResponseEntity.ok(buildEntitlement(teamId));
+    }
+
+    /** The entitlement view shared by {@code GET /entitlement} and the {@code /sync} response. */
+    private EntitlementResponse buildEntitlement(Long teamId) {
         // Same composition the FE wallet uses: billing facts (subscription, free pool) from
-        // TeamBillingService, period spend/cap + state from the entitlement snapshot.
+        // TeamBillingService, period spend/cap + state from the entitlement snapshot, plus the
+        // unit-calc policy + period the instance needs to meter locally.
         TeamBillingContext billing = billingService.forTeam(teamId);
         EntitlementSnapshot snap = entitlementService.getSnapshot(teamId);
-
-        return ResponseEntity.ok(
-                new EntitlementResponse(
-                        billing.subscribed(),
-                        billing.freeRemainingUnits(),
-                        snap.periodSpendUnits(),
-                        snap.periodCapUnits(),
-                        coarseState(snap.state())));
+        PricingPolicy policy = pricingPolicyService.getEffectivePolicy(teamId);
+        return new EntitlementResponse(
+                billing.subscribed(),
+                billing.freeRemainingUnits(),
+                snap.periodSpendUnits(),
+                snap.periodCapUnits(),
+                coarseState(snap.state()),
+                new UnitCalcPolicy(
+                        policy.getDocPagesPerUnit(),
+                        policy.getDocBytesPerUnit(),
+                        policy.getMinChargeUnits(),
+                        policy.getFileUnitCap()),
+                snap.periodStart(),
+                snap.periodEnd());
     }
 
     /**
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
index 041eaa8f4a..b79d57117e 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
@@ -19,6 +19,7 @@ import org.springframework.security.core.Authentication;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PatchMapping;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -328,6 +329,32 @@ public class PaygWalletController {
     /** Request body for {@link #updateCap}. */
     public record UpdateCapRequest(@Min(0) int capUsd, boolean noCap) {}
 
+    // ---------------------------------------------------------------------------------------
+    // POST /wallet/refresh — drop the caller's cached snapshot so the next read is fresh
+    // ---------------------------------------------------------------------------------------
+
+    /**
+     * Drops the caller's team snapshot + billing cache so the next {@code GET /wallet} reflects a
+     * billing state that just changed out-of-band. The subscription flip is written by a Postgres
+     * function ({@code payg_link_subscription}) with no Java event to invalidate on, so a client
+     * that knows a change just happened — the portal while finalizing a checkout — pokes the cache
+     * here rather than waiting out the ~30s TTL. Team-scoped to the caller: a client can only
+     * refresh its own team, and a no-team caller is a cheap no-op.
+     */
+    @PostMapping("/wallet/refresh")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<Void> refreshWallet(Authentication auth) {
+        User user;
+        try {
+            user = AuthenticationUtils.getCurrentUser(auth, userRepository);
+        } catch (SecurityException e) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        }
+        primaryMembership(user.getId())
+                .ifPresent(m -> entitlementService.invalidate(m.getTeam().getId()));
+        return ResponseEntity.noContent().build();
+    }
+
     // ---------------------------------------------------------------------------------------
     // Helpers
     // ---------------------------------------------------------------------------------------
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/docs/DefaultDocumentClassifier.java b/app/saas/src/main/java/stirling/software/saas/payg/docs/DefaultDocumentClassifier.java
index 603f490a4f..04b9b182a2 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/docs/DefaultDocumentClassifier.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/docs/DefaultDocumentClassifier.java
@@ -5,6 +5,7 @@ import java.io.InputStream;
 import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 
@@ -18,6 +19,9 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.jpdfium.PdfDocument;
+import stirling.software.proprietary.billing.DocumentUnitCalculator;
+import stirling.software.proprietary.billing.DocumentUnitCalculator.FileSize;
+import stirling.software.proprietary.billing.UnitCalcPolicy;
 import stirling.software.saas.payg.policy.PricingPolicy;
 
 /**
@@ -42,9 +46,6 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
     private static final String PDF_CONTENT_TYPE = "application/pdf";
     private static final String DEFAULT_CONTENT_TYPE = "application/octet-stream";
 
-    /** Floor for non-empty input. Distinct from {@code policy.minChargeUnits} (applied later). */
-    private static final int MIN_UNITS_PER_NONEMPTY_FILE = 1;
-
     private final TempFileManager tempFileManager;
 
     @Override
@@ -59,13 +60,7 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
         Objects.requireNonNull(policy, "policy");
 
         FileFacts facts = inspect(file, materialisedPath);
-        long rawUnits = computeRawUnits(facts.pages, facts.bytes, policy);
-        // toIntExact: fail loud on overflow rather than silently wrapping a billing number.
-        int units =
-                Math.toIntExact(
-                        Math.max(
-                                MIN_UNITS_PER_NONEMPTY_FILE,
-                                Math.min(policy.getFileUnitCap(), rawUnits)));
+        int units = DocumentUnitCalculator.unitsForFile(facts.pages, facts.bytes, unitCalc(policy));
         return new DocumentMetrics(facts.pages, facts.bytes, facts.contentType, units);
     }
 
@@ -93,17 +88,16 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
 
         int totalPages = 0;
         long totalBytes = 0;
-        long rawUnitsSum = 0;
         String firstContentType = null;
+        List<FileSize> sizes = new ArrayList<>(files.size());
 
         for (int i = 0; i < files.size(); i++) {
             MultipartFile file = files.get(i);
             Path path = materialisedPaths == null ? null : materialisedPaths.get(i);
             FileFacts facts = inspect(file, path);
-            // Sum the *raw* (unclamped) per-file units so the group cap below can actually bind.
-            // Per-file clamping in this loop would make the group cap a no-op.
-            rawUnitsSum =
-                    saturatedAdd(rawUnitsSum, computeRawUnits(facts.pages, facts.bytes, policy));
+            // Collect raw page/byte facts; the group cap is applied over the raw sum in the
+            // calculator (per-file clamping here would make the group cap a no-op).
+            sizes.add(new FileSize(facts.pages, facts.bytes));
             totalPages = saturatedAdd(totalPages, facts.pages);
             totalBytes = saturatedAdd(totalBytes, facts.bytes);
             if (firstContentType == null) {
@@ -111,13 +105,7 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
             }
         }
 
-        long groupCap = (long) policy.getFileUnitCap() * files.size();
-        // toIntExact: fail loud on overflow rather than silently wrapping.
-        int totalUnits =
-                Math.toIntExact(
-                        Math.max(
-                                (long) MIN_UNITS_PER_NONEMPTY_FILE,
-                                Math.min(groupCap, rawUnitsSum)));
+        int totalUnits = DocumentUnitCalculator.unitsForGroup(sizes, unitCalc(policy));
 
         return new DocumentMetrics(
                 totalPages,
@@ -126,6 +114,14 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
                 totalUnits);
     }
 
+    private static UnitCalcPolicy unitCalc(PricingPolicy policy) {
+        return new UnitCalcPolicy(
+                policy.getDocPagesPerUnit(),
+                policy.getDocBytesPerUnit(),
+                policy.getMinChargeUnits(),
+                policy.getFileUnitCap());
+    }
+
     private FileFacts inspect(MultipartFile file, Path materialisedPath) {
         long bytes = file.getSize();
         String contentType =
@@ -140,19 +136,6 @@ public class DefaultDocumentClassifier implements DocumentClassifier {
         return new FileFacts(pages, bytes, contentType);
     }
 
-    private static long computeRawUnits(int pages, long bytes, PricingPolicy policy) {
-        long pageUnits = pages > 0 ? ceilDiv(pages, policy.getDocPagesPerUnit()) : 0L;
-        long byteUnits = ceilDiv(bytes, policy.getDocBytesPerUnit());
-        return Math.max(pageUnits, byteUnits);
-    }
-
-    private static long ceilDiv(long numerator, long divisor) {
-        if (numerator <= 0) {
-            return 0;
-        }
-        return (numerator + divisor - 1) / divisor;
-    }
-
     private static boolean isPdf(String contentType, String filename) {
         if (PDF_CONTENT_TYPE.equalsIgnoreCase(contentType)) {
             return true;
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/instance/InstanceUsageIngestService.java b/app/saas/src/main/java/stirling/software/saas/payg/instance/InstanceUsageIngestService.java
new file mode 100644
index 0000000000..291a46880c
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/instance/InstanceUsageIngestService.java
@@ -0,0 +1,130 @@
+package stirling.software.saas.payg.instance;
+
+import java.time.LocalDateTime;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.saas.payg.charge.ChargeContext;
+import stirling.software.saas.payg.charge.JobChargeService;
+import stirling.software.saas.payg.model.BillingCategory;
+import stirling.software.saas.payg.model.JobSource;
+import stirling.software.saas.payg.model.ProcessType;
+import stirling.software.saas.payg.repository.PaygInstanceUsageRepository;
+
+/**
+ * Ingests a linked instance's daily usage sync (combined-billing "Mode A"). The instance reports a
+ * monotonic cumulative unit total per {@link BillingCategory}; we bill only the delta since the
+ * last sync via {@link JobChargeService#chargeStandalone} (reusing the in-cloud free-grant split,
+ * ledger DEBIT, Stripe meter and idempotency). Idempotent (a resend → delta 0 → no charge) and
+ * tamper-evident (a backwards total is refused; a monotonic {@code syncSeq} dedups replays). The
+ * cap is enforced at the instance gate, not here. Gated behind {@code account-link.enabled}.
+ */
+@Slf4j
+@Service
+@Profile("saas")
+@ConditionalOnProperty(name = "stirling.billing.account-link.enabled", havingValue = "true")
+public class InstanceUsageIngestService {
+
+    private final PaygInstanceUsageRepository usageRepository;
+    private final JobChargeService chargeService;
+
+    public InstanceUsageIngestService(
+            PaygInstanceUsageRepository usageRepository, JobChargeService chargeService) {
+        this.usageRepository = usageRepository;
+        this.chargeService = chargeService;
+    }
+
+    /**
+     * Bills the delta for each category and advances the last-seen cumulative + sync sequence. The
+     * delta-advance and the charge share this transaction, so a crash before commit re-bills
+     * cleanly on retry (delta unchanged) and a commit means the cumulative moved with the charge.
+     *
+     * @param actorUserId the linking admin ({@code linked_instance.created_by_user_id}); required
+     *     to attribute the charge. If {@code null} we skip entirely (don't advance) so a later
+     *     sync, once the actor is resolvable, still bills the usage.
+     */
+    @Transactional
+    public void ingest(
+            Long teamId,
+            Long actorUserId,
+            long syncSeq,
+            LocalDateTime periodStart,
+            Map<BillingCategory, Long> cumulativeByCategory) {
+        if (teamId == null || periodStart == null || cumulativeByCategory == null) {
+            return;
+        }
+        if (actorUserId == null) {
+            log.warn(
+                    "Instance usage sync for team {} has no actor (created_by_user_id null); not"
+                            + " billing — a later sync will pick it up.",
+                    teamId);
+            return;
+        }
+        cumulativeByCategory.forEach(
+                (category, cumulative) -> {
+                    if (category == null
+                            || category == BillingCategory.BYPASSED
+                            || cumulative == null
+                            || cumulative < 0) {
+                        return;
+                    }
+                    applyCategory(teamId, actorUserId, syncSeq, periodStart, category, cumulative);
+                });
+    }
+
+    private void applyCategory(
+            Long teamId,
+            Long actorUserId,
+            long syncSeq,
+            LocalDateTime periodStart,
+            BillingCategory category,
+            long cumulative) {
+        // Pessimistic row lock so a duplicate delivery can't have two txns read the same baseline
+        // and both charge: the second waits, then sees the advanced seq and replay-skips.
+        PaygInstanceUsage row =
+                usageRepository
+                        .findByTeamIdAndPeriodStartAndCategoryForUpdate(
+                                teamId, periodStart, category.name())
+                        .orElse(null);
+        if (row != null && syncSeq <= row.getLastSyncSeq()) {
+            return; // replay / out-of-order — already applied this or a later sync
+        }
+        long lastCumulative = row == null ? 0L : row.getLastCumulativeUnits();
+        long delta = cumulative - lastCumulative;
+        if (delta < 0) {
+            // The cumulative counter went backwards — a reset or tampering. Refuse to credit; don't
+            // advance, so the discrepancy stays visible and a corrected resend can reconcile.
+            log.warn(
+                    "Instance usage regression team={} category={} reported {} < last {}; ignoring.",
+                    teamId,
+                    category,
+                    cumulative,
+                    lastCumulative);
+            return;
+        }
+        if (delta > 0) {
+            int units = (int) Math.min(delta, Integer.MAX_VALUE);
+            chargeService.chargeStandalone(
+                    new ChargeContext(
+                            actorUserId,
+                            teamId,
+                            JobSource.LINKED_INSTANCE,
+                            ProcessType.SINGLE_TOOL,
+                            category),
+                    units);
+        }
+        if (row == null) {
+            row = new PaygInstanceUsage(teamId, periodStart, category.name(), cumulative, syncSeq);
+        } else {
+            row.setLastCumulativeUnits(cumulative);
+            row.setLastSyncSeq(syncSeq);
+        }
+        usageRepository.save(row);
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/instance/PaygInstanceUsage.java b/app/saas/src/main/java/stirling/software/saas/payg/instance/PaygInstanceUsage.java
new file mode 100644
index 0000000000..45a6435746
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/instance/PaygInstanceUsage.java
@@ -0,0 +1,74 @@
+package stirling.software.saas.payg.instance;
+
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.UpdateTimestamp;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.UniqueConstraint;
+
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * Last-seen cumulative usage a linked self-hosted instance has reported for one {@code (team,
+ * billing period, category)} (combined-billing "Mode A"). The instance reports monotonic cumulative
+ * unit totals on its daily sync; SaaS bills {@code reportedCumulative - lastCumulativeUnits} via
+ * the standard charge path and advances this row. {@code lastSyncSeq} dedups replays.
+ */
+@Entity
+@Table(
+        name = "payg_instance_usage",
+        uniqueConstraints =
+                @UniqueConstraint(
+                        name = "uk_payg_instance_usage",
+                        columnNames = {"team_id", "period_start", "category"}))
+@Getter
+@Setter
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+public class PaygInstanceUsage {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "team_id", nullable = false)
+    private Long teamId;
+
+    @Column(name = "period_start", nullable = false)
+    private LocalDateTime periodStart;
+
+    /** {@code BillingCategory} name — API / AI / AUTOMATION. */
+    @Column(name = "category", nullable = false, length = 32)
+    private String category;
+
+    @Column(name = "last_cumulative_units", nullable = false)
+    private long lastCumulativeUnits;
+
+    @Column(name = "last_sync_seq", nullable = false)
+    private long lastSyncSeq;
+
+    @UpdateTimestamp
+    @Column(name = "updated_at", nullable = false)
+    private LocalDateTime updatedAt;
+
+    public PaygInstanceUsage(
+            Long teamId,
+            LocalDateTime periodStart,
+            String category,
+            long lastCumulativeUnits,
+            long lastSyncSeq) {
+        this.teamId = teamId;
+        this.periodStart = periodStart;
+        this.category = category;
+        this.lastCumulativeUnits = lastCumulativeUnits;
+        this.lastSyncSeq = lastSyncSeq;
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/lineage/ByteHashSignatureExtractor.java b/app/saas/src/main/java/stirling/software/saas/payg/lineage/ByteHashSignatureExtractor.java
index 86e6e4ab47..4e62afcbd8 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/lineage/ByteHashSignatureExtractor.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/lineage/ByteHashSignatureExtractor.java
@@ -1,22 +1,18 @@
 package stirling.software.saas.payg.lineage;
 
 import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
 import java.nio.file.Path;
-import java.security.DigestInputStream;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.util.HexFormat;
 import java.util.Set;
 
 import org.springframework.context.annotation.Profile;
 import org.springframework.stereotype.Component;
 
+import stirling.software.proprietary.billing.ContentHasher;
+
 /**
  * SHA-256 of the file's bytes. The simplest universally-applicable signature — works for every
- * content type, doesn't parse, doesn't allocate proportional to file size (fixed 64 KiB read
- * buffer), hardware-accelerated by the JVM on modern hardware (Intel SHA-NI, ARM SHA extensions).
+ * content type, doesn't parse. Delegates to the shared {@link ContentHasher} so the cloud charge
+ * path and a linked self-hosted instance's meter compute byte-identical signatures.
  *
  * <p>Always returns exactly one {@link LineageSignature} of type {@code "sha256"}. A future {@code
  * PdfMetadataSignatureExtractor} would be a separate bean and add its own signature type — composed
@@ -26,36 +22,15 @@ import org.springframework.stereotype.Component;
 @Profile("saas")
 public class ByteHashSignatureExtractor implements LineageSignatureExtractor {
 
-    private static final String ALGORITHM = "SHA-256";
     private static final String SIGNATURE_TYPE = "sha256";
-    private static final int BUFFER_SIZE = 64 * 1024;
 
     @Override
     public Set<LineageSignature> extract(Path file) throws IOException {
-        MessageDigest digest = newDigest();
-        try (InputStream raw = Files.newInputStream(file);
-                DigestInputStream in = new DigestInputStream(raw, digest)) {
-            byte[] buf = new byte[BUFFER_SIZE];
-            // Drain through the digest stream; we only care about side effects on the digest.
-            while (in.read(buf) != -1) {
-                // no-op
-            }
-        }
-        String hex = HexFormat.of().formatHex(digest.digest());
-        return Set.of(new LineageSignature(SIGNATURE_TYPE, hex));
+        return Set.of(new LineageSignature(SIGNATURE_TYPE, ContentHasher.sha256(file)));
     }
 
     @Override
     public String name() {
         return SIGNATURE_TYPE;
     }
-
-    private static MessageDigest newDigest() {
-        try {
-            return MessageDigest.getInstance(ALGORITHM);
-        } catch (NoSuchAlgorithmException e) {
-            // SHA-256 is mandated by every JDK; unreachable in practice.
-            throw new IllegalStateException(ALGORITHM + " unavailable — JDK is misconfigured", e);
-        }
-    }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/model/JobSource.java b/app/saas/src/main/java/stirling/software/saas/payg/model/JobSource.java
index 8f7d2b3df7..b023f08fb5 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/model/JobSource.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/model/JobSource.java
@@ -15,5 +15,12 @@ public enum JobSource {
     /**
      * The Tauri desktop client. Independent of whether it routes to SaaS or a self-hosted backend.
      */
-    DESKTOP_APP
+    DESKTOP_APP,
+    /**
+     * Usage reported by a linked self-hosted instance via the daily sync (combined-billing "Mode
+     * A"). The per-request surface is lost in the aggregate — the instance reports cumulative units
+     * per {@code BillingCategory} — so this just marks the charge as instance-synced. No per-source
+     * step limit is seeded for it; the charge path's fallback applies.
+     */
+    LINKED_INSTANCE
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/repository/PaygInstanceUsageRepository.java b/app/saas/src/main/java/stirling/software/saas/payg/repository/PaygInstanceUsageRepository.java
new file mode 100644
index 0000000000..283cc212b1
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/repository/PaygInstanceUsageRepository.java
@@ -0,0 +1,35 @@
+package stirling.software.saas.payg.repository;
+
+import java.time.LocalDateTime;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+import jakarta.persistence.LockModeType;
+
+import stirling.software.saas.payg.instance.PaygInstanceUsage;
+
+/** Last-seen cumulative usage per (team, period, category) for linked-instance daily syncs. */
+public interface PaygInstanceUsageRepository extends JpaRepository<PaygInstanceUsage, Long> {
+
+    Optional<PaygInstanceUsage> findByTeamIdAndPeriodStartAndCategory(
+            Long teamId, LocalDateTime periodStart, String category);
+
+    /**
+     * Pessimistic-write variant the ingest uses so two concurrent deliveries of the same sync (e.g.
+     * a proxy retry) can't both read the same baseline and double-charge the delta. Must run inside
+     * a transaction.
+     */
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
+    @Query(
+            "SELECT u FROM PaygInstanceUsage u"
+                    + " WHERE u.teamId = :teamId AND u.periodStart = :periodStart"
+                    + " AND u.category = :category")
+    Optional<PaygInstanceUsage> findByTeamIdAndPeriodStartAndCategoryForUpdate(
+            @Param("teamId") Long teamId,
+            @Param("periodStart") LocalDateTime periodStart,
+            @Param("category") String category);
+}
diff --git a/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql b/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
new file mode 100644
index 0000000000..7ab65b8b78
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
@@ -0,0 +1,35 @@
+-- Twin of supabase/migrations/<ts>_payg_instance_usage.sql (Stirling-PDF-SaaS). Keep the table
+-- definition byte-identical to the Supabase twin — both repos own this stirling_pdf table (the SaaS
+-- profile runs this Flyway migration against the Supabase-backed DB; non-Hibernate consumers — RLS,
+-- PostgREST, edge functions — rely on the Supabase migration ledger having the matching entry).
+--
+-- Per-(team, billing period, category) last-seen cumulative usage reported by a linked self-hosted
+-- instance (combined-billing "Mode A"). The instance reports monotonic cumulative unit totals on
+-- its daily sync; SaaS bills the DELTA since the last sync — idempotent (a resend bills nothing) and
+-- tamper-evident (a counter that drops is a signal) — by reusing the standard charge path
+-- (JobChargeService.chargeStandalone), so no separate billing logic exists for this flow.
+--
+-- Inert until release: written only by the InstanceController /sync endpoint, gated behind
+-- stirling.billing.account-link.enabled (default off). Additive, idempotent table.
+
+CREATE TABLE IF NOT EXISTS stirling_pdf.payg_instance_usage (
+    id                    BIGSERIAL    PRIMARY KEY,
+    team_id               BIGINT       NOT NULL REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
+    period_start          TIMESTAMP    NOT NULL,
+    category              VARCHAR(32)  NOT NULL,
+    -- Highest cumulative unit total seen for this (team, period, category); the next sync bills
+    -- (reported cumulative - this).
+    last_cumulative_units BIGINT       NOT NULL DEFAULT 0,
+    -- Highest sync sequence applied; a sync at or below this is a replay and is ignored.
+    last_sync_seq         BIGINT       NOT NULL DEFAULT 0,
+    updated_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT uk_payg_instance_usage UNIQUE (team_id, period_start, category)
+);
+
+CREATE INDEX IF NOT EXISTS idx_payg_instance_usage_team
+    ON stirling_pdf.payg_instance_usage (team_id);
+
+COMMENT ON TABLE stirling_pdf.payg_instance_usage IS
+    'Last-seen cumulative usage per (team, billing period, category) reported by linked self-hosted '
+    'instances (combined-billing Mode A). SaaS bills the delta vs last_cumulative_units via the '
+    'standard charge path; last_sync_seq dedups replays.';
diff --git a/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql b/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
new file mode 100644
index 0000000000..f79097e325
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
@@ -0,0 +1,19 @@
+-- Twin of supabase/migrations/<ts>_payg_shadow_charge_linked_instance_source.sql (Stirling-PDF-SaaS).
+-- Keep byte-identical to the Supabase twin.
+--
+-- Widen the payg_shadow_charge.job_source CHECK to allow LINKED_INSTANCE (combined-billing "Mode
+-- A"). A linked instance's daily-sync charge runs through JobChargeService.chargeStandalone, which
+-- writes a payg_shadow_charge row with job_source=LINKED_INSTANCE — a JobSource value added after
+-- the original constraint, so the insert was failing the check and 500ing POST /api/v1/instance/sync.
+--
+-- Idempotent (DROP IF EXISTS + ADD, so it survives being applied by both the Flyway and Supabase
+-- migration sets against the same schema) and additive (the new set is a superset of the JobSource
+-- enum; the app only ever writes enum values, so no existing row can violate it).
+
+ALTER TABLE stirling_pdf.payg_shadow_charge
+    DROP CONSTRAINT IF EXISTS payg_shadow_charge_job_source_check;
+
+ALTER TABLE stirling_pdf.payg_shadow_charge
+    ADD CONSTRAINT payg_shadow_charge_job_source_check
+        CHECK (job_source IS NULL
+               OR job_source IN ('WEB', 'API', 'PIPELINE', 'DESKTOP_APP', 'LINKED_INSTANCE'));
diff --git a/app/saas/src/test/java/stirling/software/saas/accountlink/InstanceControllerTest.java b/app/saas/src/test/java/stirling/software/saas/accountlink/InstanceControllerTest.java
index d221ac8603..4c9cc3b76a 100644
--- a/app/saas/src/test/java/stirling/software/saas/accountlink/InstanceControllerTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/accountlink/InstanceControllerTest.java
@@ -1,6 +1,7 @@
 package stirling.software.saas.accountlink;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
@@ -8,9 +9,12 @@ import static org.mockito.Mockito.when;
 import java.math.BigDecimal;
 import java.time.LocalDateTime;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.http.HttpStatus;
@@ -19,14 +23,19 @@ import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
+import stirling.software.proprietary.billing.UnitCalcPolicy;
 import stirling.software.saas.accountlink.InstanceController.EntitlementResponse;
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
 import stirling.software.saas.payg.entitlement.EntitlementService;
 import stirling.software.saas.payg.entitlement.EntitlementSnapshot;
+import stirling.software.saas.payg.instance.InstanceUsageIngestService;
+import stirling.software.saas.payg.model.BillingCategory;
 import stirling.software.saas.payg.model.EntitlementState;
 import stirling.software.saas.payg.model.FeatureGate;
 import stirling.software.saas.payg.model.FeatureSet;
+import stirling.software.saas.payg.policy.PricingPolicy;
+import stirling.software.saas.payg.policy.PricingPolicyService;
 
 /**
  * Pure-Mockito unit tests for {@link InstanceController} — the device-credential entitlement read.
@@ -39,9 +48,22 @@ class InstanceControllerTest {
     @Mock private EntitlementService entitlementService;
     @Mock private TeamBillingService billingService;
     @Mock private AccountLinkService accountLinkService;
+    @Mock private PricingPolicyService pricingPolicyService;
+    @Mock private InstanceUsageIngestService usageIngestService;
+    @Mock private LinkedInstanceRepository linkedInstanceRepository;
 
     private InstanceController controller() {
-        return new InstanceController(entitlementService, billingService, accountLinkService);
+        return new InstanceController(
+                entitlementService,
+                billingService,
+                accountLinkService,
+                pricingPolicyService,
+                usageIngestService,
+                linkedInstanceRepository);
+    }
+
+    private static PricingPolicy policy() {
+        return new PricingPolicy(1, 1_048_576L, 1, 1000);
     }
 
     @Test
@@ -50,6 +72,7 @@ class InstanceControllerTest {
         when(billingService.forTeam(42L)).thenReturn(subscribedBilling("sub_42", 120L));
         when(entitlementService.getSnapshot(42L))
                 .thenReturn(snapshot(EntitlementState.WARNED, 90L, 1250L));
+        when(pricingPolicyService.getEffectivePolicy(42L)).thenReturn(policy());
 
         ResponseEntity<EntitlementResponse> resp = controller().entitlement(token);
 
@@ -62,6 +85,13 @@ class InstanceControllerTest {
         assertThat(body.periodCapUnits()).isEqualTo(1250L);
         // WARNED is still within budget for the gate's purposes → coarse OK.
         assertThat(body.state()).isEqualTo("OK");
+        // Phase 2: the metering inputs the instance needs ride along.
+        assertThat(body.unitCalcPolicy()).isEqualTo(new UnitCalcPolicy(1, 1_048_576L, 1, 1000));
+        assertThat(body.periodStart()).isNotNull();
+        assertThat(body.periodEnd()).isNotNull();
+        // The instance-facing read drops the cached snapshot first so a just-subscribed team's
+        // plan surfaces on the next poll instead of waiting out the cache TTL.
+        verify(entitlementService).invalidate(42L);
     }
 
     @Test
@@ -70,6 +100,7 @@ class InstanceControllerTest {
         when(billingService.forTeam(7L)).thenReturn(freeBilling(500L));
         when(entitlementService.getSnapshot(7L))
                 .thenReturn(snapshot(EntitlementState.FULL, 0L, null));
+        when(pricingPolicyService.getEffectivePolicy(7L)).thenReturn(policy());
 
         ResponseEntity<EntitlementResponse> resp = controller().entitlement(token);
 
@@ -89,6 +120,7 @@ class InstanceControllerTest {
         when(billingService.forTeam(8L)).thenReturn(subscribedBilling("sub_8", 0L));
         when(entitlementService.getSnapshot(8L))
                 .thenReturn(snapshot(EntitlementState.DEGRADED, 1300L, 1250L));
+        when(pricingPolicyService.getEffectivePolicy(8L)).thenReturn(policy());
 
         EntitlementResponse body = controller().entitlement(token).getBody();
 
@@ -110,6 +142,59 @@ class InstanceControllerTest {
         verifyNoInteractions(entitlementService, billingService);
     }
 
+    @Test
+    void sync_ingestsCumulativePerCategoryAndReturnsFreshEntitlement() {
+        Authentication token = new LinkedInstanceAuthenticationToken(4L, 99L);
+        LinkedInstance li = new LinkedInstance();
+        li.setCreatedByUserId(7L);
+        LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+        when(linkedInstanceRepository.findById(4L)).thenReturn(Optional.of(li));
+        when(billingService.forTeam(99L)).thenReturn(freeBilling(10L));
+        // The reported periodStart is validated against the authoritative snapshot period.
+        when(entitlementService.getSnapshot(99L)).thenReturn(snapshotForPeriod(period, null));
+        when(pricingPolicyService.getEffectivePolicy(99L)).thenReturn(policy());
+
+        InstanceController.UsageSyncRequest req =
+                new InstanceController.UsageSyncRequest(
+                        3L,
+                        period,
+                        new InstanceController.UsageSyncRequest.CategoryUnits(12, 4, 8));
+
+        ResponseEntity<EntitlementResponse> resp = controller().sync(token, req);
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.OK);
+        @SuppressWarnings("unchecked")
+        ArgumentCaptor<Map<BillingCategory, Long>> cumulative = ArgumentCaptor.forClass(Map.class);
+        verify(usageIngestService)
+                .ingest(eq(99L), eq(7L), eq(3L), eq(period), cumulative.capture());
+        assertThat(cumulative.getValue())
+                .containsEntry(BillingCategory.API, 12L)
+                .containsEntry(BillingCategory.AI, 4L)
+                .containsEntry(BillingCategory.AUTOMATION, 8L);
+        // The sync drops the team's cached snapshot so the just-charged delta (and the free-grant
+        // balance it moved) show on the next wallet read instead of lagging out the 30s TTL.
+        verify(entitlementService).invalidate(99L);
+    }
+
+    @Test
+    void sync_rejectsImplausiblePeriodStart() {
+        Authentication token = new LinkedInstanceAuthenticationToken(4L, 99L);
+        LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+        when(entitlementService.getSnapshot(99L)).thenReturn(snapshotForPeriod(period, null));
+
+        // A fabricated far-future periodStart (would reset the dedup partition) → 400, no ingest.
+        InstanceController.UsageSyncRequest req =
+                new InstanceController.UsageSyncRequest(
+                        1L,
+                        period.plusYears(5),
+                        new InstanceController.UsageSyncRequest.CategoryUnits(99, 0, 0));
+
+        ResponseEntity<EntitlementResponse> resp = controller().sync(token, req);
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
+        verifyNoInteractions(usageIngestService);
+    }
+
     @Test
     void revokeSelf_callsServiceWithTokenIdentityAndReturns204() {
         Authentication token = new LinkedInstanceAuthenticationToken(11L, 22L);
@@ -187,4 +272,17 @@ class InstanceControllerTest {
                 start.plusMonths(1),
                 false);
     }
+
+    /** Snapshot with an explicit period — the sync tests need a deterministic period window. */
+    private static EntitlementSnapshot snapshotForPeriod(LocalDateTime start, Long cap) {
+        return new EntitlementSnapshot(
+                EntitlementState.FULL,
+                FeatureSet.FULL,
+                List.of(FeatureGate.OFFSITE_PROCESSING),
+                0L,
+                cap,
+                start,
+                start.plusMonths(1),
+                false);
+    }
 }
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java b/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
index 8433f5e5a3..6cc97d916b 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
@@ -432,6 +432,52 @@ class PaygWalletControllerTest {
         verifyNoInteractions(policyRepo, entitlementService);
     }
 
+    // -----------------------------------------------------------------------------------------
+    // POST /wallet/refresh
+    // -----------------------------------------------------------------------------------------
+
+    @Test
+    void refreshWallet_dropsCallerTeamCache() {
+        User user = userWithId(30L, UUID.randomUUID());
+        Team team = teamWithId(70L);
+        when(userRepository.findBySupabaseId(any())).thenReturn(Optional.of(user));
+        when(memberRepo.findPrimaryMembership(30L))
+                .thenReturn(List.of(membership(team, user, TeamRole.MEMBER)));
+
+        ResponseEntity<Void> resp = controller.refreshWallet(jwtAuth(user.getSupabaseId()));
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+        // Portal pokes this after checkout so the next /wallet read reflects the subscription
+        // immediately rather than after the cache TTL.
+        verify(entitlementService).invalidate(70L);
+    }
+
+    @Test
+    void refreshWallet_noTeam_isNoOpButOk() {
+        User user = userWithId(31L, UUID.randomUUID());
+        when(userRepository.findBySupabaseId(any())).thenReturn(Optional.of(user));
+        when(memberRepo.findPrimaryMembership(31L)).thenReturn(List.of());
+
+        ResponseEntity<Void> resp = controller.refreshWallet(jwtAuth(user.getSupabaseId()));
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+        verify(entitlementService, never()).invalidate(any());
+    }
+
+    @Test
+    void refreshWallet_anonymousIs401() {
+        Authentication anon =
+                new AnonymousAuthenticationToken(
+                        "k",
+                        "anonymousUser",
+                        List.of(new SimpleGrantedAuthority("ROLE_ANONYMOUS")));
+
+        ResponseEntity<Void> resp = controller.refreshWallet(anon);
+
+        assertThat(resp.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+        verifyNoInteractions(entitlementService);
+    }
+
     // -----------------------------------------------------------------------------------------
     // Fixtures
     // -----------------------------------------------------------------------------------------
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java b/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
index 8b3ce50b6a..e669e1b5bd 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
@@ -913,6 +913,52 @@ class JobChargeServiceTest {
                 .isInstanceOf(IllegalArgumentException.class);
     }
 
+    @Test
+    void chargeStandalone_floorsUnitsAtMinChargeUnits() {
+        // Pins the per-call minChargeUnits floor that the linked-instance sync path inherits: a
+        // daily delta below the floor bills the floor (max(delta, minChargeUnits)) — applied per
+        // sync-delta here, not per underlying op (documented divergence from the in-cloud per-op
+        // floor; can only under-bill vs per-op, never over).
+        long teamId = 100L;
+        PricingPolicy policy = stubPolicy(/*minCharge*/ 5, Map.of(JobSource.WEB, 10));
+        when(policyService.getEffectivePolicy(teamId)).thenReturn(policy);
+
+        UUID jobId = UUID.randomUUID();
+        when(jobService.open(any(JobContext.class), eq(5))).thenReturn(openJob(jobId));
+        when(jobService.close(jobId)).thenReturn(openJob(jobId));
+
+        PaygTeamExtensions ext = new PaygTeamExtensions();
+        ext.setTeamId(teamId);
+        ext.setStripeCustomerId("cus_x");
+        ext.setPaygSubscriptionId("sub_x");
+        ext.setFreeUnitsRemaining(0L);
+        when(teamExtRepo.findByIdForUpdate(teamId)).thenReturn(Optional.of(ext));
+        when(teamExtRepo.findById(teamId)).thenReturn(Optional.of(ext));
+        when(shadowRepo.findFirstByJobIdOrderByIdAsc(jobId))
+                .thenReturn(
+                        Optional.of(chargedShadowRow(jobId, teamId, 5, 0, BillingCategory.API)));
+
+        ChargeContext ctx =
+                new ChargeContext(
+                        7L, teamId, JobSource.WEB, ProcessType.SINGLE_TOOL, BillingCategory.API);
+        ArgumentCaptor<WalletLedgerEntry> ledger = ArgumentCaptor.forClass(WalletLedgerEntry.class);
+
+        withTransactionSynchronization(() -> service.chargeStandalone(ctx, 2));
+
+        // Delta of 2 floored to minChargeUnits=5: the job, ledger debit, and meter all use 5.
+        verify(jobService).open(any(JobContext.class), eq(5));
+        verify(ledgerRepo).save(ledger.capture());
+        assertThat(ledger.getValue().getAmountUnits()).isEqualTo(-5);
+        verify(meterReporter)
+                .recordUsage(
+                        eq(teamId),
+                        eq("cus_x"),
+                        eq(5),
+                        eq(BillingCategory.API),
+                        eq("process:" + jobId + ":close"),
+                        eq(jobId));
+    }
+
     private static void withTransactionSynchronization(Runnable body) {
         TransactionSynchronizationManager.initSynchronization();
         try {
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/instance/InstanceUsageIngestServiceTest.java b/app/saas/src/test/java/stirling/software/saas/payg/instance/InstanceUsageIngestServiceTest.java
new file mode 100644
index 0000000000..57c7b42c01
--- /dev/null
+++ b/app/saas/src/test/java/stirling/software/saas/payg/instance/InstanceUsageIngestServiceTest.java
@@ -0,0 +1,135 @@
+package stirling.software.saas.payg.instance;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.time.LocalDateTime;
+import java.util.Map;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.saas.payg.charge.ChargeContext;
+import stirling.software.saas.payg.charge.JobChargeService;
+import stirling.software.saas.payg.model.BillingCategory;
+import stirling.software.saas.payg.model.JobSource;
+import stirling.software.saas.payg.repository.PaygInstanceUsageRepository;
+
+@ExtendWith(MockitoExtension.class)
+class InstanceUsageIngestServiceTest {
+
+    @Mock private PaygInstanceUsageRepository repo;
+    @Mock private JobChargeService chargeService;
+
+    private InstanceUsageIngestService service;
+    private final LocalDateTime period = LocalDateTime.of(2026, 6, 1, 0, 0);
+
+    @BeforeEach
+    void setUp() {
+        service = new InstanceUsageIngestService(repo, chargeService);
+    }
+
+    @Test
+    void firstSyncChargesFullCumulativeAndSavesRow() {
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "AI"))
+                .thenReturn(Optional.empty());
+
+        service.ingest(1L, 7L, 1L, period, Map.of(BillingCategory.AI, 10L));
+
+        ArgumentCaptor<ChargeContext> ctx = ArgumentCaptor.forClass(ChargeContext.class);
+        verify(chargeService).chargeStandalone(ctx.capture(), eq(10));
+        assertThat(ctx.getValue().ownerTeamId()).isEqualTo(1L);
+        assertThat(ctx.getValue().ownerUserId()).isEqualTo(7L);
+        assertThat(ctx.getValue().billingCategory()).isEqualTo(BillingCategory.AI);
+        assertThat(ctx.getValue().source()).isEqualTo(JobSource.LINKED_INSTANCE);
+
+        ArgumentCaptor<PaygInstanceUsage> row = ArgumentCaptor.forClass(PaygInstanceUsage.class);
+        verify(repo).save(row.capture());
+        assertThat(row.getValue().getLastCumulativeUnits()).isEqualTo(10L);
+        assertThat(row.getValue().getLastSyncSeq()).isEqualTo(1L);
+    }
+
+    @Test
+    void secondSyncChargesOnlyDelta() {
+        PaygInstanceUsage existing = new PaygInstanceUsage(1L, period, "API", 10L, 1L);
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "API"))
+                .thenReturn(Optional.of(existing));
+
+        service.ingest(1L, 7L, 2L, period, Map.of(BillingCategory.API, 25L));
+
+        // One charge for the aggregated delta (15), not per underlying op — pins the per-delta
+        // model.
+        verify(chargeService).chargeStandalone(any(ChargeContext.class), eq(15));
+        verify(repo).save(existing);
+        assertThat(existing.getLastCumulativeUnits()).isEqualTo(25L);
+        assertThat(existing.getLastSyncSeq()).isEqualTo(2L);
+    }
+
+    @Test
+    void replayIsIgnored() {
+        PaygInstanceUsage existing = new PaygInstanceUsage(1L, period, "API", 25L, 2L);
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "API"))
+                .thenReturn(Optional.of(existing));
+
+        service.ingest(1L, 7L, 2L, period, Map.of(BillingCategory.API, 25L));
+
+        verify(chargeService, never()).chargeStandalone(any(), anyInt());
+        verify(repo, never()).save(any());
+    }
+
+    @Test
+    void regressionIsRefusedAndNotAdvanced() {
+        PaygInstanceUsage existing = new PaygInstanceUsage(1L, period, "API", 25L, 2L);
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "API"))
+                .thenReturn(Optional.of(existing));
+
+        service.ingest(1L, 7L, 3L, period, Map.of(BillingCategory.API, 5L));
+
+        verify(chargeService, never()).chargeStandalone(any(), anyInt());
+        verify(repo, never()).save(any());
+    }
+
+    @Test
+    void zeroDeltaAdvancesSeqWithoutCharging() {
+        PaygInstanceUsage existing = new PaygInstanceUsage(1L, period, "API", 25L, 2L);
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "API"))
+                .thenReturn(Optional.of(existing));
+
+        service.ingest(1L, 7L, 3L, period, Map.of(BillingCategory.API, 25L));
+
+        verify(chargeService, never()).chargeStandalone(any(), anyInt());
+        verify(repo).save(existing);
+        assertThat(existing.getLastSyncSeq()).isEqualTo(3L);
+    }
+
+    @Test
+    void billsAccruedDeltaWithoutConsultingCap() {
+        // Intent pin: the ingest has no cap input and always bills the accrued delta — cap
+        // enforcement is the request-time gate's job (the instance stops accruing at the cap), not
+        // this aggregate charge path's. A large valid delta is billed in full.
+        when(repo.findByTeamIdAndPeriodStartAndCategoryForUpdate(1L, period, "API"))
+                .thenReturn(Optional.empty());
+
+        service.ingest(1L, 7L, 1L, period, Map.of(BillingCategory.API, 5_000_000L));
+
+        verify(chargeService).chargeStandalone(any(ChargeContext.class), eq(5_000_000));
+    }
+
+    @Test
+    void nullActorSkipsEntirely() {
+        service.ingest(1L, null, 1L, period, Map.of(BillingCategory.AI, 10L));
+
+        verifyNoInteractions(repo, chargeService);
+    }
+}
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index d07d8379da..346ece1523 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6229,9 +6229,19 @@ noClientSecret = "Edge function returned no client_secret."
 subtitle = "Add a card to keep going past your free Editor-plan grant. Stripe handles the rest."
 title = "Turn on the Processor plan"
 
+[portal.billing.checkout.activationSlow]
+body = "Your payment succeeded, but activation is taking a little longer than usual. It'll switch on automatically - close this and it'll appear here shortly."
+close = "Close"
+title = "Almost there"
+
 [portal.billing.checkout.error]
 title = "Couldn't start checkout"
 
+[portal.billing.checkout.finalizing]
+body = "Your payment went through. We're switching on metered processing across your linked instances - this usually takes a few seconds."
+hint = "Please keep this window open."
+title = "Activating your Processor plan..."
+
 [portal.billing.checkout.notConfigured]
 bodyAfter = "in the portal env to enable in-app checkout."
 bodyBefore = "Set"
@@ -7746,10 +7756,6 @@ loadWallet = "Couldn't load wallet"
 openStripePortal = "Couldn't open Stripe portal"
 walletUnavailable = "Wallet unavailable: {{status}} {{statusText}}"
 
-[portal.usage.finalizing]
-body = "It can take a few seconds for your subscription to activate. This page updates automatically."
-title = "Finalizing your subscription…"
-
 [portal.usage.sessionExpired]
 action = "Sign in again"
 body = "Your Stirling account session has expired. Sign in again to view billing — your instance stays linked."
diff --git a/frontend/editor/src/portal/api/billing.ts b/frontend/editor/src/portal/api/billing.ts
index fbb8673a26..3e76ab2989 100644
--- a/frontend/editor/src/portal/api/billing.ts
+++ b/frontend/editor/src/portal/api/billing.ts
@@ -21,6 +21,18 @@ export async function fetchWallet(): Promise<Wallet> {
   return apiClient.saas.json<Wallet>("/api/v1/payg/wallet");
 }
 
+/**
+ * Force the SaaS to drop this team's cached wallet snapshot so the next
+ * {@link fetchWallet} reflects a just-changed billing state (e.g. a completed
+ * checkout) without waiting out the ~30s server-side cache. Best-effort — the
+ * caller polls regardless of whether this succeeds.
+ */
+export async function refreshWalletCache(): Promise<void> {
+  await apiClient.saas.json<void>("/api/v1/payg/wallet/refresh", {
+    method: "POST",
+  });
+}
+
 // ────────────────────────────────────────────────────────────────────────────
 // Cap — leader-only PATCH (real endpoint).
 // ────────────────────────────────────────────────────────────────────────────
diff --git a/frontend/editor/src/portal/api/link.test.ts b/frontend/editor/src/portal/api/link.test.ts
index 2f5260486a..e03d5bf25b 100644
--- a/frontend/editor/src/portal/api/link.test.ts
+++ b/frontend/editor/src/portal/api/link.test.ts
@@ -32,6 +32,7 @@ vi.stubEnv("VITE_SAAS_API_URL", "https://saas.test.local");
 
 import {
   fetchInstances,
+  fetchLocalUsage,
   fetchStatus,
   linkInstance,
   revokeInstance,
@@ -74,6 +75,16 @@ describe("api/link — local backend (this instance)", () => {
     expect((await fetchStatus()).linked).toBe(false);
   });
 
+  it("reads instance-local unsynced usage via the local endpoint", async () => {
+    const usage = await fetchLocalUsage();
+    expect(usage.totalUnsyncedUnits).toBe(
+      usage.apiUnsyncedUnits +
+        usage.aiUnsyncedUnits +
+        usage.automationUnsyncedUnits,
+    );
+    expect(usage.totalUnsyncedUnits).toBeGreaterThanOrEqual(0);
+  });
+
   it("forwards the SaaS JWT in the link body", async () => {
     let seenBody: unknown = null;
     server.events.on("request:start", async ({ request }) => {
diff --git a/frontend/editor/src/portal/api/link.ts b/frontend/editor/src/portal/api/link.ts
index c55978dffc..9b4876ac8d 100644
--- a/frontend/editor/src/portal/api/link.ts
+++ b/frontend/editor/src/portal/api/link.ts
@@ -3,12 +3,14 @@ import type {
   LinkInstanceRequest,
   LinkStatus,
   LinkedInstanceRow,
+  LocalUsage,
 } from "@portal/mocks/link";
 
 export type {
   LinkInstanceRequest,
   LinkStatus,
   LinkedInstanceRow,
+  LocalUsage,
 } from "@portal/mocks/link";
 
 /**
@@ -57,6 +59,15 @@ export async function fetchStatus(): Promise<LinkStatus> {
   return apiClient.local.json<LinkStatus>(`${BASE}/status`);
 }
 
+/**
+ * Locally-accrued usage not yet reported to SaaS — the portal adds this on top
+ * of the SaaS-synced spend so "current usage" includes work done since the last
+ * daily sync. Local-backend call; returns zeros when metering is off.
+ */
+export async function fetchLocalUsage(): Promise<LocalUsage> {
+  return apiClient.local.json<LocalUsage>(`${BASE}/usage`);
+}
+
 /**
  * Drop this instance's link. The local backend best-effort tells SaaS to
  * revoke before clearing the credential locally, then returns 204 — there's no
@@ -66,6 +77,17 @@ export async function unlinkInstance(): Promise<void> {
   await apiClient.local.json<void>(`${BASE}/unlink`, { method: "POST" });
 }
 
+/**
+ * Nudge the local backend to sync + refresh its cached entitlement now. Called
+ * right after a checkout completes so the instance's request-time gate reflects
+ * the new subscription immediately instead of waiting out its entitlement-cache
+ * TTL. Best-effort — the caller swallows failures (metering off → 409, or the
+ * local backend unreachable); the scheduled sync / TTL refresh is the backstop.
+ */
+export async function triggerLocalSync(): Promise<void> {
+  await apiClient.local.json<void>(`${BASE}/sync-now`, { method: "POST" });
+}
+
 /**
  * Every linked instance for the team — SaaS-direct call with the admin's
  * Supabase JWT (no longer takes an accessToken parameter; the saas client
diff --git a/frontend/editor/src/portal/billing/stripe.ts b/frontend/editor/src/portal/billing/stripe.ts
index 87fa82cf7b..91e0290d72 100644
--- a/frontend/editor/src/portal/billing/stripe.ts
+++ b/frontend/editor/src/portal/billing/stripe.ts
@@ -116,6 +116,11 @@ export async function createCheckoutSession(
     currency: req.currency ?? "usd",
     success_url: req.successUrl,
     cancel_url: req.cancelUrl,
+    // The portal drives an in-page onComplete handler (the checkout modal stays open to
+    // finalise activation + nudge the linked instance), so tell the edge function not to
+    // redirect on completion. A redirect would reload the page, skip that finalize step, and
+    // make Stripe ignore onComplete entirely (console warns "redirect_on_completion: always").
+    redirect_on_completion: "never",
     ...(req.billingOwnerEmail
       ? { billing_owner_email: req.billingOwnerEmail }
       : {}),
diff --git a/frontend/editor/src/portal/components/billing/FreePlanView.tsx b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
index 0a1ae5216a..7132e6dfa1 100644
--- a/frontend/editor/src/portal/components/billing/FreePlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
@@ -2,6 +2,7 @@ import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, StatusBadge } from "@app/ui";
 import type { Wallet } from "@portal/api/billing";
+import type { LocalUsage } from "@portal/api/link";
 import type { SaasCurrency } from "@portal/billing/stripe";
 import { WalletMeter } from "@portal/components/billing/WalletMeter";
 import { FreePdfEditorsCard } from "@portal/components/billing/FreePdfEditorsCard";
@@ -10,8 +11,14 @@ import { StripeCheckoutModal } from "@portal/components/billing/StripeCheckoutMo
 
 interface Props {
   wallet: Wallet;
-  /** Called after checkout completes so the parent refetches the wallet. */
-  onSubscribed?: () => void;
+  /** Instance-local usage not yet synced to SaaS; folded into the trial meter. */
+  unsynced?: LocalUsage | null;
+  /**
+   * Runs the post-checkout activation poll and resolves true once the wallet
+   * reads subscribed (false if it's lagging past the poll window). The checkout
+   * modal awaits this to stay open through activation.
+   */
+  onSubscribed?: () => Promise<boolean>;
 }
 
 function isSaasCurrency(c: string | null): c is SaasCurrency {
@@ -23,7 +30,7 @@ function isSaasCurrency(c: string | null): c is SaasCurrency {
  * editor fleet, the Processor trial meter (with the inline "Switch on the
  * Processor" CTA → embedded Stripe Checkout), and the Enterprise upsell.
  */
-export function FreePlanView({ wallet, onSubscribed }: Props) {
+export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
   const { t } = useTranslation();
   const [modalOpen, setModalOpen] = useState(false);
   const [missingTeam, setMissingTeam] = useState<string | null>(null);
@@ -86,7 +93,11 @@ export function FreePlanView({ wallet, onSubscribed }: Props) {
       <FreePdfEditorsCard />
 
       {/* Processor trial — meter with the inline upgrade CTA */}
-      <WalletMeter wallet={wallet} action={switchOnAction} />
+      <WalletMeter
+        wallet={wallet}
+        unsynced={unsynced}
+        action={switchOnAction}
+      />
 
       {missingTeam && (
         <Banner
@@ -117,10 +128,7 @@ export function FreePlanView({ wallet, onSubscribed }: Props) {
           onClose={() => setModalOpen(false)}
           teamId={wallet.teamId}
           currency={currency}
-          onComplete={() => {
-            setModalOpen(false);
-            onSubscribed?.();
-          }}
+          onComplete={() => onSubscribed?.() ?? Promise.resolve(false)}
         />
       )}
     </div>
diff --git a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
index eaf3172bec..6f4c46641c 100644
--- a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
+++ b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
@@ -14,6 +14,20 @@ type Story = StoryObj<typeof PdfsProcessedCard>;
 /** Metered PDFs split across API / Agents / Automation (real categoryBreakdown). */
 export const WithBreakdown: Story = { args: { wallet: subscribedWallet } };
 
+/** Synced usage plus instance-local work not yet billed — headline + split combine, with a pending note. */
+export const WithUnsynced: Story = {
+  args: {
+    wallet: subscribedWallet,
+    unsynced: {
+      periodStart: subscribedWallet.billingPeriodStart,
+      apiUnsyncedUnits: 12,
+      aiUnsyncedUnits: 3,
+      automationUnsyncedUnits: 0,
+      totalUnsyncedUnits: 15,
+    },
+  },
+};
+
 /** Nothing metered yet this period — the split hides. */
 export const Empty: Story = {
   args: {
diff --git a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
index aec101ea83..00d9806e6a 100644
--- a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
+++ b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
 import { Card } from "@app/ui";
 import type { Wallet, WalletCategoryBreakdown } from "@portal/api/billing";
+import type { LocalUsage } from "@portal/api/link";
 
 /**
  * "PDFs processed this period" headline + a stacked split of where the metered
@@ -8,6 +9,11 @@ import type { Wallet, WalletCategoryBreakdown } from "@portal/api/billing";
  * (API / Agents / Automation — the same buckets the entitlement service tracks;
  * the "AI" bucket surfaces as "Agents" here). Real data only: the bar hides when
  * nothing metered has run yet.
+ *
+ * <p>When a linked instance has accrued usage SaaS hasn't billed yet ({@code
+ * unsynced}), it's folded into the headline + split so "current usage" reflects
+ * work done since the last daily sync. The synced-vs-pending split is an internal
+ * detail the customer doesn't need, so it's not surfaced — just the combined total.
  */
 const SEGMENTS: ReadonlyArray<{
   key: keyof WalletCategoryBreakdown;
@@ -43,10 +49,25 @@ const SEGMENTS: ReadonlyArray<{
   },
 ];
 
-export function PdfsProcessedCard({ wallet }: { wallet: Wallet }) {
+export function PdfsProcessedCard({
+  wallet,
+  unsynced,
+}: {
+  wallet: Wallet;
+  unsynced?: LocalUsage | null;
+}) {
   const { t } = useTranslation();
-  const b = wallet.categoryBreakdown;
+  // Fold instance-local unsynced usage into both the headline and the split, so
+  // the card shows synced + not-yet-billed work as a single current-usage figure.
+  const pending = unsynced?.totalUnsyncedUnits ?? 0;
+  const base = wallet.categoryBreakdown;
+  const b: WalletCategoryBreakdown = {
+    api: base.api + (unsynced?.apiUnsyncedUnits ?? 0),
+    ai: base.ai + (unsynced?.aiUnsyncedUnits ?? 0),
+    automation: base.automation + (unsynced?.automationUnsyncedUnits ?? 0),
+  };
   const total = b.api + b.ai + b.automation;
+  const headline = wallet.billableUsed + pending;
 
   return (
     <Card padding="loose">
@@ -58,7 +79,7 @@ export function PdfsProcessedCard({ wallet }: { wallet: Wallet }) {
       </span>
       <div className="portal-billing__bignum-row">
         <span className="portal-billing__bignum">
-          {wallet.billableUsed.toLocaleString()}
+          {headline.toLocaleString()}
         </span>
         <span className="portal-billing__bignum-unit">
           {t("portal.billing.pdfsProcessed.unit", "metered PDFs")}
diff --git a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
index 313694baa9..2b8048ebcc 100644
--- a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
@@ -1,6 +1,6 @@
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Banner, Modal, Skeleton } from "@app/ui";
+import { Banner, Button, Modal, Skeleton, Spinner } from "@app/ui";
 import {
   EmbeddedCheckout,
   EmbeddedCheckoutProvider,
@@ -22,10 +22,14 @@ interface Props {
   /** Optional billing email prefill (Stripe locks the field when set). */
   billingOwnerEmail?: string;
   /**
-   * Fired when Stripe (or the mock continue button) signals success. Caller
-   * refreshes the wallet so the linked-subscribed view takes over.
+   * Fired when Stripe (or the mock continue button) signals payment success.
+   * Runs the caller's activation flow (poll the wallet until the subscription
+   * webhook lands) and resolves {@code true} once subscribed, {@code false} if
+   * it's taking longer than the poll window. The modal stays open and
+   * non-dismissable while this runs, so the admin watches activation through
+   * instead of the modal vanishing and needing a manual refresh.
    */
-  onComplete: () => void;
+  onComplete: () => Promise<boolean>;
 }
 
 /**
@@ -45,6 +49,55 @@ function loadStripeOnce(pk: string): Promise<Stripe | null> {
   return stripePromise;
 }
 
+/** Payment done, waiting for the subscription webhook to activate the plan. */
+function CheckoutFinalizing() {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-billing__checkout-finalizing" role="status">
+      <Spinner size="lg" />
+      <h3 className="portal-billing__checkout-status-title">
+        {t(
+          "portal.billing.checkout.finalizing.title",
+          "Activating your Processor plan...",
+        )}
+      </h3>
+      <p className="portal-billing__checkout-status-body">
+        {t(
+          "portal.billing.checkout.finalizing.body",
+          "Your payment went through. We're switching on metered processing across your linked instances - this usually takes a few seconds.",
+        )}
+      </p>
+      <p className="portal-billing__checkout-status-hint">
+        {t(
+          "portal.billing.checkout.finalizing.hint",
+          "Please keep this window open.",
+        )}
+      </p>
+    </div>
+  );
+}
+
+/** Webhook lagging past the poll window — dismissable "it'll appear shortly" notice. */
+function CheckoutActivationSlow({ onClose }: { onClose: () => void }) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-billing__checkout-finalizing" role="status">
+      <h3 className="portal-billing__checkout-status-title">
+        {t("portal.billing.checkout.activationSlow.title", "Almost there")}
+      </h3>
+      <p className="portal-billing__checkout-status-body">
+        {t(
+          "portal.billing.checkout.activationSlow.body",
+          "Your payment succeeded, but activation is taking a little longer than usual. It'll switch on automatically - close this and it'll appear here shortly.",
+        )}
+      </p>
+      <Button variant="outline" onClick={onClose}>
+        {t("portal.billing.checkout.activationSlow.close", "Close")}
+      </Button>
+    </div>
+  );
+}
+
 export function StripeCheckoutModal({
   open,
   onClose,
@@ -57,16 +110,29 @@ export function StripeCheckoutModal({
   const [clientSecret, setClientSecret] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
+  // "checkout" = Stripe form; "finalizing" = payment done, waiting for the plan to activate
+  // (non-dismissable); "activationSlow" = webhook lagging past the poll window (dismissable).
+  const [phase, setPhase] = useState<
+    "checkout" | "finalizing" | "activationSlow"
+  >("checkout");
+  const mounted = useRef(true);
+  useEffect(() => {
+    mounted.current = true;
+    return () => {
+      mounted.current = false;
+    };
+  }, []);
 
   const publishableKey = getStripePublishableKey();
 
   // Mint the checkout session whenever the modal opens for a fresh team/currency.
   useEffect(() => {
     if (!open) {
-      // Reset on close so re-opening fetches a fresh session.
+      // Reset on close so re-opening fetches a fresh session + starts at checkout.
       setClientSecret(null);
       setError(null);
       setLoading(true);
+      setPhase("checkout");
       return;
     }
     let cancelled = false;
@@ -115,57 +181,91 @@ export function StripeCheckoutModal({
   const stripe = publishableKey ? loadStripeOnce(publishableKey) : null;
   const canRender = Boolean(stripe && clientSecret);
 
+  // Payment succeeded — hold the modal open and run the caller's activation poll instead of
+  // closing. The parent swaps to the subscribed view on success (unmounting us); a lagging
+  // webhook drops us into the dismissable "almost there" state.
+  function handleStripeComplete() {
+    setPhase("finalizing");
+    onComplete()
+      .then((activated) => {
+        if (!activated && mounted.current) setPhase("activationSlow");
+      })
+      .catch(() => {
+        if (mounted.current) setPhase("activationSlow");
+      });
+  }
+
+  // Block dismissal while activation is in flight so a half-finished flow can't be abandoned;
+  // the X, backdrop, and Escape all route through this.
+  const dismissable = phase !== "finalizing";
+  const handleClose = () => {
+    if (dismissable) onClose();
+  };
+
   return (
     <Modal
       open={open}
-      onClose={onClose}
-      width="lg"
+      onClose={handleClose}
+      width="xl"
+      className="portal-billing__checkout-modal"
+      disableBackdropClose={!dismissable}
+      disableEscapeClose={!dismissable}
       title={t("portal.billing.checkout.title", "Turn on the Processor plan")}
       subtitle={t(
         "portal.billing.checkout.subtitle",
         "Add a card to keep going past your free Editor-plan grant. Stripe handles the rest.",
       )}
     >
-      {!publishableKey && (
-        <Banner
-          tone="neutral"
-          title={t(
-            "portal.billing.checkout.notConfigured.title",
-            "Stripe not configured",
-          )}
-        >
-          {t("portal.billing.checkout.notConfigured.bodyBefore", "Set")}{" "}
-          <code>VITE_STRIPE_PUBLISHABLE_KEY</code>{" "}
-          {t(
-            "portal.billing.checkout.notConfigured.bodyAfter",
-            "in the portal env to enable in-app checkout.",
-          )}
-        </Banner>
+      {phase === "finalizing" && <CheckoutFinalizing />}
+
+      {phase === "activationSlow" && (
+        <CheckoutActivationSlow onClose={onClose} />
       )}
-      {publishableKey && error && (
-        <Banner
-          tone="danger"
-          title={t(
-            "portal.billing.checkout.error.title",
-            "Couldn't start checkout",
+
+      {phase === "checkout" && (
+        <>
+          {!publishableKey && (
+            <Banner
+              tone="neutral"
+              title={t(
+                "portal.billing.checkout.notConfigured.title",
+                "Stripe not configured",
+              )}
+            >
+              {t("portal.billing.checkout.notConfigured.bodyBefore", "Set")}{" "}
+              <code>VITE_STRIPE_PUBLISHABLE_KEY</code>{" "}
+              {t(
+                "portal.billing.checkout.notConfigured.bodyAfter",
+                "in the portal env to enable in-app checkout.",
+              )}
+            </Banner>
           )}
-        >
-          {error}
-        </Banner>
-      )}
-      {publishableKey && loading && !error && (
-        <div className="portal-billing__skeleton" aria-hidden>
-          <Skeleton height="3rem" />
-          <Skeleton height="18rem" />
-        </div>
-      )}
-      {publishableKey && canRender && stripe && clientSecret && (
-        <EmbeddedCheckoutProvider
-          stripe={stripe}
-          options={{ clientSecret, onComplete }}
-        >
-          <EmbeddedCheckout />
-        </EmbeddedCheckoutProvider>
+          {publishableKey && error && (
+            <Banner
+              tone="danger"
+              title={t(
+                "portal.billing.checkout.error.title",
+                "Couldn't start checkout",
+              )}
+            >
+              {error}
+            </Banner>
+          )}
+          {publishableKey && loading && !error && (
+            <div className="portal-billing__skeleton" aria-hidden>
+              <Skeleton height="3rem" />
+              <Skeleton height="18rem" />
+            </div>
+          )}
+          {publishableKey && canRender && stripe && clientSecret && (
+            <EmbeddedCheckoutProvider
+              stripe={stripe}
+              options={{ clientSecret, onComplete: handleStripeComplete }}
+            >
+              <EmbeddedCheckout />
+            </EmbeddedCheckoutProvider>
+          )}
+        </>
       )}
     </Modal>
   );
diff --git a/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx b/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
index 37bf35a54a..4d92eecf77 100644
--- a/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { Banner, Button } from "@app/ui";
 import { meterState } from "@app/billing";
 import type { Wallet } from "@portal/api/billing";
+import type { LocalUsage } from "@portal/api/link";
 import { useStripePortal } from "@portal/hooks/useStripePortal";
 import { FreePdfEditorsCard } from "@portal/components/billing/FreePdfEditorsCard";
 import { PdfsProcessedCard } from "@portal/components/billing/PdfsProcessedCard";
@@ -13,6 +14,8 @@ import { InvoicesList } from "@portal/components/billing/InvoicesList";
 
 interface Props {
   wallet: Wallet;
+  /** Instance-local usage not yet synced to SaaS; folded into the PDFs-processed card. */
+  unsynced?: LocalUsage | null;
   onWalletChange?: () => void;
 }
 
@@ -30,7 +33,11 @@ interface Props {
  * page-header "Manage Payment" action and the payment card's "Update" button
  * deep-link there via {@link useStripePortal}.
  */
-export function SubscribedPlanView({ wallet, onWalletChange }: Props) {
+export function SubscribedPlanView({
+  wallet,
+  unsynced,
+  onWalletChange,
+}: Props) {
   const { t } = useTranslation();
   const [adjusting, setAdjusting] = useState(false);
   const portal = useStripePortal(wallet);
@@ -93,7 +100,7 @@ export function SubscribedPlanView({ wallet, onWalletChange }: Props) {
 
       <FreePdfEditorsCard />
 
-      <PdfsProcessedCard wallet={wallet} />
+      <PdfsProcessedCard wallet={wallet} unsynced={unsynced} />
 
       <div className="portal-billing__spend-row">
         <SpendThisMonthCard wallet={wallet} />
diff --git a/frontend/editor/src/portal/components/billing/WalletMeter.tsx b/frontend/editor/src/portal/components/billing/WalletMeter.tsx
index 1cb7f5794f..081f6b2a32 100644
--- a/frontend/editor/src/portal/components/billing/WalletMeter.tsx
+++ b/frontend/editor/src/portal/components/billing/WalletMeter.tsx
@@ -3,10 +3,13 @@ import { useTranslation } from "react-i18next";
 import { Card } from "@app/ui";
 import { formatMinor, MeterBar, meterState } from "@app/billing";
 import type { Wallet } from "@portal/api/billing";
+import type { LocalUsage } from "@portal/api/link";
 
 interface Props {
   /** A linked-free wallet. */
   wallet: Wallet;
+  /** Instance-local usage not yet synced to SaaS; folded into "used" so the trial meter reflects work since the last sync. */
+  unsynced?: LocalUsage | null;
   /** Optional top-right action (e.g. "Switch on the Processor"). */
   action?: ReactNode;
 }
@@ -16,10 +19,18 @@ interface Props {
  * grant. Uses the shared {@link MeterBar} (same `paygf-meter` structure as the
  * cloud plan page). The subscribed spend-vs-cap meter is a separate surface
  * ({@code SpendLimitCard}); this card is only the free face.
+ *
+ * <p>Locally-accrued usage SaaS hasn't billed yet ({@code unsynced}) is folded
+ * into the used figure + remaining count so the trial depletes in step with the
+ * gate — which now also blocks against the pending local delta — instead of only
+ * moving after a daily sync.
  */
-export function WalletMeter({ wallet, action }: Props) {
+export function WalletMeter({ wallet, unsynced, action }: Props) {
   const { t } = useTranslation();
-  const { state, pct } = meterState(wallet.billableUsed, wallet.freeAllowance);
+  const pending = unsynced?.totalUnsyncedUnits ?? 0;
+  const used = wallet.billableUsed + pending;
+  const remaining = Math.max(0, wallet.freeRemaining - pending);
+  const { state, pct } = meterState(used, wallet.freeAllowance);
   const rate =
     wallet.pricePerDocMinor != null && wallet.pricePerDocMinor > 0
       ? wallet.pricePerDocMinor
@@ -65,7 +76,7 @@ export function WalletMeter({ wallet, action }: Props) {
         <MeterBar
           state={state}
           pct={pct}
-          figure={wallet.billableUsed.toLocaleString()}
+          figure={used.toLocaleString()}
           capSuffix={t(
             "portal.billing.walletMeter.capSuffix",
             "of {{allowance}} free PDFs used",
@@ -78,8 +89,8 @@ export function WalletMeter({ wallet, action }: Props) {
             "portal.billing.walletMeter.statusLabel",
             "{{remaining}} left",
             {
-              count: wallet.freeRemaining,
-              remaining: wallet.freeRemaining.toLocaleString(),
+              count: remaining,
+              remaining: remaining.toLocaleString(),
             },
           )}
         />
diff --git a/frontend/editor/src/portal/components/billing/billing.css b/frontend/editor/src/portal/components/billing/billing.css
index ee1f593833..63ea82d748 100644
--- a/frontend/editor/src/portal/components/billing/billing.css
+++ b/frontend/editor/src/portal/components/billing/billing.css
@@ -122,6 +122,47 @@
   gap: 0.75rem;
 }
 
+/* Widen the checkout modal past the ~1000px iframe threshold where Stripe
+   Embedded Checkout flips from its single-column ("mobile") layout to the
+   two-column desktop one — matching the SaaS Plan page's UpgradeModal (1100px
+   cap → ~1056px iframe). Two-class selector so it beats .sui-modal--xl's
+   max-width regardless of stylesheet order. width:100% still shrinks it on
+   narrow viewports, where Stripe falls back to single column on its own. */
+.sui-modal.portal-billing__checkout-modal {
+  max-width: 1100px;
+}
+
+/* Post-checkout activation state, shown inside the checkout modal while the
+   subscription webhook lands (and the "almost there" fallback if it lags). */
+.portal-billing__checkout-finalizing {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  text-align: center;
+  gap: 0.75rem;
+  padding: 2.5rem 1.5rem;
+}
+
+.portal-billing__checkout-status-title {
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  margin: 0.25rem 0 0;
+}
+
+.portal-billing__checkout-status-body {
+  font-size: 0.9375rem;
+  color: var(--color-text-2);
+  margin: 0;
+  max-width: 32rem;
+}
+
+.portal-billing__checkout-status-hint {
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+  margin: 0;
+}
+
 .portal-billing__error {
   color: var(--color-red, #b91c1c);
   font-size: 0.875rem;
diff --git a/frontend/editor/src/portal/mocks/handlers/link.ts b/frontend/editor/src/portal/mocks/handlers/link.ts
index 2be110a794..6ac6781f71 100644
--- a/frontend/editor/src/portal/mocks/handlers/link.ts
+++ b/frontend/editor/src/portal/mocks/handlers/link.ts
@@ -1,6 +1,7 @@
 import { http, HttpResponse, delay } from "msw";
 import {
   getLocalStatus,
+  getLocalUsage,
   linkLocal,
   listInstances,
   revokeInstance,
@@ -37,6 +38,11 @@ export const linkHandlers = [
     return HttpResponse.json(linkLocal(name), { status: 201 });
   }),
 
+  http.get("/api/v1/account-link/usage", async () => {
+    await delay(120);
+    return HttpResponse.json(getLocalUsage());
+  }),
+
   http.post("/api/v1/account-link/unlink", async () => {
     await delay(120);
     // Clear local link state, then 204 (no body) to match the real backend.
@@ -44,6 +50,14 @@ export const linkHandlers = [
     return new HttpResponse(null, { status: 204 });
   }),
 
+  // Manual sync trigger — the real backend runs a sync + entitlement refresh and
+  // returns 204 (or 409 when metering is off). The portal fires it best-effort
+  // after a checkout completes; the mock just acknowledges.
+  http.post("/api/v1/account-link/sync-now", async () => {
+    await delay(120);
+    return new HttpResponse(null, { status: 204 });
+  }),
+
   // Team-wide list/revoke are SaaS-direct now (apiClient.saas calls the
   // absolute VITE_SAAS_API_URL). Wildcard so the same handlers intercept both
   // the relative pattern (legacy / direct-MSW usage) and any absolute SaaS
diff --git a/frontend/editor/src/portal/mocks/link.ts b/frontend/editor/src/portal/mocks/link.ts
index f540f85177..0dd11e104c 100644
--- a/frontend/editor/src/portal/mocks/link.ts
+++ b/frontend/editor/src/portal/mocks/link.ts
@@ -36,6 +36,21 @@ export interface LinkStatus {
   name: string | null;
 }
 
+/**
+ * Locally-accrued usage not yet reported to SaaS (GET /api/v1/account-link/usage).
+ * The portal adds this on top of the SaaS-synced spend so "current usage"
+ * includes work done since the last daily sync. Per-category unsynced units for
+ * the current period; all zero when metering is off or nothing is pending.
+ */
+export interface LocalUsage {
+  /** ISO timestamp of the current period start; null when unknown (not yet synced). */
+  periodStart: string | null;
+  apiUnsyncedUnits: number;
+  aiUnsyncedUnits: number;
+  automationUnsyncedUnits: number;
+  totalUnsyncedUnits: number;
+}
+
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  SaaS backend — team-wide instance management                             */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -85,15 +100,34 @@ function seedInstances(): LinkedInstanceRow[] {
   ];
 }
 
+function seedLocalUsage(): LocalUsage {
+  // A little unsynced usage so the portal's "+ pending sync" combine is visible
+  // in dev/Storybook.
+  return {
+    periodStart: daysAgo(6),
+    apiUnsyncedUnits: 12,
+    aiUnsyncedUnits: 3,
+    automationUnsyncedUnits: 0,
+    totalUnsyncedUnits: 15,
+  };
+}
+
 let store: LinkedInstanceRow[] = seedInstances();
 let nextId = 1004;
 let localStatus: LinkStatus = { linked: false, name: null };
+let localUsage: LocalUsage = seedLocalUsage();
 
 /** Resets the mock store + local link status to seed state (Storybook / tests). */
 export function resetLinkStore(): void {
   store = seedInstances();
   nextId = 1004;
   localStatus = { linked: false, name: null };
+  localUsage = seedLocalUsage();
+}
+
+/** Current instance-local unsynced usage (GET /api/v1/account-link/usage). */
+export function getLocalUsage(): LocalUsage {
+  return { ...localUsage };
 }
 
 /** Current local link status for this instance. */
diff --git a/frontend/editor/src/portal/views/Usage.tsx b/frontend/editor/src/portal/views/Usage.tsx
index 3a0229a886..d1f6ede78a 100644
--- a/frontend/editor/src/portal/views/Usage.tsx
+++ b/frontend/editor/src/portal/views/Usage.tsx
@@ -3,7 +3,16 @@ import { useTranslation } from "react-i18next";
 import { Banner, Button, Skeleton } from "@app/ui";
 import { useLink } from "@portal/contexts/LinkContext";
 import { useUI } from "@portal/contexts/UIContext";
-import { fetchWallet, type Wallet } from "@portal/api/billing";
+import {
+  fetchWallet,
+  refreshWalletCache,
+  type Wallet,
+} from "@portal/api/billing";
+import {
+  fetchLocalUsage,
+  triggerLocalSync,
+  type LocalUsage,
+} from "@portal/api/link";
 import { useStripePortal } from "@portal/hooks/useStripePortal";
 import { LinkAccountPrompt } from "@portal/components/billing/LinkAccountPrompt";
 import { FreePlanView } from "@portal/components/billing/FreePlanView";
@@ -35,14 +44,14 @@ export function Usage() {
   const { isLinked, setLinkState, saasSessionNonce } = useLink();
   const { openLinkModal } = useUI();
   const [wallet, setWallet] = useState<Wallet | null>(null);
+  // Locally-accrued usage SaaS hasn't billed yet; added to the synced figure so
+  // "current usage" reflects work since the last daily sync. Best-effort.
+  const [localUsage, setLocalUsage] = useState<LocalUsage | null>(null);
   const [loading, setLoading] = useState<boolean>(isLinked);
   const [error, setError] = useState<string | null>(null);
   // The instance is linked but the browser's SaaS session has lapsed — needs a
   // re-sign-in, NOT a re-link.
   const [needsReauth, setNeedsReauth] = useState(false);
-  // Briefly polling the wallet after a successful checkout until the webhook flips
-  // it to subscribed.
-  const [finalizing, setFinalizing] = useState(false);
   const [refreshKey, setRefreshKey] = useState(0);
   // Stripe customer portal — the subscribed header's "Manage Payment" action.
   const portal = useStripePortal(wallet);
@@ -60,6 +69,7 @@ export function Usage() {
     // link prompt; no SaaS call needed.
     if (!isLinked) {
       setWallet(null);
+      setLocalUsage(null);
       setLoading(false);
       setError(null);
       setNeedsReauth(false);
@@ -69,6 +79,15 @@ export function Usage() {
     setLoading(true);
     setError(null);
     setNeedsReauth(false);
+    // Independent of the wallet load — a local-usage failure must not break the
+    // page; it just means no unsynced delta is shown.
+    fetchLocalUsage()
+      .then((u) => {
+        if (!cancelled) setLocalUsage(u);
+      })
+      .catch(() => {
+        if (!cancelled) setLocalUsage(null);
+      });
     fetchWallet()
       .then((w) => {
         if (cancelled) return;
@@ -112,31 +131,37 @@ export function Usage() {
 
   const refresh = useCallback(() => setRefreshKey((k) => k + 1), []);
 
-  const confirmSubscription = useCallback(async () => {
+  const confirmSubscription = useCallback(async (): Promise<boolean> => {
     // Stripe's onComplete fires before the subscription webhook lands, so poll the
-    // wallet briefly until it flips to subscribed rather than dropping the
-    // just-paid admin back on the free CTA.
-    setFinalizing(true);
-    for (let i = 0; i < 10; i++) {
+    // wallet until it flips to subscribed. Drop the server cache before each read
+    // so we see the webhook the moment it lands rather than after the ~30s TTL.
+    // ~60s of attempts — longer than the observed webhook + sync-engine latency —
+    // so a slightly slow activation still completes inside the (open) checkout
+    // modal instead of falling back to a manual refresh. Resolves true once
+    // subscribed so the modal can close itself in.
+    for (let i = 0; i < 30; i++) {
       try {
+        await refreshWalletCache().catch(() => {});
         const w = await fetchWallet();
-        if (!mounted.current) return;
+        if (!mounted.current) return false;
         if (w.status === "subscribed") {
           setWallet(w);
           setLinkState("linked-subscribed");
-          setFinalizing(false);
-          return;
+          // Nudge the local instance to refresh its gate now so billable work
+          // unblocks immediately rather than on its next poll. Fire-and-forget.
+          triggerLocalSync().catch(() => {});
+          return true;
         }
       } catch {
         // Transient read failure — keep polling.
       }
       await new Promise((r) => setTimeout(r, 2000));
-      if (!mounted.current) return;
+      if (!mounted.current) return false;
     }
-    // Webhook still hasn't landed after ~20s: stop blocking and refresh. The page
-    // self-heals on the next load once provisioning completes.
-    setFinalizing(false);
+    // Webhook still hasn't landed: re-fetch once more and report back so the modal
+    // shows its "almost there" notice rather than the page silently self-healing.
     setRefreshKey((k) => k + 1);
+    return false;
   }, [setLinkState]);
 
   return (
@@ -177,21 +202,6 @@ export function Usage() {
           </div>
         )}
 
-        {isLinked && finalizing && (
-          <Banner
-            tone="info"
-            title={t(
-              "portal.usage.finalizing.title",
-              "Finalizing your subscription…",
-            )}
-          >
-            {t(
-              "portal.usage.finalizing.body",
-              "It can take a few seconds for your subscription to activate. This page updates automatically.",
-            )}
-          </Banner>
-        )}
-
         {isLinked && needsReauth && (
           <Banner
             tone="warning"
@@ -230,12 +240,20 @@ export function Usage() {
           </Banner>
         )}
 
-        {isLinked && !finalizing && wallet && wallet.status === "free" && (
-          <FreePlanView wallet={wallet} onSubscribed={confirmSubscription} />
+        {isLinked && wallet && wallet.status === "free" && (
+          <FreePlanView
+            wallet={wallet}
+            unsynced={localUsage}
+            onSubscribed={confirmSubscription}
+          />
         )}
 
         {isLinked && wallet && wallet.status === "subscribed" && (
-          <SubscribedPlanView wallet={wallet} onWalletChange={refresh} />
+          <SubscribedPlanView
+            wallet={wallet}
+            unsynced={localUsage}
+            onWalletChange={refresh}
+          />
         )}
       </div>
     </div>

From 355d7364873ed9cb30ea2d1ff777d3babe2e7a93 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 6 Jul 2026 14:26:10 +0100
Subject: [PATCH 07/35] Skip enterprise tests for forks since they can't run
 without secrets (#6888)

# Description of Changes
OSS contributions which trigger the enterprise e2e tests will always
fail due to missing secrets (see
https://github.com/Stirling-Tools/Stirling-PDF/actions/runs/28776342146/job/85337748018?pr=6045).
This PR disables them for OSS PRs.
---
 .github/workflows/build-enterprise.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index 2db275284b..99b3b127a4 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -2,7 +2,7 @@ name: Enterprise E2E (Playwright)
 
 # Enterprise Playwright suite — exercises premium-key gated features (audit,
 # teams, analytics) plus full OAuth + SAML logins via the Keycloak compose
-# stacks under testing/compose. Slow and secret-gated, so it runs in three
+# stacks under testing/compose. Slow and secret-gated, so it runs in four
 # situations:
 #
 #   - PRs that touch proprietary / premium / SSO compose / enterprise tests
@@ -12,8 +12,6 @@ name: Enterprise E2E (Playwright)
 #   - on a nightly cron schedule (catches Keycloak image drift, license
 #     expiry, upstream proprietary changes),
 #   - manual workflow_dispatch.
-#
-# Auto-skipped when secrets.PREMIUM_KEY_ENTERPRISE is missing (forks, dependabot).
 
 on:
   workflow_call:
@@ -52,6 +50,10 @@ jobs:
 
   playwright-e2e-enterprise:
     needs: pick
+    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE
+    # (nor DEPOT_TOKEN), so the suite can't boot premium and would fail. See the
+    # header comment. GitHub reports the skipped reusable workflow as success.
+    if: needs.pick.outputs.is_fork != 'true'
     runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
     timeout-minutes: 45
     env:

From 16cfbc170e8351bc5879589f0f8a37babdfad90e Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <3691490+PeterDaveHello@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:07:06 +0800
Subject: [PATCH 08/35] Clean up typos in docs, comments, and UI copy (#6045)

# Description of Changes

Fix wording, numbering, path references, and minor grammar issues across
project guides, backend comments, and frontend strings.

This keeps documentation and user-facing text consistent without
changing application behavior.

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

Co-authored-by: James Brunton <jbrunton96@gmail.com>
---
 DeveloperGuide.md                                           | 6 +++---
 README.md                                                   | 4 ++--
 .../stirling/software/common/configuration/AppConfig.java   | 2 +-
 app/proprietary/src/main/resources/templates/AUDIT_USAGE.md | 2 +-
 devGuide/STYLELINT.md                                       | 4 ++--
 docs/type3_fallback_plan.md                                 | 2 +-
 .../editor/src/core/services/googleDrivePickerService.ts    | 2 +-
 frontend/editor/src/core/tests/test-fixtures/README.md      | 2 +-
 .../editor/src/proprietary/constants/staticStripeLinks.ts   | 2 +-
 testing/cucumber/exampleFiles/example.md                    | 2 +-
 10 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/DeveloperGuide.md b/DeveloperGuide.md
index 23b2652ce1..fbbf6478ac 100644
--- a/DeveloperGuide.md
+++ b/DeveloperGuide.md
@@ -92,7 +92,7 @@ Visit the [Lombok website](https://projectlombok.org/setup/) for installation in
 
 5. Add environment variable
 For local testing, you should generally be testing the full 'Security' version of Stirling PDF. To do this, you must add the environment flag DISABLE_ADDITIONAL_FEATURES=false to your system and/or IDE build/run step.
-5. **Frontend Setup (Required for Stirling 2.0)**
+6. **Frontend Setup (Required for Stirling 2.0)**
    Navigate to the frontend directory and install dependencies using npm.
 
 ### Verify Setup
@@ -275,7 +275,7 @@ Stirling-PDF uses different Docker images for various configurations. The build
 1. Set the security environment variable:
 
    ```bash
-   export DISABLE_ADDITIONAL_FEATURES=true  # or false for to enable login and security features for builds
+   export DISABLE_ADDITIONAL_FEATURES=true  # or false to enable login and security features for builds
    ```
 
 2. Build the project:
@@ -305,7 +305,7 @@ Stirling-PDF uses different Docker images for various configurations. The build
    docker build --no-cache --pull --build-arg VERSION_TAG=alpha -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .
    ```
 
-Note: The `--no-cache` and `--pull` flags ensure that the build process uses the latest base images and doesn't use cached layers, which is useful for testing and ensuring reproducible builds. however to improve build times these can often be removed depending on your usecase
+Note: The `--no-cache` and `--pull` flags ensure that the build process uses the latest base images and doesn't use cached layers, which is useful for testing and ensuring reproducible builds. However, to improve build times these can often be removed depending on your use case
 
 ## 7. Testing
 
diff --git a/README.md b/README.md
index c1d96eca1d..c6777f1032 100644
--- a/README.md
+++ b/README.md
@@ -53,8 +53,8 @@ For full installation options (including desktop and Kubernetes), see our [Docum
 
 ## Support
 
-- **Community** [Discord](https://discord.gg/HYmhKj45pU)
-- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+- **Community**: [Discord](https://discord.gg/HYmhKj45pU)
+- **Bug Reports**: [GitHub Issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
 
 ## Contributing
 
diff --git a/app/common/src/main/java/stirling/software/common/configuration/AppConfig.java b/app/common/src/main/java/stirling/software/common/configuration/AppConfig.java
index ba896b4e34..40c1c98f23 100644
--- a/app/common/src/main/java/stirling/software/common/configuration/AppConfig.java
+++ b/app/common/src/main/java/stirling/software/common/configuration/AppConfig.java
@@ -132,7 +132,7 @@ public class AppConfig {
             return true;
         }
         Path mountInfo = Path.of("/proc/1/mountinfo");
-        // this should always exist, if not some unknown usecase
+        // this should always exist, if not some unknown use case
         if (!Files.exists(mountInfo)) {
             return true;
         }
diff --git a/app/proprietary/src/main/resources/templates/AUDIT_USAGE.md b/app/proprietary/src/main/resources/templates/AUDIT_USAGE.md
index 57cdce61b5..58702d3524 100644
--- a/app/proprietary/src/main/resources/templates/AUDIT_USAGE.md
+++ b/app/proprietary/src/main/resources/templates/AUDIT_USAGE.md
@@ -223,7 +223,7 @@ Use consistent event types throughout the application:
 - `FILE_DOWNLOAD` - When a file is downloaded
 - `PDF_PROCESS` - When a PDF is processed (split, merged, etc.)
 - `USER_CREATE` - When a user is created
-- `USER_UPDATE` - When a user details are updated
+- `USER_UPDATE` - When a user's details are updated
 - `PASSWORD_CHANGE` - When a password is changed
 - `PERMISSION_CHANGE` - When permissions are modified
 - `SETTINGS_CHANGE` - When system settings are changed
diff --git a/devGuide/STYLELINT.md b/devGuide/STYLELINT.md
index 04ddc407a1..0e279e1915 100644
--- a/devGuide/STYLELINT.md
+++ b/devGuide/STYLELINT.md
@@ -17,8 +17,8 @@ Apply Stylelint to your project's CSS with the following steps:
      ```jsonc
      {
        "scripts": {
-          "lint:css:check": "stylelint \"../app/core/src/main/**/*.css\" \"../app/proprietary/src/main/resources/static/css/*.css\" --config ../.stylelintrc.json",
-          "lint:css:fix": "stylelint \"../app/core//src/main/**/*.css\" \"../app/proprietary/src/main/resources/static/css/*.css\" --config .stylelintrc.json --fix"
+          "lint:css:check": "stylelint \"../app/core/src/main/**/*.css\" \"../app/proprietary/src/main/resources/static/css/*.css\" --config .stylelintrc.json",
+          "lint:css:fix": "stylelint \"../app/core/src/main/**/*.css\" \"../app/proprietary/src/main/resources/static/css/*.css\" --config .stylelintrc.json --fix"
        }
      }
      ```
diff --git a/docs/type3_fallback_plan.md b/docs/type3_fallback_plan.md
index 3ef7e6ad2a..f49514585a 100644
--- a/docs/type3_fallback_plan.md
+++ b/docs/type3_fallback_plan.md
@@ -132,7 +132,7 @@ Feel free to expand this plan or add notes as the work progresses.
 
 | Stage | Tool / Command | Output |
 | --- | --- | --- |
-| 1. Collect PDFs | `python scripts/download_pdf_collection.py --output scripts/pdf-collection` (or drop your own PDFs anywhere) | Raw PDFs ready for harvesting |
+| 1. Collect PDFs | `python scripts/download_pdf_samples.py --output-dir scripts/pdf-collection` (or drop your own PDFs anywhere) | Raw PDFs ready for harvesting |
 | 2. Harvest signatures | `python scripts/harvest_type3_fonts.py --input scripts/pdf-collection --pretty` | Per-PDF dumps in `docs/type3/signatures/…` + global summary `docs/type3/harvest_report.json` |
 | 3. Summarize backlog | `python scripts/summarize_type3_signatures.py` | `docs/type3/signature_inventory.md` (human checklist of aliases/signatures) |
 | 4. Convert fonts | Either copy the upstream TTF/OTF for the font (DejaVu, CM, STIX, etc.) or run `scripts/type3_to_cff.py` against the harvested glyph JSON to synthesize one offline; store the result under `app/core/src/main/resources/type3/library/fonts/<family>/`. | Canonical font binaries |
diff --git a/frontend/editor/src/core/services/googleDrivePickerService.ts b/frontend/editor/src/core/services/googleDrivePickerService.ts
index ac4dbd116d..9d91ffdeac 100644
--- a/frontend/editor/src/core/services/googleDrivePickerService.ts
+++ b/frontend/editor/src/core/services/googleDrivePickerService.ts
@@ -155,7 +155,7 @@ class GoogleDrivePickerService {
           return;
         }
         if (response.access_token == null) {
-          reject(new Error("No acces token in response"));
+          reject(new Error("No access token in response"));
         }
 
         this.accessToken = response.access_token;
diff --git a/frontend/editor/src/core/tests/test-fixtures/README.md b/frontend/editor/src/core/tests/test-fixtures/README.md
index 32e64b3469..079bd401d0 100644
--- a/frontend/editor/src/core/tests/test-fixtures/README.md
+++ b/frontend/editor/src/core/tests/test-fixtures/README.md
@@ -93,7 +93,7 @@ To run the full test suite, please add the following test files to this director
 ## Test File Structure
 
 ```
-frontend/src/tests/test-fixtures/
+frontend/editor/src/core/tests/test-fixtures/
 ├── README.md (this file)
 ├── sample.pdf
 ├── sample.docx
diff --git a/frontend/editor/src/proprietary/constants/staticStripeLinks.ts b/frontend/editor/src/proprietary/constants/staticStripeLinks.ts
index 6b78a09fd5..bb38aa218b 100644
--- a/frontend/editor/src/proprietary/constants/staticStripeLinks.ts
+++ b/frontend/editor/src/proprietary/constants/staticStripeLinks.ts
@@ -17,7 +17,7 @@ export interface StaticStripeLinks {
   };
   billingPortal: string;
 }
-// PRODCUTION LINKS FOR LIVE SERVER
+// PRODUCTION LINKS FOR LIVE SERVER
 export const STATIC_STRIPE_LINKS: StaticStripeLinks = {
   server: {
     monthly: "https://buy.stripe.com/fZu4gB8Nv6ysfAj0ts8Zq03",
diff --git a/testing/cucumber/exampleFiles/example.md b/testing/cucumber/exampleFiles/example.md
index 10bb117bad..6e51c608f3 100644
--- a/testing/cucumber/exampleFiles/example.md
+++ b/testing/cucumber/exampleFiles/example.md
@@ -11,6 +11,6 @@ text2
 
 ### **Page Operations**
 
-- View and modify PDFs - View multi page PDFs with custom viewing sorting and searching. Plus on page edit features like annotate, draw and adding text and images. (Using PDF.js with Joxit and Liberation.Liberation fonts)
+- View and modify PDFs - View multi page PDFs with custom viewing sorting and searching. Plus on page edit features like annotate, draw and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
 - Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages.
 - Merge multiple PDFs together into a single resultant file.
\ No newline at end of file

From f881828cd8135bbe8ad303a95d4dae84b906b2d8 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 6 Jul 2026 22:37:21 +0100
Subject: [PATCH 09/35] Fix intermittently failing Playwright tests (#6886)

# Description of Changes
Fixes intermittently failing tests (and replaces one that wasn't useful
in its previous state) and also adds a CI check to warn if there are any
Playwright tests which failed on their first go and succeeded on
retries, to hopefully help find intermittently failing tests more
quickly and avoid them being merged in the first place.
---
 .github/workflows/build-enterprise.yml        |  19 +++
 .github/workflows/e2e-live.yml                |  10 ++
 .github/workflows/e2e-stubbed.yml             |  11 ++
 frontend/editor/playwright.config.ts          |  13 +-
 .../editor/scripts/report-flaky-tests.mts     | 127 ++++++++++++++++++
 .../stubbed/file-state-across-tools.spec.ts   |  38 ++++++
 .../src/core/tests/stubbed/files-page.spec.ts |   9 +-
 .../stubbed/unsaved-changes-guard.spec.ts     |  43 ------
 8 files changed, 221 insertions(+), 49 deletions(-)
 create mode 100644 frontend/editor/scripts/report-flaky-tests.mts
 delete mode 100644 frontend/editor/src/core/tests/stubbed/unsaved-changes-guard.spec.ts

diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index 99b3b127a4..9e1a4efb83 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -167,6 +167,8 @@ jobs:
           wait_for_backend
       - name: Run enterprise OAuth Playwright tests
         id: oauth-tests
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-oauth.json
         run: task e2e:enterprise -- --grep "OAuth"
       - name: Stop backend + tear down OAuth Keycloak
         if: always()
@@ -240,6 +242,8 @@ jobs:
           wait_for_backend
       - name: Run enterprise SAML Playwright tests
         id: saml-tests
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-saml.json
         run: task e2e:enterprise -- --grep "SAML"
       - name: Stop backend + tear down SAML Keycloak
         if: always()
@@ -270,6 +274,8 @@ jobs:
           wait_for_backend
       - name: Run enterprise feature Playwright tests
         id: feature-tests
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-feature.json
         run: task e2e:enterprise -- --grep "Enterprise license"
       - name: Print backend log on failure
         if: failure()
@@ -282,6 +288,19 @@ jobs:
         run: |
           source /tmp/helpers.sh
           stop_backend
+      - name: Flag flaky tests
+        # Runs regardless of the test outcomes: a flaky test (passed on retry)
+        # leaves its step green, so this is the only place it surfaces. Merges
+        # all three phase reports (some may be absent if an earlier phase hard-
+        # failed and skipped the rest). Emits ::warning:: annotations + a job
+        # summary; never fails the job.
+        if: always()
+        working-directory: frontend
+        run: >
+          npx tsx editor/scripts/report-flaky-tests.mts
+          "${{ github.workspace }}/frontend/playwright-report/results-oauth.json"
+          "${{ github.workspace }}/frontend/playwright-report/results-saml.json"
+          "${{ github.workspace }}/frontend/playwright-report/results-feature.json"
       - name: Upload Playwright report
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 44d5443a73..57a4357dad 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -62,7 +62,17 @@ jobs:
           # .test-state/playwright/coverage-pw/ for the post-process step
           # to aggregate. Chromium-only - other engines silently skip.
           PW_COVERAGE: "1"
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
         run: task e2e:live
+      - name: Flag flaky tests
+        # Runs regardless of the test outcome: a flaky test (passed on retry)
+        # leaves the step green, so this is the only place it surfaces. Emits
+        # ::warning:: annotations + a job summary; never fails the job.
+        if: always()
+        working-directory: frontend
+        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
       - name: Generate JaCoCo report from e2e:live .exec
         if: always()
         id: live-coverage
diff --git a/.github/workflows/e2e-stubbed.yml b/.github/workflows/e2e-stubbed.yml
index 33bb24ee4c..ccfdf0052f 100644
--- a/.github/workflows/e2e-stubbed.yml
+++ b/.github/workflows/e2e-stubbed.yml
@@ -44,7 +44,18 @@ jobs:
           VITE_BUILD_FOR_PREVIEW: "1"
         run: task frontend:build
       - name: Run stubbed E2E tests (chromium)
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
         run: task e2e:stubbed -- --workers=3
+      - name: Flag flaky tests
+        # Runs regardless of the test outcome: a flaky test (passed on retry)
+        # leaves the step green, so this is the only place it surfaces. Emits
+        # ::warning:: annotations + a job summary; never fails the job.
+        if: always()
+        working-directory: frontend
+        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
       - name: Upload Playwright report
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/frontend/editor/playwright.config.ts b/frontend/editor/playwright.config.ts
index 7a049e2632..93e6572392 100644
--- a/frontend/editor/playwright.config.ts
+++ b/frontend/editor/playwright.config.ts
@@ -30,7 +30,18 @@ export default defineConfig({
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 2 : 0,
   workers: process.env.CI ? 1 : "50%",
-  reporter: [["html", { open: "never" }], ["list"]],
+  // In CI, add a JSON report alongside the HTML/list output so the workflow
+  // can flag flaky tests (passed only on retry) as warnings without failing
+  // the job. Path is pinned via PLAYWRIGHT_JSON_OUTPUT_FILE in the workflow;
+  // the outputFile here is just a sane default. Omitted locally to keep dev
+  // runs' terminal output clean.
+  reporter: process.env.CI
+    ? [
+        ["html", { open: "never" }],
+        ["list"],
+        ["json", { outputFile: "playwright-report/results.json" }],
+      ]
+    : [["html", { open: "never" }], ["list"]],
   timeout: 60_000,
   expect: { timeout: 10_000 },
 
diff --git a/frontend/editor/scripts/report-flaky-tests.mts b/frontend/editor/scripts/report-flaky-tests.mts
new file mode 100644
index 0000000000..1b1039b3ae
--- /dev/null
+++ b/frontend/editor/scripts/report-flaky-tests.mts
@@ -0,0 +1,127 @@
+// Reads a Playwright JSON report and surfaces "flaky" tests (tests that
+// failed at least once, then passed on retry) in GitHub Actions WITHOUT
+// failing the job:
+//   - emits one ::warning:: workflow command per flaky test, so the run and
+//     PR show a yellow warning triangle + count, and the annotation links to
+//     the test's source line
+//   - appends a summary table to the job summary ($GITHUB_STEP_SUMMARY)
+//
+// A green-but-flaky job is otherwise invisible (Playwright exits 0 once a
+// retry passes), which lets flakes accrete unnoticed. This makes them visible
+// without turning them into hard failures.
+//
+// Run: `npx tsx editor/scripts/report-flaky-tests.mts <results.json> [more.json...]`
+//      (a single path is also read from PLAYWRIGHT_JSON_OUTPUT_FILE). Multiple
+//      reports are merged + de-duplicated, so a job that runs Playwright in
+//      several segments (e.g. the enterprise OAuth/SAML/license phases) can
+//      pass one report per phase. A missing report or zero flaky tests is a
+//      silent no-op, so it is safe to run with `if: always()` after any
+//      Playwright step.
+
+import { appendFileSync, existsSync, readFileSync } from "fs";
+import { isAbsolute, join, relative } from "path";
+import type { JSONReport, JSONReportSuite } from "@playwright/test/reporter";
+
+interface FlakyTest {
+  file: string;
+  line: number;
+  title: string;
+}
+
+// Playwright records each test's outcome as expected|unexpected|flaky|skipped.
+// "flaky" means it needed a retry to pass, which is exactly what we surface.
+function collectFlaky(
+  report: JSONReport,
+  workspace: string,
+  rootDir: string,
+): FlakyTest[] {
+  const flaky: FlakyTest[] = [];
+  const walk = (suite: JSONReportSuite, trail: string[], depth: number) => {
+    // The outermost suite per file has title === the file path; skip it so the
+    // human-readable title is just "describe > test" (the path is shown
+    // separately as the location). Nested suites are the describe() blocks.
+    const titles = depth > 0 && suite.title ? [...trail, suite.title] : trail;
+    for (const spec of suite.specs ?? []) {
+      if ((spec.tests ?? []).some((t) => t.status === "flaky")) {
+        const abs = spec.file
+          ? isAbsolute(spec.file)
+            ? spec.file
+            : join(rootDir, spec.file)
+          : "";
+        const rel = abs ? relative(workspace, abs) : "";
+        flaky.push({
+          // Drop the path from the annotation if it escapes the workspace, so
+          // we never emit a broken file= link (the warning still shows).
+          file: rel && !rel.startsWith("..") ? rel : "",
+          line: spec.line || 0,
+          title: [...titles, spec.title].filter(Boolean).join(" > "),
+        });
+      }
+    }
+    for (const child of suite.suites ?? []) walk(child, titles, depth + 1);
+  };
+  for (const suite of report.suites ?? []) walk(suite, [], 0);
+  return flaky;
+}
+
+// Deliberately no process.exit() calls: every path falls through to a natural
+// exit(0). This step must never fail the job, and it keeps CI green even when
+// the report is missing or clean.
+function main(): void {
+  // Accept one or more report paths: a job may run Playwright in several
+  // segments, each writing its own report (the enterprise job does this for
+  // OAuth / SAML / license phases). Fall back to the env var when no paths are
+  // passed. Missing files are skipped, not fatal.
+  const reportPaths = process.argv.slice(2);
+  const envPath = process.env.PLAYWRIGHT_JSON_OUTPUT_FILE;
+  if (reportPaths.length === 0 && envPath) {
+    reportPaths.push(envPath);
+  }
+
+  const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
+  const seen = new Set<string>();
+  const flaky: FlakyTest[] = [];
+  for (const reportPath of reportPaths) {
+    if (!reportPath || !existsSync(reportPath)) {
+      // No report (e.g. the build failed before this segment ran).
+      continue;
+    }
+    const report = JSON.parse(readFileSync(reportPath, "utf8")) as JSONReport;
+    const rootDir = report.config?.rootDir || process.cwd();
+    for (const test of collectFlaky(report, workspace, rootDir)) {
+      const key = `${test.file}:${test.line}:${test.title}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        flaky.push(test);
+      }
+    }
+  }
+  if (flaky.length === 0) {
+    return;
+  }
+
+  for (const f of flaky) {
+    const loc = f.file ? `file=${f.file},line=${f.line},` : "";
+    process.stdout.write(
+      `::warning ${loc}title=Flaky test::${f.title} passed only on retry\n`,
+    );
+  }
+
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (summaryPath) {
+    const plural = flaky.length === 1 ? "" : "s";
+    const lines = [
+      `### :warning: ${flaky.length} flaky test${plural} (passed on retry)`,
+      "",
+      "These passed, but not on the first attempt. Worth fixing before they turn into hard failures.",
+      "",
+      "| Test | Location |",
+      "| --- | --- |",
+      ...flaky.map((f) => `| ${f.title} | \`${f.file || "?"}:${f.line}\` |`),
+      "",
+    ];
+    appendFileSync(summaryPath, lines.join("\n") + "\n");
+  }
+}
+
+main();
diff --git a/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts b/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
index e4b9a30c3e..6c84f6020a 100644
--- a/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
@@ -9,6 +9,11 @@ const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
  * Files uploaded on one tool page should remain in the workbench when the
  * user navigates to a different tool. This is FileContext behaviour and
  * easy to break with a stale-effect or unmount-clear bug.
+ *
+ * Covered for both navigation mechanisms, which take different code paths:
+ *   - a full page reload (page.goto) -> FileContext re-hydrates from IndexedDB
+ *   - an in-app tool-link click       -> client-side nav, FileContext stays
+ *                                        in memory
  */
 test.describe("File state persists across tool navigation", () => {
   test("file uploaded on /merge survives navigation to /split", async ({
@@ -32,4 +37,37 @@ test.describe("File state persists across tool navigation", () => {
       timeout: 5_000,
     });
   });
+
+  test("file uploaded on /merge survives an in-app tool-link navigation", async ({
+    page,
+  }) => {
+    await page.goto("/merge");
+    await page.waitForLoadState("domcontentloaded");
+    await uploadFiles(page, SAMPLE_PDF);
+
+    // Navigate via the in-app tool link (client-side React Router nav) rather
+    // than a full reload, so this exercises the in-memory FileContext path the
+    // page.goto test above doesn't. Fall back to a direct visit if the nav
+    // rail isn't showing the link yet.
+    const splitNav = page.getByRole("link", { name: /^Split$/i }).first();
+    if (await splitNav.isVisible({ timeout: 1_000 }).catch(() => false)) {
+      await splitNav.click();
+    } else {
+      await page.goto("/split");
+    }
+
+    // A client-side nav has no document load event, so waitForLoadState is a
+    // no-op here. Wait for the route to actually commit before opening the
+    // file manager; otherwise the my-files click fires mid-transition and
+    // opens it against a not-yet-settled workbench, which renders a permanent
+    // empty state (the flaky "0 items" that then passes on retry).
+    await expect(page).toHaveURL(/\/split(?:$|[/?#])/);
+
+    // The upload must still be listed after the tool switch. A "no files"
+    // empty state here would mean the client-side nav silently dropped it.
+    await page.getByTestId("my-files-button").click();
+    await expect(page.getByText(/sample\.pdf/i).first()).toBeVisible({
+      timeout: 10_000,
+    });
+  });
 });
diff --git a/frontend/editor/src/core/tests/stubbed/files-page.spec.ts b/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
index 7c08d943bb..56687b2217 100644
--- a/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
@@ -825,11 +825,10 @@ test.describe("Files page", () => {
       // and direct user shares.)
       await page.locator("#filesPage-tab-sharedByMe").click();
       const sharedByMeCards = page.locator(".files-page-card:not(.is-folder)");
-      await expect(sharedByMeCards).toHaveCount(2, { timeout: 3_000 });
-      await expect(sharedByMeCards).toContainText([
-        "link-shared.pdf",
-        "user-shared.pdf",
-      ]);
+      await expect(sharedByMeCards).toHaveCount(2, { timeout: 5_000 });
+      for (const name of ["link-shared.pdf", "user-shared.pdf"]) {
+        await expect(sharedByMeCards.filter({ hasText: name })).toHaveCount(1);
+      }
 
       // "Shared with me" -> only from-someone-else.pdf
       await page.locator("#filesPage-tab-shared").click();
diff --git a/frontend/editor/src/core/tests/stubbed/unsaved-changes-guard.spec.ts b/frontend/editor/src/core/tests/stubbed/unsaved-changes-guard.spec.ts
deleted file mode 100644
index fc3a1240d1..0000000000
--- a/frontend/editor/src/core/tests/stubbed/unsaved-changes-guard.spec.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { test, expect } from "@app/tests/helpers/stub-test-base";
-import { uploadFiles } from "@app/tests/helpers/ui-helpers";
-import path from "path";
-
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
-
-/**
- * The NavigationGuard context warns the user when they have unsaved work
- * (uploaded files or modified config) and try to navigate away. The guard
- * surface is a Mantine modal asking to confirm or cancel the navigation.
- *
- * Today the guard logic exists but is silently bypassed by tests that go
- * through the workbench. This spec asserts the modal appears and that
- * cancelling keeps the user on the current tool.
- */
-test.describe("Unsaved changes navigation guard", () => {
-  test("uploading then navigating away surfaces the guard prompt", async ({
-    page,
-  }) => {
-    await page.goto("/merge");
-    await page.waitForLoadState("domcontentloaded");
-    await uploadFiles(page, SAMPLE_PDF);
-
-    // Triggering a tool-level navigation while files are loaded should
-    // either prompt or clear-and-navigate cleanly. A regression that
-    // discards files silently is the failure we want to catch.
-    const splitNav = page.getByRole("link", { name: /^Split$/i }).first();
-    if (await splitNav.isVisible({ timeout: 1_000 }).catch(() => false)) {
-      await splitNav.click();
-    } else {
-      await page.goto("/split");
-    }
-
-    // After arriving at /split the My Files page should still list the
-    // previously uploaded sample (NavigationGuard either kept us on
-    // /merge or moved us with state intact). A "no files" empty state
-    // here would indicate the guard silently dropped the workbench.
-    await page.getByTestId("my-files-button").click();
-    await expect(page.getByText(/sample\.pdf/i).first()).toBeVisible({
-      timeout: 5_000,
-    });
-  });
-});

From b4f7b1d8a92670a1abbf65c1d13941db6b81b607 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 7 Jul 2026 08:47:07 +0100
Subject: [PATCH 10/35] Add bidirectional API types to frontend (#6867)

# Description of Changes
Fix https://github.com/Stirling-Tools/Stirling-PDF-SaaS/issues/281. Add
generated backend API mappings to the frontend code, and the logic to
convert from a backend API to frontend parameters objects.

Previously, it was impossible to tell if changing the backend API would
require a change to the frontend to support it because the frontend had
no static type information about the backend API. This PR adds
autogenerated tool API types to the frontend (in `toolApiTypes.ts`) and
adds explicit typed mappings between the frontend parameter types and
the backend API types, so theoretically the type checker should be able
to catch issues when changing one puts us in an invalid state with the
other. During development, it pointed out several inconsistencies that
we have between the frontend and backend types, some of which were
genuine bugs, and others were only happening to work because the backend
is more permissive than its API claims to be.

This also unlocks the ability for us to render the frontend settings on
saved backend API structures, which we've previously had to avoid doing
because we had no reverse mapping.
---
 .github/config/.files.yaml                    |   15 +
 .github/workflows/ai-engine.yml               |  103 +-
 .github/workflows/build.yml                   |   17 +
 .github/workflows/check-generated-models.yml  |  148 ++
 .taskfiles/frontend.yml                       |   17 +
 Taskfile.yml                                  |   10 +
 .../model/api/general/PosterPdfRequest.java   |   46 +-
 .../api/security/AddPasswordRequest.java      |    3 +-
 engine/src/stirling/models/tool_models.py     |    6 +-
 .../scripts/generate-tool-api-types.mts       |  400 +++++
 .../useAddPageNumbersOperation.ts             |   78 +-
 .../tools/addStamp/useAddStampOperation.ts    |  106 +-
 .../useAddAttachmentsOperation.ts             |   58 +-
 .../useAddPasswordOperation.test.ts           |   51 +-
 .../addPassword/useAddPasswordOperation.ts    |   79 +-
 .../useAddWatermarkOperation.test.ts          |   26 +
 .../addWatermark/useAddWatermarkOperation.ts  |  108 +-
 .../adjustPageScaleFormData.ts                |   43 +-
 .../useAdjustPageScaleOperation.test.ts       |   25 +-
 .../useAdjustPageScaleOperation.ts            |   17 +-
 .../autoRename/useAutoRenameOperation.ts      |   48 +-
 .../useBookletImpositionOperation.ts          |   61 +-
 .../tools/certSign/useCertSignOperation.ts    |  188 +-
 .../useChangePermissionsOperation.test.ts     |   34 +-
 .../useChangePermissionsOperation.ts          |   75 +-
 .../compress/useCompressOperation.test.ts     |  127 ++
 .../tools/compress/useCompressOperation.ts    |  104 +-
 .../compress/useCompressParameters.test.ts    |   42 +
 .../tools/compress/useCompressParameters.ts   |   11 +-
 .../hooks/tools/crop/useCropOperation.test.ts |   32 +
 .../core/hooks/tools/crop/useCropOperation.ts |   65 +-
 .../useEditTableOfContentsOperation.test.ts   |   46 +
 .../useEditTableOfContentsOperation.ts        |   68 +-
 .../useExtractImagesOperation.ts              |   35 +-
 .../tools/flatten/useFlattenOperation.ts      |   57 +-
 .../tools/merge/useMergeOperation.test.ts     |   60 +
 .../hooks/tools/merge/useMergeOperation.ts    |   52 +-
 .../core/hooks/tools/ocr/useOCROperation.ts   |   69 +-
 .../overlayPdfs/useOverlayPdfsOperation.ts    |   76 +-
 .../pageLayout/usePageLayoutOperation.test.ts |   24 +
 .../pageLayout/usePageLayoutOperation.ts      |   77 +-
 .../hooks/tools/redact/useRedactOperation.ts  |   77 +-
 .../removeBlanks/useRemoveBlanksOperation.ts  |   37 +-
 .../useRemoveCertificateSignOperation.ts      |   21 +-
 .../removeImage/useRemoveImageOperation.ts    |   20 +-
 .../removePages/useRemovePagesOperation.ts    |   38 +-
 .../buildRemovePasswordFormData.ts            |   41 +-
 .../useRemovePasswordOperation.ts             |   11 +-
 .../useReorganizePagesOperation.ts            |   61 +-
 .../hooks/tools/repair/useRepairOperation.ts  |   21 +-
 .../replaceColor/useReplaceColorOperation.ts  |   71 +-
 .../tools/rotate/useRotateOperation.test.ts   |   31 +
 .../hooks/tools/rotate/useRotateOperation.ts  |   38 +-
 .../tools/sanitize/useSanitizeOperation.ts    |   70 +-
 .../useScannerImageSplitOperation.ts          |   51 +-
 .../tools/shared/migratedToolMappers.test.ts  |  163 ++
 .../hooks/tools/shared/toolApiMapping.test.ts |   85 +
 .../core/hooks/tools/shared/toolApiMapping.ts |   88 +
 .../hooks/tools/shared/toolOperationTypes.ts  |   36 +-
 .../hooks/tools/shared/useToolApiCalls.ts     |   19 +-
 .../hooks/tools/shared/useToolOperation.ts    |    5 +
 .../core/hooks/tools/sign/useSignOperation.ts |    5 +-
 .../useSingleLargePageOperation.ts            |   20 +-
 .../tools/split/useSplitOperation.test.ts     |  212 +++
 .../hooks/tools/split/useSplitOperation.ts    |  211 ++-
 .../timestampPdf/useTimestampPdfOperation.ts  |   34 +-
 .../useUnlockPdfFormsOperation.ts             |   20 +-
 .../editor/src/core/types/toolApiTypes.ts     | 1594 +++++++++++++++++
 .../core/utils/automationConverter.test.ts    |   95 +
 .../src/core/utils/automationConverter.ts     |    2 +-
 .../src/core/utils/automationExecutor.ts      |   20 +-
 frontend/package-lock.json                    |   64 +
 frontend/package.json                         |    1 +
 73 files changed, 5195 insertions(+), 774 deletions(-)
 create mode 100644 .github/workflows/check-generated-models.yml
 create mode 100644 frontend/editor/scripts/generate-tool-api-types.mts
 create mode 100644 frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/compress/useCompressOperation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/compress/useCompressParameters.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/crop/useCropOperation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/split/useSplitOperation.test.ts
 create mode 100644 frontend/editor/src/core/types/toolApiTypes.ts

diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index 2d617f8f20..5e85976937 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -87,6 +87,21 @@ engine: &engine
   - Taskfile.yml
   - .taskfiles/engine.yml
 
+# Files that can make the committed generated API models (frontend tool API
+# types + engine tool models) go stale: the Java tool surfaces they derive from,
+# the generators, the generated files themselves (to catch a hand-edit), and the
+# tasks that drive generation. Deliberately excludes the broad frontend/docker/
+# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
+generated-models: &generated-models
+  - *openapi
+  - frontend/editor/scripts/generate-tool-api-types.mts
+  - frontend/editor/src/core/types/toolApiTypes.ts
+  - engine/scripts/generate_tool_models.py
+  - engine/src/stirling/models/tool_models.py
+  - .taskfiles/frontend.yml
+  - .taskfiles/engine.yml
+  - .github/workflows/check-generated-models.yml
+
 licenses-frontend: &licenses-frontend
   - ".github/workflows/frontend-backend-licenses-update.yml"
   - "frontend/package.json"
diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml
index 223490f45f..554100f535 100644
--- a/.github/workflows/ai-engine.yml
+++ b/.github/workflows/ai-engine.yml
@@ -1,9 +1,9 @@
 name: AI Engine CI
 
-# Validates the Python AI engine: regenerates tool models and runs the
-# engine quality gate (lint, type-check, format-check, tests). Called from
-# build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net.
+# Runs the engine quality gate (lint, type-check, format-check, tests). Called
+# from build.yml on PRs and merge_group; also runs directly on push to main as
+# a post-merge safety net. Freshness of the generated tool_models.py is checked
+# by the shared check-generated-models workflow.
 on:
   workflow_call:
   push:
@@ -34,104 +34,9 @@ jobs:
         with:
           enable-cache: true
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
-      - name: Regenerate tool models
-        run: task engine:tool-models
-
-      - name: Verify tool models are up to date
-        id: tool-models-check
-        continue-on-error: true
-        run: git diff --exit-code engine/src/stirling/models/tool_models.py
-
-      - name: Comment on tool models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.tool-models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const body = [
-              marker,
-              '### Tool Models Check Failed',
-              '',
-              'The generated `engine/src/stirling/models/tool_models.py` is out of date with the Java OpenAPI spec and will need to be regenerated before it can be merged in.',
-              '',
-              'Run `task engine:tool-models` to regenerate, then commit the updated file.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if tool models check failed
-        if: steps.tool-models-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Tool Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated engine/src/stirling/models/tool_models.py"
-          echo "is out of date with the Java OpenAPI spec and will"
-          echo "need to be regenerated before it can be merged in."
-          echo ""
-          echo "Run 'task engine:tool-models' to regenerate, then"
-          echo "commit the updated file."
-          echo "============================================"
-          exit 1
-
-      - name: Remove tool models check comment on success
-        if: steps.tool-models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
       - name: Quality-check engine
         id: engine-check
         run: task engine:check
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0e0a702cc2..8142c37fca 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -43,6 +43,7 @@ jobs:
       docker-base: ${{ steps.changes.outputs.docker-base }}
       tauri: ${{ steps.changes.outputs.tauri }}
       engine: ${{ steps.changes.outputs.engine }}
+      generated-models: ${{ steps.changes.outputs.generated-models }}
       proprietary: ${{ steps.changes.outputs.proprietary }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -171,6 +172,20 @@ jobs:
     uses: ./.github/workflows/ai-engine.yml
     secrets: inherit
 
+  # The generated frontend types and engine tool models are both derived from
+  # the Java OpenAPI spec. This job regenerates and diffs them; it boots the
+  # backend, so it is gated on the narrow generated-models filter (spec source,
+  # generators, generated files, generation tasks) rather than the broad
+  # frontend filter, so a CSS-only PR does not pay for a backend build.
+  generated-models:
+    if: needs.files-changed.outputs.generated-models == 'true'
+    needs: [files-changed]
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ./.github/workflows/check-generated-models.yml
+    secrets: inherit
+
   pre-commit:
     needs: [files-changed]
     permissions:
@@ -228,6 +243,7 @@ jobs:
       - test-build-docker-images
       - tauri-build
       - ai-engine
+      - generated-models
       - pre-commit
       - dependency-review
     runs-on: ubuntu-latest
@@ -253,6 +269,7 @@ jobs:
             test-build-docker-images=${{ needs.test-build-docker-images.result }}
             tauri-build=${{ needs.tauri-build.result }}
             ai-engine=${{ needs.ai-engine.result }}
+            generated-models=${{ needs.generated-models.result }}
             pre-commit=${{ needs.pre-commit.result }}
             dependency-review=${{ needs.dependency-review.result }}
         run: |
diff --git a/.github/workflows/check-generated-models.yml b/.github/workflows/check-generated-models.yml
new file mode 100644
index 0000000000..db9c49fba2
--- /dev/null
+++ b/.github/workflows/check-generated-models.yml
@@ -0,0 +1,148 @@
+name: Check generated models
+
+# Verifies the committed generated API models are still in sync with the Java
+# OpenAPI spec: the frontend tool API types
+# (frontend/editor/src/core/types/toolApiTypes.ts) and the engine tool
+# models (engine/src/stirling/models/tool_models.py). Regenerates both with the
+# single top-level `task tool-models` and fails if either committed file is
+# out of date. Called from build.yml when the backend Java, frontend, or engine
+# changes; also runs on push to main as a post-merge safety net.
+on:
+  workflow_call:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  generated-models:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        with:
+          gradle-version: 9.6.0
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Task
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
+      # Rebuilds the OpenAPI spec from the current Java and regenerates both the
+      # frontend types and the engine tool models from it.
+      - name: Regenerate generated models
+        run: task tool-models
+
+      - name: Verify generated models are up to date
+        id: models-check
+        continue-on-error: true
+        run: |
+          git diff --exit-code \
+            frontend/editor/src/core/types/toolApiTypes.ts \
+            engine/src/stirling/models/tool_models.py
+
+      - name: Comment on generated models check failure
+        # Only post a comment on PRs. github-script's PR helpers need an
+        # issue/PR number, which doesn't exist on merge_group runs.
+        if: steps.models-check.outcome == 'failure' && github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const marker = '<!-- generated-models-check -->';
+            const body = [
+              marker,
+              '### Generated Models Check Failed',
+              '',
+              'The generated `frontend/editor/src/core/types/toolApiTypes.ts` and/or `engine/src/stirling/models/tool_models.py` are out of date with the Java OpenAPI spec and will need to be regenerated before they can be merged in.',
+              '',
+              'Run `task tool-models` to regenerate both, then commit the updated files.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if generated models check failed
+        if: steps.models-check.outcome == 'failure'
+        run: |
+          echo "============================================"
+          echo "  Generated Models Check Failed"
+          echo "============================================"
+          echo ""
+          echo "The generated frontend API types and/or engine tool"
+          echo "models are out of date with the Java OpenAPI spec and"
+          echo "will need to be regenerated before they can be merged in."
+          echo ""
+          echo "Run 'task tool-models' to regenerate both, then"
+          echo "commit the updated files."
+          echo "============================================"
+          exit 1
+
+      - name: Remove generated models check comment on success
+        if: steps.models-check.outcome == 'success' && github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const marker = '<!-- generated-models-check -->';
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+              });
+            }
diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 52277b5b04..4f87226f93 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -396,6 +396,23 @@ tasks:
   # Code Generation
   # ============================================================
 
+  tool-models:
+    desc: "Generate tool API types from the Java OpenAPI spec"
+    deps: [install, ":backend:swagger"]
+    cmds:
+      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts
+    sources:
+      - editor/scripts/generate-tool-api-types.mts
+      - ../SwaggerDoc.json
+    generates:
+      - editor/src/core/types/toolApiTypes.ts
+
+  tool-models:check:
+    desc: "Fail if committed tool API types are out of date"
+    deps: [install, ":backend:swagger"]
+    cmds:
+      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --check
+
   licenses:generate:
     desc: "Generate frontend license report"
     deps: [install]
diff --git a/Taskfile.yml b/Taskfile.yml
index 26895723d0..705ad4a1db 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -185,6 +185,16 @@ tasks:
       - task: frontend:format:check
       - task: engine:format:check
 
+  # ============================================================
+  # Code generation
+  # ============================================================
+
+  tool-models:
+    desc: "Generate all API models from the Java OpenAPI spec"
+    cmds:
+      - task: frontend:tool-models
+      - task: engine:tool-models
+
   # ============================================================
   # Quality Gate
   # ============================================================
diff --git a/app/core/src/main/java/stirling/software/SPDF/model/api/general/PosterPdfRequest.java b/app/core/src/main/java/stirling/software/SPDF/model/api/general/PosterPdfRequest.java
index 20d7eaf70b..222b89022a 100644
--- a/app/core/src/main/java/stirling/software/SPDF/model/api/general/PosterPdfRequest.java
+++ b/app/core/src/main/java/stirling/software/SPDF/model/api/general/PosterPdfRequest.java
@@ -1,5 +1,7 @@
 package stirling.software.SPDF.model.api.general;
 
+import com.fasterxml.jackson.annotation.JsonProperty;
+
 import io.swagger.v3.oas.annotations.media.Schema;
 
 import lombok.Data;
@@ -17,20 +19,8 @@ public class PosterPdfRequest extends PDFFile {
             allowableValues = {"A4", "Letter", "A3", "A5", "Legal", "Tabloid"})
     private String pageSize = "A4";
 
-    @Schema(
-            description = "Horizontal decimation factor (how many columns to split into)",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "2",
-            minimum = "1",
-            maximum = "10")
     private int xFactor = 2;
 
-    @Schema(
-            description = "Vertical decimation factor (how many rows to split into)",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "2",
-            minimum = "1",
-            maximum = "10")
     private int yFactor = 2;
 
     @Schema(
@@ -38,4 +28,36 @@ public class PosterPdfRequest extends PDFFile {
             requiredMode = Schema.RequiredMode.NOT_REQUIRED,
             defaultValue = "false")
     private boolean rightToLeft = false;
+
+    @JsonProperty("xFactor")
+    @Schema(
+            description = "Horizontal decimation factor (how many columns to split into)",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "2",
+            minimum = "1",
+            maximum = "10")
+    public int getXFactor() {
+        return xFactor;
+    }
+
+    @JsonProperty("xFactor")
+    public void setXFactor(int xFactor) {
+        this.xFactor = xFactor;
+    }
+
+    @JsonProperty("yFactor")
+    @Schema(
+            description = "Vertical decimation factor (how many rows to split into)",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "2",
+            minimum = "1",
+            maximum = "10")
+    public int getYFactor() {
+        return yFactor;
+    }
+
+    @JsonProperty("yFactor")
+    public void setYFactor(int yFactor) {
+        this.yFactor = yFactor;
+    }
 }
diff --git a/app/core/src/main/java/stirling/software/SPDF/model/api/security/AddPasswordRequest.java b/app/core/src/main/java/stirling/software/SPDF/model/api/security/AddPasswordRequest.java
index 541a8717f3..2227803372 100644
--- a/app/core/src/main/java/stirling/software/SPDF/model/api/security/AddPasswordRequest.java
+++ b/app/core/src/main/java/stirling/software/SPDF/model/api/security/AddPasswordRequest.java
@@ -29,7 +29,8 @@ public class AddPasswordRequest extends PDFFile {
             description = "The length of the encryption key",
             type = "integer",
             allowableValues = {"40", "128", "256"},
-            requiredMode = Schema.RequiredMode.REQUIRED)
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "256")
     private int keyLength = 256;
 
     @Schema(description = "Whether document assembly is prevented", defaultValue = "false")
diff --git a/engine/src/stirling/models/tool_models.py b/engine/src/stirling/models/tool_models.py
index 3e179eaf0c..2591d947a8 100644
--- a/engine/src/stirling/models/tool_models.py
+++ b/engine/src/stirling/models/tool_models.py
@@ -107,7 +107,7 @@ class KeyLength(IntEnum):
 
 
 class AddPasswordParams(ApiModel):
-    key_length: KeyLength = Field(..., description="The length of the encryption key")
+    key_length: KeyLength = Field(KeyLength.integer_256, description="The length of the encryption key")
     owner_password: SecretStr | None = Field(
         None,
         description="The owner password to be added to the PDF file (Restricts what can be done with the document once it is opened)",
@@ -1283,8 +1283,8 @@ class PageSize1(StrEnum):
 class SplitForPosterPrintParams(ApiModel):
     page_size: PageSize1 = Field(..., description="Target page size for output chunks (e.g., 'A4', 'Letter', 'A3')")
     right_to_left: bool = Field(False, description="Split right-to-left instead of left-to-right")
-    xfactor: int | None = None
-    yfactor: int | None = None
+    x_factor: int = Field(2, description="Horizontal decimation factor (how many columns to split into)", ge=1, le=10)
+    y_factor: int = Field(2, description="Vertical decimation factor (how many rows to split into)", ge=1, le=10)
 
 
 class SplitPagesParams(ApiModel):
diff --git a/frontend/editor/scripts/generate-tool-api-types.mts b/frontend/editor/scripts/generate-tool-api-types.mts
new file mode 100644
index 0000000000..f12572620a
--- /dev/null
+++ b/frontend/editor/scripts/generate-tool-api-types.mts
@@ -0,0 +1,400 @@
+/**
+ * Generates the committed frontend tool API types (toolApiTypes.ts) from the
+ * Java backend's OpenAPI spec, so the frontend's request shapes stay in step
+ * with the backend.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { compile, type JSONSchema } from "json-schema-to-typescript";
+import * as prettier from "prettier";
+
+// The API namespaces whose endpoints are real, callable tools. `/api/v1/filter/`
+// (pipeline-only) and `/api/v1/ai/tools/` (not in the spec) are intentionally
+// excluded. Extend this list when other namespaces become tools.
+const ALLOWED_PATH_PREFIXES = [
+  "/api/v1/general/",
+  "/api/v1/misc/",
+  "/api/v1/security/",
+  "/api/v1/convert/",
+];
+
+// File plumbing, not user parameters: `fileInput` is the uploaded document and
+// `fileId` a server-side handle. Stripped from every generated request model.
+// Named file fields (stampImage, attachments, ...) are real parameters and kept.
+const BASE_FILE_FIELDS = new Set(["fileInput", "fileId"]);
+
+// The shared "upload a file or provide a file ID" wrapper schema and its two
+// branches. An endpoint whose body is exactly this has no parameters, so it must
+// resolve to an empty model. It needs separate handling because the wrapper is a
+// `oneOf`, which survives the flat-field stripping above and would otherwise leak
+// the file fields into the output.
+const FILE_WRAPPER_COMPONENTS = new Set([
+  "PDFFile",
+  "PDFFileUpload",
+  "PDFFileRef",
+]);
+
+const COMPONENT_REF_PREFIX = "#/components/schemas/";
+
+const FILE_HEADER = [
+  "// AUTO-GENERATED FILE. DO NOT EDIT.",
+  "// Generated by editor/scripts/generate-tool-api-types.mts from the Java OpenAPI spec",
+  "// (SwaggerDoc.json). Regenerate with: task frontend:tool-models",
+  "// Tools that take only a file input have no parameters; their model is Record<string, never>.",
+].join("\n");
+
+type Json = Record<string, unknown>;
+
+interface DiscoveredTool {
+  path: string;
+  className: string;
+}
+
+function isObject(value: unknown): value is Json {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Recursively sort object keys so the output is byte-stable regardless of the
+ * key ordering springdoc happens to emit.
+ */
+function deepSortKeys(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(deepSortKeys);
+  if (isObject(value)) {
+    const sorted: Json = {};
+    for (const key of Object.keys(value).sort()) {
+      sorted[key] = deepSortKeys(value[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+
+function pascalCase(segment: string): string {
+  return segment
+    .split(/[-_/]/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+}
+
+/** Fallback class name for an inline request body (no $ref to name it after). */
+function pathToClassName(path: string): string {
+  const relevant = path.replace(/^\/api\/v1\//, "");
+  return `${pascalCase(relevant)}Request`;
+}
+
+function dedupe(name: string, used: Set<string>): string {
+  let candidate = name;
+  let n = 2;
+  while (used.has(candidate)) candidate = `${name}${n++}`;
+  used.add(candidate);
+  return candidate;
+}
+
+/** The request body schema for a POST endpoint (multipart wins, then JSON), or null. */
+function requestBodySchema(pathItem: Json): Json | null {
+  const post = pathItem.post;
+  if (!isObject(post)) return null;
+  const requestBody = post.requestBody;
+  if (!isObject(requestBody)) return null;
+  const content = requestBody.content;
+  if (!isObject(content)) return null;
+  for (const mediaType of ["multipart/form-data", "application/json"]) {
+    const entry = content[mediaType];
+    if (isObject(entry) && isObject(entry.schema)) return entry.schema;
+  }
+  return null;
+}
+
+/**
+ * A POST endpoint's query parameters as a property map plus the required ones.
+ * Some tools take inputs on the query string alongside the multipart body (e.g.
+ * merge-pdfs' `fileOrder`), so a complete model has to fold them in. Ref-valued
+ * param schemas are inlined later by rewriteRefs.
+ */
+function queryParameters(pathItem: Json): { props: Json; required: string[] } {
+  const props: Json = {};
+  const required: string[] = [];
+  const post = pathItem.post;
+  if (!isObject(post) || !Array.isArray(post.parameters))
+    return { props, required };
+  for (const param of post.parameters) {
+    if (
+      !isObject(param) ||
+      param.in !== "query" ||
+      typeof param.name !== "string"
+    )
+      continue;
+    if (!isObject(param.schema)) continue;
+    const schema = structuredClone(param.schema) as Json;
+    if (!("description" in schema) && typeof param.description === "string") {
+      schema.description = param.description;
+    }
+    props[param.name] = schema;
+    if (param.required === true) required.push(param.name);
+  }
+  return { props, required };
+}
+
+/**
+ * Rewrite every `#/components/schemas/X` ref to `#/definitions/X` in place (the
+ * form json-schema-to-typescript expects) and collect the referenced component
+ * names so the caller can inline them.
+ */
+function rewriteRefs(node: unknown, found: Set<string>): void {
+  if (Array.isArray(node)) {
+    for (const item of node) rewriteRefs(item, found);
+    return;
+  }
+  if (!isObject(node)) return;
+  const ref = node.$ref;
+  if (typeof ref === "string" && ref.startsWith(COMPONENT_REF_PREFIX)) {
+    const name = ref.slice(COMPONENT_REF_PREFIX.length);
+    node.$ref = `#/definitions/${name}`;
+    found.add(name);
+  }
+  for (const value of Object.values(node)) rewriteRefs(value, found);
+}
+
+/** Keep only fields the client must send: drop those with a default or already stripped. */
+function computeRequired(schema: Json, properties: Json): string[] {
+  const required = Array.isArray(schema.required)
+    ? (schema.required as string[])
+    : [];
+  return required.filter((name) => {
+    const prop = properties[name];
+    return name in properties && !(isObject(prop) && "default" in prop);
+  });
+}
+
+async function main(): Promise<void> {
+  const { values } = parseArgs({
+    options: {
+      spec: { type: "string" },
+      output: { type: "string" },
+      check: { type: "boolean", default: false },
+    },
+  });
+  if (!values.spec || !values.output) {
+    throw new Error(
+      "Usage: generate-tool-api-types.mts --spec <SwaggerDoc.json> --output <file.ts> [--check]",
+    );
+  }
+  const specPath = resolve(values.spec);
+  const outputPath = resolve(values.output);
+
+  const spec = JSON.parse(readFileSync(specPath, "utf-8")) as Json;
+  const paths = isObject(spec.paths) ? spec.paths : {};
+  const components =
+    isObject(spec.components) && isObject(spec.components.schemas)
+      ? spec.components.schemas
+      : {};
+
+  const tools: DiscoveredTool[] = [];
+  const definitions: Record<string, Json> = {};
+  const usedClassNames = new Set<string>();
+  const pendingComponents = new Set<string>();
+  const skipped: string[] = [];
+
+  for (const path of Object.keys(paths).sort()) {
+    if (
+      path.includes("{") ||
+      !ALLOWED_PATH_PREFIXES.some((p) => path.startsWith(p))
+    )
+      continue;
+    const pathItem = paths[path];
+    if (!isObject(pathItem)) continue;
+    const bodySchema = requestBodySchema(pathItem);
+    if (!bodySchema) {
+      if (isObject(pathItem.post)) skipped.push(path);
+      continue;
+    }
+
+    // Resolve the request model into a fresh, mutable clone so we never mutate the shared spec.
+    const ref = bodySchema.$ref;
+    const refComponent =
+      typeof ref === "string" && ref.startsWith(COMPONENT_REF_PREFIX)
+        ? ref.slice(COMPONENT_REF_PREFIX.length)
+        : null;
+    let className: string;
+    let modelSchema: Json;
+    if (refComponent && FILE_WRAPPER_COMPONENTS.has(refComponent)) {
+      // File-only endpoint: model it as an empty object so it becomes
+      // Record<string, never> rather than the wrapper's file union. Named after
+      // the path since the wrapper schema is shared. Query params still fold in
+      // below.
+      className = pathToClassName(path);
+      modelSchema = { type: "object", properties: {} };
+    } else if (refComponent) {
+      const component = components[refComponent];
+      if (!isObject(component)) continue;
+      className = refComponent;
+      modelSchema = structuredClone(component) as Json;
+    } else {
+      className = pathToClassName(path);
+      modelSchema = structuredClone(bodySchema) as Json;
+    }
+
+    // A component shared by several endpoints (e.g. GeneralFile) is only defined once.
+    if (!(className in definitions)) {
+      const uniqueName = dedupe(className, usedClassNames);
+      className = uniqueName;
+      const bodyProps: Json = isObject(modelSchema.properties)
+        ? (structuredClone(modelSchema.properties) as Json)
+        : {};
+      const query = queryParameters(pathItem);
+      // Body wins over query on a name collision.
+      const properties: Json = { ...query.props, ...bodyProps };
+      for (const field of BASE_FILE_FIELDS) delete properties[field];
+      modelSchema.properties = properties;
+      const required = new Set(computeRequired(modelSchema, properties));
+      for (const name of query.required) {
+        const prop = properties[name];
+        if (name in properties && !(isObject(prop) && "default" in prop)) {
+          required.add(name);
+        }
+      }
+      if (required.size > 0) modelSchema.required = [...required];
+      else delete modelSchema.required;
+      modelSchema.title = className;
+      rewriteRefs(modelSchema, pendingComponents);
+      definitions[className] = modelSchema;
+    }
+
+    tools.push({ path, className });
+  }
+
+  // Transitively inline every referenced component into `definitions`, rewriting its refs too.
+  const queue = [...pendingComponents];
+  while (queue.length > 0) {
+    const name = queue.pop() as string;
+    if (name in definitions) continue;
+    const component = components[name];
+    if (!isObject(component)) continue;
+    const cloned = structuredClone(component) as Json;
+    cloned.title = name;
+    const nested = new Set<string>();
+    rewriteRefs(cloned, nested);
+    definitions[name] = cloned;
+    for (const next of nested) if (!(next in definitions)) queue.push(next);
+  }
+
+  await compileAndWrite(
+    tools,
+    definitions,
+    outputPath,
+    values.check ?? false,
+    skipped,
+  );
+}
+
+async function compileAndWrite(
+  tools: DiscoveredTool[],
+  definitions: Record<string, Json>,
+  outputPath: string,
+  check: boolean,
+  skipped: string[],
+): Promise<void> {
+  // json-schema-to-typescript only emits a named, exported interface per schema
+  // if something references it, so wrap every model in one root object. The root
+  // interface itself is stripped from the output afterwards.
+  const rootName = "__ToolApiRootAutogen";
+  const uniqueClassNames = [...new Set(tools.map((t) => t.className))];
+  const rootSchema: JSONSchema = {
+    title: rootName,
+    type: "object",
+    additionalProperties: false,
+    properties: Object.fromEntries(
+      uniqueClassNames.map((name) => [name, { $ref: `#/definitions/${name}` }]),
+    ),
+    definitions: definitions as Record<string, JSONSchema>,
+  };
+
+  // Canonicalize key order so a reordering in SwaggerDoc.json can never change
+  // the generated file (which would flake the committed-types CI check).
+  const canonicalRoot = deepSortKeys(rootSchema) as JSONSchema;
+
+  const compiled = await compile(canonicalRoot, rootName, {
+    bannerComment: "",
+    additionalProperties: false,
+    declareExternallyReferenced: true,
+    unreachableDefinitions: false,
+    strictIndexSignatures: true,
+    format: false,
+  });
+
+  // Drop the root wrapper interface, then rewrite empty models (file-only tools)
+  // to `Record<string, never>` - the precise, lint-clean type for an object with
+  // no properties (json-schema-to-typescript always emits `{}` interfaces here).
+  const models = compiled
+    .replace(new RegExp(`export interface ${rootName} \\{[^}]*\\}`), "")
+    .replace(
+      /export interface (\w+) \{\s*\}/g,
+      "export type $1 = Record<string, never>;",
+    )
+    .trim();
+
+  const endpointUnion = tools
+    .map((t) => `  | ${JSON.stringify(t.path)}`)
+    .join("\n");
+  const paramsEntries = tools
+    .map((t) => `  ${JSON.stringify(t.path)}: ${t.className};`)
+    .join("\n");
+  const endpointList = tools
+    .map((t) => `  ${JSON.stringify(t.path)},`)
+    .join("\n");
+
+  const footer = [
+    "/** Endpoint path for a generated tool operation (the operation identity across languages). */",
+    `export type ToolEndpoint =\n${endpointUnion};`,
+    "",
+    "/** Backend request-parameter model for each tool endpoint. */",
+    `export interface ToolApiParams {\n${paramsEntries}\n}`,
+    "",
+    "/** Every generated tool endpoint, for iteration. */",
+    `export const TOOL_ENDPOINTS = [\n${endpointList}\n] as const satisfies readonly ToolEndpoint[];`,
+    "",
+    "/** Union of every generated tool request model. */",
+    `export type ToolApiRequest = ToolApiParams[ToolEndpoint];`,
+  ].join("\n");
+
+  const body = `${FILE_HEADER}\n\n${models}\n\n${footer}\n`;
+  const prettierConfig = await prettier.resolveConfig(outputPath);
+  const formatted = await prettier.format(body, {
+    ...prettierConfig,
+    parser: "typescript",
+  });
+
+  if (check) {
+    let current = "";
+    try {
+      current = readFileSync(outputPath, "utf-8");
+    } catch {
+      // Missing file counts as out of date.
+    }
+    if (current !== formatted) {
+      throw new Error(
+        `${outputPath} is out of date. Run 'task frontend:tool-models' and commit the result.`,
+      );
+    }
+    console.log(`Up to date: ${tools.length} tool endpoints.`);
+    return;
+  }
+
+  mkdirSync(dirname(outputPath), { recursive: true });
+  writeFileSync(outputPath, formatted, "utf-8");
+  console.log(`Generated ${tools.length} tool endpoints -> ${outputPath}`);
+  if (skipped.length > 0) {
+    console.log(
+      `Skipped ${skipped.length} POST endpoint(s) with no request body: ${skipped.join(", ")}`,
+    );
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts b/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
index f9bf73f4ce..cb5624bce2 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
@@ -3,35 +3,83 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   AddPageNumbersParameters,
   defaultParameters,
 } from "@app/components/tools/addPageNumbers/useAddPageNumbersParameters";
 
+const ENDPOINT = "/api/v1/misc/add-page-numbers" satisfies ToolEndpoint;
+type AddPageNumbersApiParams = ToolApiParams[typeof ENDPOINT];
+
+// The UI labels fonts capitalized while the backend model uses lowercase; these
+// maps translate between them so both mappers type-check without casting.
+const FONT_TYPE_TO_API = {
+  Times: "times",
+  Helvetica: "helvetica",
+  Courier: "courier",
+} as const satisfies Record<
+  AddPageNumbersParameters["fontType"],
+  AddPageNumbersApiParams["fontType"]
+>;
+const FONT_TYPE_FROM_API = {
+  times: "Times",
+  helvetica: "Helvetica",
+  courier: "Courier",
+} as const satisfies Record<
+  AddPageNumbersApiParams["fontType"],
+  AddPageNumbersParameters["fontType"]
+>;
+
+// Convert the tool's UI parameters into the add-page-numbers request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const addPageNumbersToApiParams = (
+  parameters: AddPageNumbersParameters,
+): AddPageNumbersApiParams => ({
+  customMargin: parameters.customMargin,
+  position: parameters.position,
+  fontSize: parameters.fontSize,
+  fontType: FONT_TYPE_TO_API[parameters.fontType],
+  startingNumber: parameters.startingNumber,
+  pagesToNumber: parameters.pagesToNumber,
+  customText: parameters.customText,
+  zeroPad: parameters.zeroPad,
+});
+
+// Reconstruct the tool's UI parameters from an add-page-numbers request body,
+// so a stored or AI-authored step can be re-rendered in the settings UI.
+export const addPageNumbersFromApiParams = (
+  apiParams: AddPageNumbersApiParams,
+): Partial<AddPageNumbersParameters> => ({
+  customMargin: apiParams.customMargin,
+  position: apiParams.position,
+  fontSize: apiParams.fontSize,
+  fontType: FONT_TYPE_FROM_API[apiParams.fontType],
+  startingNumber: apiParams.startingNumber,
+  pagesToNumber: apiParams.pagesToNumber,
+  customText: apiParams.customText,
+  zeroPad: apiParams.zeroPad,
+});
+
 export const buildAddPageNumbersFormData = (
   parameters: AddPageNumbersParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("customMargin", parameters.customMargin);
-  formData.append("position", String(parameters.position));
-  formData.append("fontSize", String(parameters.fontSize));
-  formData.append("fontType", parameters.fontType);
-  formData.append("startingNumber", String(parameters.startingNumber));
-  formData.append("pagesToNumber", parameters.pagesToNumber);
-  formData.append("customText", parameters.customText);
-  formData.append("zeroPad", String(parameters.zeroPad));
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(addPageNumbersToApiParams(parameters), { fileInput: file });
 
 export const addPageNumbersOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAddPageNumbersFormData,
+  toApiParams: addPageNumbersToApiParams,
+  fromApiParams: addPageNumbersFromApiParams,
   operationType: "addPageNumbers",
-  endpoint: "/api/v1/misc/add-page-numbers",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts b/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
index dc34c5d27a..bdceee49f1 100644
--- a/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
+++ b/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
@@ -3,51 +3,97 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   AddStampParameters,
   defaultParameters,
 } from "@app/components/tools/addStamp/useAddStampParameters";
 
+const ENDPOINT = "/api/v1/misc/add-stamp" satisfies ToolEndpoint;
+type AddStampApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the add-stamp request body. The stamp
+// image itself is a File and is passed via the `files` argument, not here.
+export const addStampToApiParams = (
+  parameters: AddStampParameters,
+): AddStampApiParams => {
+  const stampType = parameters.stampType || "text";
+  const apiParams: AddStampApiParams = {
+    stampType,
+    pageNumbers: parameters.pageNumbers,
+    customMargin: parameters.customMargin || "medium",
+    position: parameters.position,
+    fontSize: parameters.fontSize,
+    rotation: parameters.rotation,
+    // The UI stores opacity as a 0-100 percentage; the backend expects 0.0-1.0.
+    opacity: parameters.opacity / 100,
+    overrideX: parameters.overrideX,
+    overrideY: parameters.overrideY,
+    customColor: parameters.customColor.startsWith("#")
+      ? parameters.customColor
+      : `#${parameters.customColor}`,
+    alphabet: parameters.alphabet,
+  };
+
+  if (stampType === "text") {
+    apiParams.stampText = parameters.stampText;
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from an add-stamp request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI. The stamp
+// image File cannot be recovered from the request model.
+export const addStampFromApiParams = (
+  apiParams: AddStampApiParams,
+): Partial<AddStampParameters> => {
+  const result: Partial<AddStampParameters> = {
+    stampType: apiParams.stampType,
+    pageNumbers: apiParams.pageNumbers,
+    customMargin: apiParams.customMargin,
+    position: apiParams.position,
+    fontSize: apiParams.fontSize,
+    rotation: apiParams.rotation,
+    overrideX: apiParams.overrideX,
+    overrideY: apiParams.overrideY,
+    customColor: apiParams.customColor,
+    alphabet: apiParams.alphabet,
+  };
+
+  if (apiParams.opacity !== undefined) {
+    result.opacity = apiParams.opacity * 100;
+  }
+  if (apiParams.stampText !== undefined) {
+    result.stampText = apiParams.stampText;
+  }
+
+  return result;
+};
+
 export const buildAddStampFormData = (
   parameters: AddStampParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("pageNumbers", parameters.pageNumbers);
-  formData.append("customMargin", parameters.customMargin || "medium");
-  formData.append("position", String(parameters.position));
-  const effectiveFontSize = parameters.fontSize;
-  formData.append("fontSize", String(effectiveFontSize));
-  formData.append("rotation", String(parameters.rotation));
-  formData.append("opacity", String(parameters.opacity / 100));
-  formData.append("overrideX", String(parameters.overrideX));
-  formData.append("overrideY", String(parameters.overrideY));
-  formData.append(
-    "customColor",
-    parameters.customColor.startsWith("#")
-      ? parameters.customColor
-      : `#${parameters.customColor}`,
+): FormData =>
+  objectToFormData(
+    addStampToApiParams(parameters),
+    parameters.stampType === "image" && parameters.stampImage
+      ? { fileInput: file, stampImage: parameters.stampImage }
+      : { fileInput: file },
   );
-  formData.append("alphabet", parameters.alphabet);
-
-  // Stamp type and payload
-  formData.append("stampType", parameters.stampType || "text");
-  if (parameters.stampType === "text") {
-    formData.append("stampText", parameters.stampText);
-  } else if (parameters.stampType === "image" && parameters.stampImage) {
-    formData.append("stampImage", parameters.stampImage);
-  }
-
-  return formData;
-};
 
 export const addStampOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAddStampFormData,
+  toApiParams: addStampToApiParams,
+  fromApiParams: addStampFromApiParams,
   operationType: "addStamp",
-  endpoint: "/api/v1/misc/add-stamp",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts b/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
index 2b66bbdc34..bc9fb738bc 100644
--- a/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
@@ -4,37 +4,59 @@ import {
   ToolOperationConfig,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
-import { AddAttachmentsParameters } from "@app/hooks/tools/addAttachments/useAddAttachmentsParameters";
+import {
+  AddAttachmentsParameters,
+  DEFAULT_ADD_ATTACHMENTS_PARAMETERS,
+} from "@app/hooks/tools/addAttachments/useAddAttachmentsParameters";
+
+const ENDPOINT = "/api/v1/misc/add-attachments" satisfies ToolEndpoint;
+type AddAttachmentsApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the add-attachments request body. The
+// attachment files are uploaded via the named "attachments" field (see
+// buildFormData); the model lists them but they are not scalar parameters.
+export const addAttachmentsToApiParams = (
+  parameters: AddAttachmentsParameters,
+): AddAttachmentsApiParams => ({
+  attachments: [],
+  convertToPdfA3b: parameters.convertToPdfA3b,
+});
+
+// Reconstruct the tool's UI parameters from an add-attachments request body (the
+// attachment files themselves are not recoverable from stored parameters).
+export const addAttachmentsFromApiParams = (
+  apiParams: AddAttachmentsApiParams,
+): Partial<AddAttachmentsParameters> => ({
+  convertToPdfA3b:
+    apiParams.convertToPdfA3b ??
+    DEFAULT_ADD_ATTACHMENTS_PARAMETERS.convertToPdfA3b,
+});
 
 const buildFormData = (
   parameters: AddAttachmentsParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-
-  // Add the main PDF file (single file per request in singleFile mode)
-  if (file) {
-    formData.append("fileInput", file);
-  }
-
-  // Add attachment files
-  (parameters.attachments || []).forEach((attachment) => {
-    if (attachment) formData.append("attachments", attachment);
+): FormData =>
+  objectToFormData(addAttachmentsToApiParams(parameters), {
+    fileInput: file,
+    attachments: (parameters.attachments || []).filter(Boolean),
   });
 
-  formData.append("convertToPdfA3b", String(parameters.convertToPdfA3b));
-
-  return formData;
-};
-
 // Operation configuration for automation
 export const addAttachmentsOperationConfig: ToolOperationConfig<AddAttachmentsParameters> =
   {
     toolType: ToolType.singleFile,
     buildFormData,
+    toApiParams: addAttachmentsToApiParams,
+    fromApiParams: addAttachmentsFromApiParams,
     operationType: "addAttachments",
-    endpoint: "/api/v1/misc/add-attachments",
+    endpoint: ENDPOINT,
+    defaultParameters: DEFAULT_ADD_ATTACHMENTS_PARAMETERS,
   };
 
 export const useAddAttachmentsOperation = () => {
diff --git a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.test.ts b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.test.ts
index 3045c69450..77958629b0 100644
--- a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.test.ts
@@ -1,6 +1,10 @@
 import { describe, expect, test, vi, beforeEach } from "vitest";
 import { renderHook } from "@testing-library/react";
-import { useAddPasswordOperation } from "@app/hooks/tools/addPassword/useAddPasswordOperation";
+import {
+  addPasswordFromApiParams,
+  addPasswordToApiParams,
+  useAddPasswordOperation,
+} from "@app/hooks/tools/addPassword/useAddPasswordOperation";
 import type { AddPasswordFullParameters } from "@app/hooks/tools/addPassword/useAddPasswordParameters";
 
 // Mock the useToolOperation hook
@@ -141,3 +145,48 @@ describe("useAddPasswordOperation", () => {
     expect(callArgs[property]).toBe(expectedValue);
   });
 });
+
+describe("addPassword mappers", () => {
+  test("round-trips backend params, including the flattened permissions", () => {
+    // Baseline differs from the configured values so the round trip fails if
+    // fromApiParams drops a field instead of reconstructing it.
+    const baseline: AddPasswordFullParameters = {
+      password: "",
+      ownerPassword: "",
+      keyLength: 40,
+      permissions: {
+        preventAssembly: false,
+        preventExtractContent: false,
+        preventExtractForAccessibility: false,
+        preventFillInForm: false,
+        preventModify: false,
+        preventModifyAnnotations: false,
+        preventPrinting: false,
+        preventPrintingFaithful: false,
+      },
+    };
+    const configured: AddPasswordFullParameters = {
+      password: "user-pw",
+      ownerPassword: "owner-pw",
+      keyLength: 128,
+      permissions: {
+        preventAssembly: true,
+        preventExtractContent: false,
+        preventExtractForAccessibility: true,
+        preventFillInForm: false,
+        preventModify: true,
+        preventModifyAnnotations: false,
+        preventPrinting: true,
+        preventPrintingFaithful: false,
+      },
+    };
+
+    const api = addPasswordToApiParams(configured);
+    const roundTripped = addPasswordToApiParams({
+      ...baseline,
+      ...addPasswordFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
index c09a740250..0bc3c1b396 100644
--- a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
@@ -3,29 +3,80 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   AddPasswordFullParameters,
   defaultParameters,
 } from "@app/hooks/tools/addPassword/useAddPasswordParameters";
 import { defaultParameters as permissionsDefaults } from "@app/hooks/tools/changePermissions/useChangePermissionsParameters";
-import { getFormData } from "@app/hooks/tools/changePermissions/useChangePermissionsOperation";
+
+const ENDPOINT = "/api/v1/security/add-password" satisfies ToolEndpoint;
+type AddPasswordApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the add-password request body. The
+// permissions sub-object is flattened into the request's prevent* fields.
+export const addPasswordToApiParams = (
+  parameters: AddPasswordFullParameters,
+): AddPasswordApiParams => ({
+  password: parameters.password,
+  ownerPassword: parameters.ownerPassword,
+  // The UI stores keyLength as a number; narrow it to the model's allowed sizes.
+  keyLength: parameters.keyLength as AddPasswordApiParams["keyLength"],
+  preventAssembly: parameters.permissions.preventAssembly ?? false,
+  preventExtractContent: parameters.permissions.preventExtractContent ?? false,
+  preventExtractForAccessibility:
+    parameters.permissions.preventExtractForAccessibility ?? false,
+  preventFillInForm: parameters.permissions.preventFillInForm ?? false,
+  preventModify: parameters.permissions.preventModify ?? false,
+  preventModifyAnnotations:
+    parameters.permissions.preventModifyAnnotations ?? false,
+  preventPrinting: parameters.permissions.preventPrinting ?? false,
+  preventPrintingFaithful:
+    parameters.permissions.preventPrintingFaithful ?? false,
+});
+
+// Reconstruct the tool's UI parameters from an add-password request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const addPasswordFromApiParams = (
+  apiParams: AddPasswordApiParams,
+): Partial<AddPasswordFullParameters> => ({
+  password: apiParams.password ?? defaultParameters.password,
+  ownerPassword: apiParams.ownerPassword ?? defaultParameters.ownerPassword,
+  keyLength: apiParams.keyLength,
+  permissions: {
+    preventAssembly:
+      apiParams.preventAssembly ?? permissionsDefaults.preventAssembly,
+    preventExtractContent:
+      apiParams.preventExtractContent ??
+      permissionsDefaults.preventExtractContent,
+    preventExtractForAccessibility:
+      apiParams.preventExtractForAccessibility ??
+      permissionsDefaults.preventExtractForAccessibility,
+    preventFillInForm:
+      apiParams.preventFillInForm ?? permissionsDefaults.preventFillInForm,
+    preventModify: apiParams.preventModify ?? permissionsDefaults.preventModify,
+    preventModifyAnnotations:
+      apiParams.preventModifyAnnotations ??
+      permissionsDefaults.preventModifyAnnotations,
+    preventPrinting:
+      apiParams.preventPrinting ?? permissionsDefaults.preventPrinting,
+    preventPrintingFaithful:
+      apiParams.preventPrintingFaithful ??
+      permissionsDefaults.preventPrintingFaithful,
+  },
+});
 
 // Static function that can be used by both the hook and automation executor
 export const buildAddPasswordFormData = (
   parameters: AddPasswordFullParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("password", parameters.password);
-  formData.append("ownerPassword", parameters.ownerPassword);
-  formData.append("keyLength", parameters.keyLength.toString());
-  getFormData(parameters.permissions).forEach(([key, value]) => {
-    formData.append(key, value);
-  });
-  return formData;
-};
+): FormData =>
+  objectToFormData(addPasswordToApiParams(parameters), { fileInput: file });
 
 // Full default parameters including permissions for automation
 const fullDefaultParameters: AddPasswordFullParameters = {
@@ -37,8 +88,10 @@ const fullDefaultParameters: AddPasswordFullParameters = {
 export const addPasswordOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAddPasswordFormData,
+  toApiParams: addPasswordToApiParams,
+  fromApiParams: addPasswordFromApiParams,
   operationType: "addPassword",
-  endpoint: "/api/v1/security/add-password",
+  endpoint: ENDPOINT,
   defaultParameters: fullDefaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.test.ts b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.test.ts
new file mode 100644
index 0000000000..e00753e41c
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, test } from "vitest";
+import {
+  addWatermarkFromApiParams,
+  addWatermarkToApiParams,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkOperation";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+describe("addWatermark mappers", () => {
+  // opacity 33 exercises the percentage <-> fraction conversion (/100, *100),
+  // which must survive the round trip without drifting on floating point.
+  test.each<Partial<AddWatermarkParameters>>([
+    { watermarkType: "text", watermarkText: "DRAFT", opacity: 33 },
+    { watermarkType: "image", opacity: 33 },
+  ])("round-trips backend params for %o", (overrides) => {
+    const api = addWatermarkToApiParams({ ...defaultParameters, ...overrides });
+    const roundTripped = addWatermarkToApiParams({
+      ...defaultParameters,
+      ...addWatermarkFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
index 19700f43e7..75651f7bcd 100644
--- a/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
@@ -3,57 +3,97 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   AddWatermarkParameters,
   defaultParameters,
 } from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
 
+const ENDPOINT = "/api/v1/security/add-watermark" satisfies ToolEndpoint;
+type AddWatermarkApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the add-watermark request body. The
+// watermark image itself is a File and is passed via the `files` argument.
+export const addWatermarkToApiParams = (
+  parameters: AddWatermarkParameters,
+): AddWatermarkApiParams => {
+  const watermarkType = parameters.watermarkType || "text";
+  const apiParams: AddWatermarkApiParams = {
+    watermarkType,
+    fontSize: parameters.fontSize,
+    rotation: parameters.rotation,
+    // The UI stores opacity as a 0-100 percentage; the backend expects 0.0-1.0.
+    opacity: parameters.opacity / 100,
+    widthSpacer: parameters.widthSpacer,
+    heightSpacer: parameters.heightSpacer,
+    // The UI types alphabet as a free string; the wire always sends it (empty
+    // string when unset) so the value is passed through and cast to the model
+    // enum to preserve existing behaviour.
+    alphabet: (parameters.alphabet || "") as AddWatermarkApiParams["alphabet"],
+    customColor: parameters.customColor || "",
+    convertPDFToImage: parameters.convertPDFToImage ?? false,
+  };
+
+  if (watermarkType === "text") {
+    apiParams.watermarkText = parameters.watermarkText;
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from an add-watermark request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI. The
+// watermark image File cannot be recovered from the request model.
+export const addWatermarkFromApiParams = (
+  apiParams: AddWatermarkApiParams,
+): Partial<AddWatermarkParameters> => {
+  const result: Partial<AddWatermarkParameters> = {
+    watermarkType: apiParams.watermarkType,
+    fontSize: apiParams.fontSize,
+    rotation: apiParams.rotation,
+    widthSpacer: apiParams.widthSpacer,
+    heightSpacer: apiParams.heightSpacer,
+    alphabet: apiParams.alphabet ?? defaultParameters.alphabet,
+    customColor: apiParams.customColor ?? defaultParameters.customColor,
+    convertPDFToImage:
+      apiParams.convertPDFToImage ?? defaultParameters.convertPDFToImage,
+  };
+
+  if (apiParams.opacity !== undefined) {
+    result.opacity = apiParams.opacity * 100;
+  }
+  if (apiParams.watermarkText !== undefined) {
+    result.watermarkText = apiParams.watermarkText;
+  }
+
+  return result;
+};
+
 // Static function that can be used by both the hook and automation executor
 export const buildAddWatermarkFormData = (
   parameters: AddWatermarkParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Required: watermarkType as string
-  formData.append("watermarkType", parameters.watermarkType || "text");
-
-  // Add watermark content based on type
-  if (parameters.watermarkType === "text") {
-    formData.append("watermarkText", parameters.watermarkText);
-  } else if (
-    parameters.watermarkType === "image" &&
-    parameters.watermarkImage
-  ) {
-    formData.append("watermarkImage", parameters.watermarkImage);
-  }
-
-  // Required parameters with correct formatting (defaults merged in automationExecutor)
-  formData.append("fontSize", parameters.fontSize.toString());
-  formData.append("rotation", parameters.rotation.toString());
-  formData.append("opacity", (parameters.opacity / 100).toString()); // Convert percentage to decimal
-  formData.append("widthSpacer", parameters.widthSpacer.toString());
-  formData.append("heightSpacer", parameters.heightSpacer.toString());
-
-  // Backend-expected parameters from user input
-  formData.append("alphabet", parameters.alphabet || "");
-  formData.append("customColor", parameters.customColor || "");
-  formData.append(
-    "convertPDFToImage",
-    (parameters.convertPDFToImage ?? false).toString(),
+): FormData =>
+  objectToFormData(
+    addWatermarkToApiParams(parameters),
+    parameters.watermarkType === "image" && parameters.watermarkImage
+      ? { fileInput: file, watermarkImage: parameters.watermarkImage }
+      : { fileInput: file },
   );
 
-  return formData;
-};
-
 // Static configuration object
 export const addWatermarkOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAddWatermarkFormData,
+  toApiParams: addWatermarkToApiParams,
+  fromApiParams: addWatermarkFromApiParams,
   operationType: "watermark",
-  endpoint: "/api/v1/security/add-watermark",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/adjustPageScale/adjustPageScaleFormData.ts b/frontend/editor/src/core/hooks/tools/adjustPageScale/adjustPageScaleFormData.ts
index 95ee6f3293..e278097508 100644
--- a/frontend/editor/src/core/hooks/tools/adjustPageScale/adjustPageScaleFormData.ts
+++ b/frontend/editor/src/core/hooks/tools/adjustPageScale/adjustPageScaleFormData.ts
@@ -1,13 +1,38 @@
-import { AdjustPageScaleParameters } from "@app/hooks/tools/adjustPageScale/useAdjustPageScaleParameters";
+import {
+  AdjustPageScaleParameters,
+  PageSize,
+} from "@app/hooks/tools/adjustPageScale/useAdjustPageScaleParameters";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
+
+export const ADJUST_PAGE_SCALE_ENDPOINT =
+  "/api/v1/general/scale-pages" satisfies ToolEndpoint;
+type AdjustPageScaleApiParams =
+  ToolApiParams[typeof ADJUST_PAGE_SCALE_ENDPOINT];
+
+export const adjustPageScaleToApiParams = (
+  parameters: AdjustPageScaleParameters,
+): AdjustPageScaleApiParams => ({
+  scaleFactor: parameters.scaleFactor,
+  pageSize: parameters.pageSize,
+  orientation: parameters.orientation,
+});
+
+export const adjustPageScaleFromApiParams = (
+  apiParams: AdjustPageScaleApiParams,
+): Partial<AdjustPageScaleParameters> => ({
+  scaleFactor: apiParams.scaleFactor,
+  pageSize: apiParams.pageSize as PageSize,
+  orientation: apiParams.orientation,
+});
 
 export const buildAdjustPageScaleFormData = (
   parameters: AdjustPageScaleParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("scaleFactor", parameters.scaleFactor.toString());
-  formData.append("pageSize", parameters.pageSize);
-  formData.append("orientation", parameters.orientation);
-  return formData;
-};
+): FormData =>
+  objectToFormData(adjustPageScaleToApiParams(parameters), {
+    fileInput: file,
+  });
diff --git a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.test.ts b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.test.ts
index 264c71c940..7453ecfb3e 100644
--- a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.test.ts
@@ -1,5 +1,9 @@
-import { describe, expect, it } from "vitest";
-import { buildAdjustPageScaleFormData } from "@app/hooks/tools/adjustPageScale/adjustPageScaleFormData";
+import { describe, expect, it, test } from "vitest";
+import {
+  adjustPageScaleFromApiParams,
+  adjustPageScaleToApiParams,
+  buildAdjustPageScaleFormData,
+} from "@app/hooks/tools/adjustPageScale/adjustPageScaleFormData";
 import {
   defaultParameters,
   PageSize,
@@ -49,3 +53,20 @@ describe("buildAdjustPageScaleFormData", () => {
     expect(formData.get("fileInput")).toBe(file);
   });
 });
+
+describe("adjustPageScale mappers", () => {
+  test("round-trips backend params", () => {
+    const api = adjustPageScaleToApiParams({
+      ...defaultParameters,
+      scaleFactor: 1.5,
+      pageSize: PageSize.A4,
+      orientation: "LANDSCAPE",
+    });
+    const roundTripped = adjustPageScaleToApiParams({
+      ...defaultParameters,
+      ...adjustPageScaleFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
index c710737722..c25e12e3a9 100644
--- a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
@@ -8,15 +8,26 @@ import {
   AdjustPageScaleParameters,
   defaultParameters,
 } from "@app/hooks/tools/adjustPageScale/useAdjustPageScaleParameters";
-import { buildAdjustPageScaleFormData } from "@app/hooks/tools/adjustPageScale/adjustPageScaleFormData";
+import {
+  buildAdjustPageScaleFormData,
+  adjustPageScaleToApiParams,
+  adjustPageScaleFromApiParams,
+  ADJUST_PAGE_SCALE_ENDPOINT,
+} from "@app/hooks/tools/adjustPageScale/adjustPageScaleFormData";
 
-export { buildAdjustPageScaleFormData };
+export {
+  buildAdjustPageScaleFormData,
+  adjustPageScaleToApiParams,
+  adjustPageScaleFromApiParams,
+};
 
 export const adjustPageScaleOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAdjustPageScaleFormData,
+  toApiParams: adjustPageScaleToApiParams,
+  fromApiParams: adjustPageScaleFromApiParams,
   operationType: "scalePages",
-  endpoint: "/api/v1/general/scale-pages",
+  endpoint: ADJUST_PAGE_SCALE_ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts b/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
index 26c900df66..faca5b0ae7 100644
--- a/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
@@ -3,40 +3,54 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   AutoRenameParameters,
   defaultParameters,
 } from "@app/hooks/tools/autoRename/useAutoRenameParameters";
 
-export const getFormData = (parameters: AutoRenameParameters) =>
-  Object.entries(parameters).map(([key, value]) => [
-    key,
-    value.toString(),
-  ]) as string[][];
+const ENDPOINT = "/api/v1/misc/auto-rename" satisfies ToolEndpoint;
+type AutoRenameApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the auto-rename request body. The return
+// type is the generated backend model, so a spec change that renames or drops a
+// field breaks the build here.
+export const autoRenameToApiParams = (
+  parameters: AutoRenameParameters,
+): AutoRenameApiParams => ({
+  useFirstTextAsFallback: parameters.useFirstTextAsFallback,
+});
+
+// Reconstruct the tool's UI parameters from an auto-rename request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const autoRenameFromApiParams = (
+  apiParams: AutoRenameApiParams,
+): Partial<AutoRenameParameters> => ({
+  useFirstTextAsFallback:
+    apiParams.useFirstTextAsFallback ??
+    defaultParameters.useFirstTextAsFallback,
+});
 
 // Static function that can be used by both the hook and automation executor
 export const buildAutoRenameFormData = (
   parameters: AutoRenameParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Add all permission parameters
-  getFormData(parameters).forEach(([key, value]) => {
-    formData.append(key, value);
-  });
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(autoRenameToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const autoRenameOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildAutoRenameFormData,
+  toApiParams: autoRenameToApiParams,
+  fromApiParams: autoRenameFromApiParams,
   operationType: "autoRename",
-  endpoint: "/api/v1/misc/auto-rename",
+  endpoint: ENDPOINT,
   preserveBackendFilename: true, // Use filename from backend response headers
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts b/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
index 6da2b66320..f5a213d48c 100644
--- a/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
@@ -3,36 +3,69 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   BookletImpositionParameters,
   defaultParameters,
 } from "@app/hooks/tools/bookletImposition/useBookletImpositionParameters";
 
+const ENDPOINT = "/api/v1/general/booklet-imposition" satisfies ToolEndpoint;
+type BookletImpositionApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the booklet-imposition request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const bookletImpositionToApiParams = (
+  parameters: BookletImpositionParameters,
+): BookletImpositionApiParams => ({
+  pagesPerSheet: parameters.pagesPerSheet,
+  addBorder: parameters.addBorder,
+  spineLocation: parameters.spineLocation,
+  addGutter: parameters.addGutter,
+  gutterSize: parameters.gutterSize,
+  doubleSided: parameters.doubleSided,
+  duplexPass: parameters.duplexPass,
+  flipOnShortEdge: parameters.flipOnShortEdge,
+});
+
+// Reconstruct the tool's UI parameters from a booklet-imposition request body,
+// so a stored or AI-authored step can be re-rendered in the settings UI.
+export const bookletImpositionFromApiParams = (
+  apiParams: BookletImpositionApiParams,
+): Partial<BookletImpositionParameters> => ({
+  pagesPerSheet: apiParams.pagesPerSheet ?? defaultParameters.pagesPerSheet,
+  addBorder: apiParams.addBorder ?? defaultParameters.addBorder,
+  spineLocation: apiParams.spineLocation ?? defaultParameters.spineLocation,
+  addGutter: apiParams.addGutter ?? defaultParameters.addGutter,
+  gutterSize: apiParams.gutterSize ?? defaultParameters.gutterSize,
+  doubleSided: apiParams.doubleSided ?? defaultParameters.doubleSided,
+  duplexPass: apiParams.duplexPass ?? defaultParameters.duplexPass,
+  flipOnShortEdge:
+    apiParams.flipOnShortEdge ?? defaultParameters.flipOnShortEdge,
+});
+
 // Static configuration that can be used by both the hook and automation executor
 export const buildBookletImpositionFormData = (
   parameters: BookletImpositionParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("pagesPerSheet", parameters.pagesPerSheet.toString());
-  formData.append("addBorder", parameters.addBorder.toString());
-  formData.append("spineLocation", parameters.spineLocation);
-  formData.append("addGutter", parameters.addGutter.toString());
-  formData.append("gutterSize", parameters.gutterSize.toString());
-  formData.append("doubleSided", parameters.doubleSided.toString());
-  formData.append("duplexPass", parameters.duplexPass);
-  formData.append("flipOnShortEdge", parameters.flipOnShortEdge.toString());
-  return formData;
-};
+): FormData =>
+  objectToFormData(bookletImpositionToApiParams(parameters), {
+    fileInput: file,
+  });
 
 // Static configuration object
 export const bookletImpositionOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildBookletImpositionFormData,
+  toApiParams: bookletImpositionToApiParams,
+  fromApiParams: bookletImpositionFromApiParams,
   operationType: "bookletImposition",
-  endpoint: "/api/v1/general/booklet-imposition",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts b/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
index 8488dec77a..9f4767044e 100644
--- a/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
@@ -3,86 +3,146 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type FormDataFiles,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   CertSignParameters,
   defaultParameters,
 } from "@app/hooks/tools/certSign/useCertSignParameters";
 
+const ENDPOINT = "/api/v1/security/cert-sign" satisfies ToolEndpoint;
+type CertSignApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the cert-sign request body. The keystore
+// uploads (privateKeyFile, certFile, p12File, jksFile) are actual File uploads
+// and are appended separately (see buildCertSignFormData); only the scalar
+// fields are serialized here.
+export const certSignToApiParams = (
+  parameters: CertSignParameters,
+): CertSignApiParams => {
+  // AUTO mode signs with the server certificate; no keystore/password is sent.
+  if (parameters.signMode === "AUTO") {
+    return withSignatureAppearance({ certType: "SERVER" }, parameters);
+  }
+
+  const apiParams: CertSignApiParams = {
+    certType: parameters.certType as CertSignApiParams["certType"],
+    password: parameters.password,
+  };
+
+  // Non-file identifiers depend on the chosen certificate type.
+  switch (parameters.certType) {
+    case "WINDOWS_STORE":
+      if (parameters.alias) apiParams.alias = parameters.alias;
+      break;
+    case "PKCS11":
+      if (parameters.pkcs11LibraryPath) {
+        apiParams.pkcs11LibraryPath = parameters.pkcs11LibraryPath;
+      }
+      if (parameters.pkcs11Slot != null) {
+        apiParams.pkcs11Slot = parameters.pkcs11Slot;
+      }
+      if (parameters.alias) apiParams.alias = parameters.alias;
+      break;
+  }
+
+  return withSignatureAppearance(apiParams, parameters);
+};
+
+// Signature appearance fields are only sent when the visible signature is
+// enabled, matching the original form behaviour.
+const withSignatureAppearance = (
+  apiParams: CertSignApiParams,
+  parameters: CertSignParameters,
+): CertSignApiParams => {
+  if (parameters.showSignature) {
+    apiParams.showSignature = true;
+    apiParams.reason = parameters.reason;
+    apiParams.location = parameters.location;
+    apiParams.name = parameters.name;
+    apiParams.pageNumber = parameters.pageNumber;
+    apiParams.showLogo = parameters.showLogo;
+  }
+  return apiParams;
+};
+
+// Select the keystore File uploads for the chosen certificate type. AUTO mode
+// (server certificate) uploads no keystore.
+const certSignFiles = (parameters: CertSignParameters): FormDataFiles => {
+  if (parameters.signMode === "AUTO") return {};
+
+  switch (parameters.certType) {
+    case "PEM":
+      return {
+        privateKeyFile: parameters.privateKeyFile,
+        certFile: parameters.certFile,
+      };
+    case "PKCS12":
+    case "PFX":
+      return { p12File: parameters.p12File };
+    case "JKS":
+      return { jksFile: parameters.jksFile };
+    default:
+      return {};
+  }
+};
+
+// Reconstruct the tool's UI parameters from a cert-sign request body, so a stored
+// or AI-authored step can be re-rendered in the settings UI. Uploaded keystore
+// files cannot be recovered from the request model.
+export const certSignFromApiParams = (
+  apiParams: CertSignApiParams,
+): Partial<CertSignParameters> => {
+  const result: Partial<CertSignParameters> = {
+    signMode: apiParams.certType === "SERVER" ? "AUTO" : "MANUAL",
+    showSignature: apiParams.showSignature ?? defaultParameters.showSignature,
+  };
+
+  if (apiParams.certType !== "SERVER") {
+    result.certType = apiParams.certType;
+    result.password = apiParams.password ?? defaultParameters.password;
+  }
+  if (apiParams.alias !== undefined) result.alias = apiParams.alias;
+  if (apiParams.pkcs11LibraryPath !== undefined) {
+    result.pkcs11LibraryPath = apiParams.pkcs11LibraryPath;
+  }
+  if (apiParams.pkcs11Slot !== undefined) {
+    result.pkcs11Slot = apiParams.pkcs11Slot;
+  }
+  if (apiParams.reason !== undefined) result.reason = apiParams.reason;
+  if (apiParams.location !== undefined) result.location = apiParams.location;
+  if (apiParams.name !== undefined) result.name = apiParams.name;
+  if (apiParams.pageNumber !== undefined) {
+    result.pageNumber = apiParams.pageNumber;
+  }
+  if (apiParams.showLogo !== undefined) result.showLogo = apiParams.showLogo;
+
+  return result;
+};
+
 // Build form data for signing
 export const buildCertSignFormData = (
   parameters: CertSignParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Handle sign mode
-  if (parameters.signMode === "AUTO") {
-    formData.append("certType", "SERVER");
-  } else {
-    formData.append("certType", parameters.certType);
-    formData.append("password", parameters.password);
-
-    // Add certificate files based on type (only for manual mode)
-    switch (parameters.certType) {
-      case "PEM":
-        if (parameters.privateKeyFile) {
-          formData.append("privateKeyFile", parameters.privateKeyFile);
-        }
-        if (parameters.certFile) {
-          formData.append("certFile", parameters.certFile);
-        }
-        break;
-      case "PKCS12":
-      case "PFX":
-        if (parameters.p12File) {
-          formData.append("p12File", parameters.p12File);
-        }
-        break;
-      case "JKS":
-        if (parameters.jksFile) {
-          formData.append("jksFile", parameters.jksFile);
-        }
-        break;
-      case "WINDOWS_STORE":
-        if (parameters.alias) {
-          formData.append("alias", parameters.alias);
-        }
-        break;
-      case "PKCS11":
-        if (parameters.pkcs11LibraryPath) {
-          formData.append("pkcs11LibraryPath", parameters.pkcs11LibraryPath);
-        }
-        if (parameters.pkcs11Slot != null) {
-          formData.append("pkcs11Slot", parameters.pkcs11Slot.toString());
-        }
-        if (parameters.alias) {
-          formData.append("alias", parameters.alias);
-        }
-        break;
-    }
-  }
-
-  // Add signature appearance options if enabled
-  if (parameters.showSignature) {
-    formData.append("showSignature", "true");
-    formData.append("reason", parameters.reason);
-    formData.append("location", parameters.location);
-    formData.append("name", parameters.name);
-    formData.append("pageNumber", parameters.pageNumber.toString());
-    formData.append("showLogo", parameters.showLogo.toString());
-  }
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(certSignToApiParams(parameters), {
+    fileInput: file,
+    ...certSignFiles(parameters),
+  });
 
 // Static configuration object
 export const certSignOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildCertSignFormData,
+  toApiParams: certSignToApiParams,
+  fromApiParams: certSignFromApiParams,
   operationType: "certSign",
-  endpoint: "/api/v1/security/cert-sign",
+  endpoint: ENDPOINT,
   multiFileEndpoint: false,
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.test.ts b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.test.ts
index 2be13c3466..bad85097e2 100644
--- a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, test, vi, beforeEach } from "vitest";
 import { renderHook } from "@testing-library/react";
-import { useChangePermissionsOperation } from "@app/hooks/tools/changePermissions/useChangePermissionsOperation";
-import type { ChangePermissionsParameters } from "@app/hooks/tools/changePermissions/useChangePermissionsParameters";
+import {
+  changePermissionsFromApiParams,
+  changePermissionsToApiParams,
+  useChangePermissionsOperation,
+} from "@app/hooks/tools/changePermissions/useChangePermissionsOperation";
+import {
+  type ChangePermissionsParameters,
+  defaultParameters,
+} from "@app/hooks/tools/changePermissions/useChangePermissionsParameters";
 
 // Mock the useToolOperation hook
 vi.mock("../shared/useToolOperation", async () => {
@@ -141,3 +148,26 @@ describe("useChangePermissionsOperation", () => {
     expect(callArgs[property]).toBe(expectedValue);
   });
 });
+
+describe("changePermissions mappers", () => {
+  test("round-trips backend params", () => {
+    const configured: ChangePermissionsParameters = {
+      preventAssembly: true,
+      preventExtractContent: false,
+      preventExtractForAccessibility: true,
+      preventFillInForm: false,
+      preventModify: true,
+      preventModifyAnnotations: false,
+      preventPrinting: true,
+      preventPrintingFaithful: false,
+    };
+
+    const api = changePermissionsToApiParams(configured);
+    const roundTripped = changePermissionsToApiParams({
+      ...defaultParameters,
+      ...changePermissionsFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
index 0500d86417..dd0c532706 100644
--- a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
@@ -3,42 +3,81 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   ChangePermissionsParameters,
   defaultParameters,
 } from "@app/hooks/tools/changePermissions/useChangePermissionsParameters";
 
-export const getFormData = (parameters: ChangePermissionsParameters) => {
-  if (!parameters) return [];
-  return Object.entries(parameters).map(([key, value]) => [
-    key,
-    (value ?? false).toString(),
-  ]) as string[][];
-};
+// Change Permissions reuses the Add Password endpoint but sends only the
+// prevent* subset of the request model (no password or keyLength).
+const ENDPOINT = "/api/v1/security/add-password" satisfies ToolEndpoint;
+type AddPasswordApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the add-password request body. Only the
+// prevent* permission flags are sent; password and keyLength are optional on the
+// model and left unset, so the endpoint changes permissions without encrypting.
+export const changePermissionsToApiParams = (
+  parameters: ChangePermissionsParameters,
+): AddPasswordApiParams => ({
+  preventAssembly: parameters.preventAssembly ?? false,
+  preventExtractContent: parameters.preventExtractContent ?? false,
+  preventExtractForAccessibility:
+    parameters.preventExtractForAccessibility ?? false,
+  preventFillInForm: parameters.preventFillInForm ?? false,
+  preventModify: parameters.preventModify ?? false,
+  preventModifyAnnotations: parameters.preventModifyAnnotations ?? false,
+  preventPrinting: parameters.preventPrinting ?? false,
+  preventPrintingFaithful: parameters.preventPrintingFaithful ?? false,
+});
+
+// Reconstruct the tool's UI parameters from an add-password request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const changePermissionsFromApiParams = (
+  apiParams: AddPasswordApiParams,
+): Partial<ChangePermissionsParameters> => ({
+  preventAssembly:
+    apiParams.preventAssembly ?? defaultParameters.preventAssembly,
+  preventExtractContent:
+    apiParams.preventExtractContent ?? defaultParameters.preventExtractContent,
+  preventExtractForAccessibility:
+    apiParams.preventExtractForAccessibility ??
+    defaultParameters.preventExtractForAccessibility,
+  preventFillInForm:
+    apiParams.preventFillInForm ?? defaultParameters.preventFillInForm,
+  preventModify: apiParams.preventModify ?? defaultParameters.preventModify,
+  preventModifyAnnotations:
+    apiParams.preventModifyAnnotations ??
+    defaultParameters.preventModifyAnnotations,
+  preventPrinting:
+    apiParams.preventPrinting ?? defaultParameters.preventPrinting,
+  preventPrintingFaithful:
+    apiParams.preventPrintingFaithful ??
+    defaultParameters.preventPrintingFaithful,
+});
 
 // Static function that can be used by both the hook and automation executor
 export const buildChangePermissionsFormData = (
   parameters: ChangePermissionsParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Add all permission parameters
-  getFormData(parameters).forEach(([key, value]) => {
-    formData.append(key, value);
+): FormData =>
+  objectToFormData(changePermissionsToApiParams(parameters), {
+    fileInput: file,
   });
 
-  return formData;
-};
-
 // Static configuration object
 export const changePermissionsOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildChangePermissionsFormData,
+  toApiParams: changePermissionsToApiParams,
+  fromApiParams: changePermissionsFromApiParams,
   operationType: "changePermissions",
-  endpoint: "/api/v1/security/add-password", // Change Permissions is a fake endpoint for the Add Password tool
+  endpoint: ENDPOINT, // Change Permissions is a fake endpoint for the Add Password tool
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.test.ts b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.test.ts
new file mode 100644
index 0000000000..4118eaf7d6
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.test.ts
@@ -0,0 +1,127 @@
+import { describe, expect, test } from "vitest";
+import {
+  buildCompressFormData,
+  compressFromApiParams,
+  compressToApiParams,
+} from "@app/hooks/tools/compress/useCompressOperation";
+import {
+  CompressParameters,
+  defaultParameters,
+} from "@app/hooks/tools/compress/useCompressParameters";
+
+const params = (
+  overrides: Partial<CompressParameters>,
+): CompressParameters => ({
+  ...defaultParameters,
+  ...overrides,
+});
+
+describe("compressToApiParams", () => {
+  test("quality mode sends optimizeLevel and no expectedOutputSize", () => {
+    const api = compressToApiParams(
+      params({ compressionMethod: "quality", compressionLevel: 7 }),
+    );
+
+    expect(api.optimizeLevel).toBe(7);
+    expect(api.expectedOutputSize).toBeUndefined();
+  });
+
+  test("file-size mode sends expectedOutputSize (level still present for the spec)", () => {
+    const api = compressToApiParams(
+      params({
+        compressionMethod: "filesize",
+        fileSizeValue: "100",
+        fileSizeUnit: "MB",
+      }),
+    );
+
+    // optimizeLevel is required by the backend model; the backend recomputes it
+    // from the target size, so its presence is harmless.
+    expect(api.optimizeLevel).toBeDefined();
+    expect(api.expectedOutputSize).toBe("100MB");
+  });
+
+  test("omits expectedOutputSize when file-size value is empty", () => {
+    const api = compressToApiParams(
+      params({ compressionMethod: "filesize", fileSizeValue: "" }),
+    );
+
+    expect(api.expectedOutputSize).toBeUndefined();
+  });
+
+  test("line-art thresholds only included when line art is enabled", () => {
+    const off = compressToApiParams(params({ lineArt: false }));
+    expect(off.lineArtThreshold).toBeUndefined();
+    expect(off.lineArtEdgeLevel).toBeUndefined();
+
+    const on = compressToApiParams(
+      params({ lineArt: true, lineArtThreshold: 40, lineArtEdgeLevel: 2 }),
+    );
+    expect(on.lineArtThreshold).toBe(40);
+    expect(on.lineArtEdgeLevel).toBe(2);
+  });
+
+  test("defaults produce the required optimizeLevel field", () => {
+    const api = compressToApiParams(defaultParameters);
+    expect(api.optimizeLevel).toBe(defaultParameters.compressionLevel);
+  });
+});
+
+describe("compressFromApiParams", () => {
+  test("expectedOutputSize maps back to file-size mode and its value/unit", () => {
+    const ui = compressFromApiParams({
+      optimizeLevel: 5,
+      expectedOutputSize: "25KB",
+    });
+
+    expect(ui.compressionMethod).toBe("filesize");
+    expect(ui.fileSizeValue).toBe("25");
+    expect(ui.fileSizeUnit).toBe("KB");
+  });
+
+  test("no expectedOutputSize maps back to quality mode", () => {
+    const ui = compressFromApiParams({ optimizeLevel: 8 });
+
+    expect(ui.compressionMethod).toBe("quality");
+    expect(ui.compressionLevel).toBe(8);
+  });
+});
+
+describe("compress round-trip", () => {
+  test.each<Partial<CompressParameters>>([
+    { compressionMethod: "quality", compressionLevel: 3, grayscale: true },
+    {
+      compressionMethod: "filesize",
+      fileSizeValue: "10",
+      fileSizeUnit: "MB",
+      linearize: true,
+    },
+    {
+      compressionMethod: "quality",
+      lineArt: true,
+      lineArtThreshold: 60,
+      lineArtEdgeLevel: 3,
+    },
+  ])("toApiParams(fromApiParams(x)) reproduces x %o", (overrides) => {
+    const api = compressToApiParams(params(overrides));
+    const roundTripped = compressToApiParams(
+      params(compressFromApiParams(api)),
+    );
+
+    expect(roundTripped).toEqual(api);
+  });
+});
+
+describe("buildCompressFormData", () => {
+  test("appends the file and serialized parameters", () => {
+    const file = new File(["x"], "test.pdf", { type: "application/pdf" });
+    const formData = buildCompressFormData(
+      params({ compressionMethod: "quality", compressionLevel: 6 }),
+      file,
+    );
+
+    expect(formData.get("fileInput")).toBe(file);
+    expect(formData.get("optimizeLevel")).toBe("6");
+    expect(formData.get("grayscale")).toBe("false");
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
index 6efa24e5d3..f62c981879 100644
--- a/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
@@ -3,48 +3,100 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   CompressParameters,
   defaultParameters,
 } from "@app/hooks/tools/compress/useCompressParameters";
 
+const ENDPOINT = "/api/v1/misc/compress-pdf" satisfies ToolEndpoint;
+type CompressApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the compress-pdf request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const compressToApiParams = (
+  parameters: CompressParameters,
+): CompressApiParams => {
+  const apiParams: CompressApiParams = {
+    // compressionLevel is validated to 1-9 by the parameters hook. It is always
+    // sent: in file-size mode the backend recomputes the level from the target
+    // size (autoMode in CompressController), so this value only takes effect in
+    // quality mode.
+    optimizeLevel:
+      parameters.compressionLevel as CompressApiParams["optimizeLevel"],
+    grayscale: parameters.grayscale ?? false,
+    lineArt: parameters.lineArt,
+    linearize: parameters.linearize,
+  };
+
+  if (parameters.compressionMethod === "filesize" && parameters.fileSizeValue) {
+    apiParams.expectedOutputSize = `${parameters.fileSizeValue}${parameters.fileSizeUnit}`;
+  }
+
+  if (parameters.lineArt) {
+    apiParams.lineArtThreshold = parameters.lineArtThreshold;
+    apiParams.lineArtEdgeLevel = parameters.lineArtEdgeLevel;
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from a compress-pdf request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const compressFromApiParams = (
+  apiParams: CompressApiParams,
+): Partial<CompressParameters> => {
+  const result: Partial<CompressParameters> = {
+    compressionLevel: apiParams.optimizeLevel,
+    grayscale: apiParams.grayscale ?? defaultParameters.grayscale,
+    lineArt: apiParams.lineArt ?? defaultParameters.lineArt,
+    linearize: apiParams.linearize ?? defaultParameters.linearize,
+  };
+
+  if (apiParams.lineArtThreshold !== undefined) {
+    result.lineArtThreshold = apiParams.lineArtThreshold;
+  }
+  if (apiParams.lineArtEdgeLevel !== undefined) {
+    result.lineArtEdgeLevel = apiParams.lineArtEdgeLevel;
+  }
+
+  if (apiParams.expectedOutputSize) {
+    result.compressionMethod = "filesize";
+    const match = /^(\d+(?:\.\d+)?)(KB|MB)$/i.exec(
+      apiParams.expectedOutputSize,
+    );
+    if (match) {
+      result.fileSizeValue = match[1];
+      result.fileSizeUnit = match[2].toUpperCase() as "KB" | "MB";
+    }
+  } else {
+    result.compressionMethod = "quality";
+  }
+
+  return result;
+};
+
 // Static configuration that can be used by both the hook and automation executor
 export const buildCompressFormData = (
   parameters: CompressParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  if (parameters.compressionMethod === "quality") {
-    formData.append("optimizeLevel", parameters.compressionLevel.toString());
-  } else {
-    // File size method
-    const fileSize = parameters.fileSizeValue
-      ? `${parameters.fileSizeValue}${parameters.fileSizeUnit}`
-      : "";
-    if (fileSize) {
-      formData.append("expectedOutputSize", fileSize);
-    }
-  }
-
-  formData.append("grayscale", (parameters.grayscale ?? false).toString());
-  formData.append("lineArt", parameters.lineArt.toString());
-  formData.append("linearize", parameters.linearize.toString());
-  if (parameters.lineArt) {
-    formData.append("lineArtThreshold", parameters.lineArtThreshold.toString());
-    formData.append("lineArtEdgeLevel", parameters.lineArtEdgeLevel.toString());
-  }
-  return formData;
-};
+): FormData =>
+  objectToFormData(compressToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const compressOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildCompressFormData,
+  toApiParams: compressToApiParams,
+  fromApiParams: compressFromApiParams,
   operationType: "compress",
-  endpoint: "/api/v1/misc/compress-pdf",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.test.ts b/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.test.ts
new file mode 100644
index 0000000000..eb03607d54
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, test } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+import { useCompressParameters } from "@app/hooks/tools/compress/useCompressParameters";
+
+describe("useCompressParameters", () => {
+  test("defaults (quality mode) validate", () => {
+    const { result } = renderHook(() => useCompressParameters());
+
+    expect(result.current.validateParameters()).toBe(true);
+  });
+
+  test("compressionLevel outside 1-9 is invalid", () => {
+    const { result } = renderHook(() => useCompressParameters());
+
+    act(() => {
+      result.current.updateParameter("compressionLevel", 0);
+    });
+    expect(result.current.validateParameters()).toBe(false);
+
+    act(() => {
+      result.current.updateParameter("compressionLevel", 10);
+    });
+    expect(result.current.validateParameters()).toBe(false);
+  });
+
+  test("filesize mode requires a target size", () => {
+    const { result } = renderHook(() => useCompressParameters());
+
+    // Filesize mode with no size entered must not validate: otherwise the
+    // request omits expectedOutputSize and the backend silently falls back to a
+    // quality compression.
+    act(() => {
+      result.current.updateParameter("compressionMethod", "filesize");
+    });
+    expect(result.current.validateParameters()).toBe(false);
+
+    act(() => {
+      result.current.updateParameter("fileSizeValue", "5");
+    });
+    expect(result.current.validateParameters()).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.ts b/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.ts
index a6e9bfe631..0500b8c77c 100644
--- a/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.ts
+++ b/frontend/editor/src/core/hooks/tools/compress/useCompressParameters.ts
@@ -37,8 +37,15 @@ export const useCompressParameters = (): CompressParametersHook => {
     defaultParameters,
     endpointName: "compress-pdf",
     validateFn: (params) => {
-      // For compression, we only need to validate that compression level is within range
-      return params.compressionLevel >= 1 && params.compressionLevel <= 9;
+      if (params.compressionLevel < 1 || params.compressionLevel > 9) {
+        return false;
+      }
+      // Filesize mode needs a target size; without one the request omits
+      // expectedOutputSize and the backend silently does a quality compression.
+      if (params.compressionMethod === "filesize") {
+        return params.fileSizeValue.trim() !== "";
+      }
+      return true;
     },
   });
 };
diff --git a/frontend/editor/src/core/hooks/tools/crop/useCropOperation.test.ts b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.test.ts
new file mode 100644
index 0000000000..806ad40af0
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, test } from "vitest";
+import {
+  cropFromApiParams,
+  cropToApiParams,
+} from "@app/hooks/tools/crop/useCropOperation";
+import {
+  CropParameters,
+  defaultParameters,
+} from "@app/hooks/tools/crop/useCropParameters";
+
+describe("crop mappers", () => {
+  // With autoCrop on the coordinates aren't sent, so they must not resurface on
+  // the round trip; with autoCrop off the rectangle must survive intact.
+  test.each<{ label: string; overrides: Partial<CropParameters> }>([
+    { label: "autoCrop on", overrides: { autoCrop: true } },
+    {
+      label: "autoCrop off with a rectangle",
+      overrides: {
+        autoCrop: false,
+        cropArea: { x: 10, y: 20, width: 300, height: 400 },
+      },
+    },
+  ])("round-trips backend params ($label)", ({ overrides }) => {
+    const api = cropToApiParams({ ...defaultParameters, ...overrides });
+    const roundTripped = cropToApiParams({
+      ...defaultParameters,
+      ...cropFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
index 67d72c8df0..24dc35daa3 100644
--- a/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
@@ -3,40 +3,69 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   CropParameters,
   defaultParameters,
 } from "@app/hooks/tools/crop/useCropParameters";
+import { DEFAULT_CROP_AREA } from "@app/constants/cropConstants";
+
+const ENDPOINT = "/api/v1/general/crop" satisfies ToolEndpoint;
+type CropApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the crop request body. The return type
+// is the generated backend model, so a spec change that renames or drops a
+// field breaks the build here.
+export const cropToApiParams = (parameters: CropParameters): CropApiParams => {
+  const apiParams: CropApiParams = {
+    autoCrop: parameters.autoCrop,
+  };
+
+  if (!parameters.autoCrop) {
+    const cropArea = parameters.cropArea;
+    apiParams.x = cropArea.x;
+    apiParams.y = cropArea.y;
+    apiParams.width = cropArea.width;
+    apiParams.height = cropArea.height;
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from a crop request body, so a stored or
+// AI-authored step can be re-rendered in the settings UI.
+export const cropFromApiParams = (
+  apiParams: CropApiParams,
+): Partial<CropParameters> => ({
+  autoCrop: apiParams.autoCrop ?? defaultParameters.autoCrop,
+  cropArea: {
+    x: apiParams.x ?? DEFAULT_CROP_AREA.x,
+    y: apiParams.y ?? DEFAULT_CROP_AREA.y,
+    width: apiParams.width ?? DEFAULT_CROP_AREA.width,
+    height: apiParams.height ?? DEFAULT_CROP_AREA.height,
+  },
+});
 
 // Static configuration that can be used by both the hook and automation executor
 export const buildCropFormData = (
   parameters: CropParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  if (!parameters.autoCrop) {
-    const cropArea = parameters.cropArea;
-
-    formData.append("x", cropArea.x.toString());
-    formData.append("y", cropArea.y.toString());
-    formData.append("width", cropArea.width.toString());
-    formData.append("height", cropArea.height.toString());
-  }
-
-  formData.append("autoCrop", parameters.autoCrop.toString());
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(cropToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const cropOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildCropFormData,
+  toApiParams: cropToApiParams,
+  fromApiParams: cropFromApiParams,
   operationType: "crop",
-  endpoint: "/api/v1/general/crop",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.test.ts b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.test.ts
new file mode 100644
index 0000000000..288beed847
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.test.ts
@@ -0,0 +1,46 @@
+import { describe, test, expect } from "vitest";
+import { expectConsole } from "@app/tests/failOnConsole";
+import { editTableOfContentsFromApiParams } from "@app/hooks/tools/editTableOfContents/useEditTableOfContentsOperation";
+
+describe("editTableOfContentsFromApiParams", () => {
+  test("passes replaceExisting through", () => {
+    expect(editTableOfContentsFromApiParams({ replaceExisting: true })).toEqual(
+      {
+        replaceExisting: true,
+      },
+    );
+  });
+
+  test("hydrates a valid (empty) bookmark array", () => {
+    expect(
+      editTableOfContentsFromApiParams({
+        replaceExisting: false,
+        bookmarkData: "[]",
+      }),
+    ).toEqual({ replaceExisting: false, bookmarks: [] });
+  });
+
+  test.each(["", "not json", "{truncated"])(
+    "does not throw on malformed bookmarkData (%j); leaves bookmarks unset",
+    (bookmarkData) => {
+      expectConsole.warn(/could not parse bookmarkData/);
+      const result = editTableOfContentsFromApiParams({
+        replaceExisting: true,
+        bookmarkData,
+      });
+      expect(result).toEqual({ replaceExisting: true });
+      expect(result).not.toHaveProperty("bookmarks");
+    },
+  );
+
+  test.each(["{}", "null", "42"])(
+    "ignores non-array bookmarkData (%j) without throwing",
+    (bookmarkData) => {
+      const result = editTableOfContentsFromApiParams({
+        replaceExisting: false,
+        bookmarkData,
+      });
+      expect(result).not.toHaveProperty("bookmarks");
+    },
+  );
+});
diff --git a/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
index 7f94008503..c395ed0521 100644
--- a/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
@@ -4,30 +4,74 @@ import {
   type ToolOperationConfig,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import { EditTableOfContentsParameters } from "@app/hooks/tools/editTableOfContents/useEditTableOfContentsParameters";
-import { serializeBookmarkNodes } from "@app/utils/editTableOfContents";
+import {
+  hydrateBookmarkPayload,
+  serializeBookmarkNodes,
+  type BookmarkPayload,
+} from "@app/utils/editTableOfContents";
+
+const ENDPOINT =
+  "/api/v1/general/edit-table-of-contents" satisfies ToolEndpoint;
+type EditTableOfContentsApiParams = ToolApiParams[typeof ENDPOINT];
+
+// bookmarkData is a string in the backend model even though it carries JSON, so
+// the serialized bookmark tree is JSON-encoded into that string here.
+export const editTableOfContentsToApiParams = (
+  parameters: EditTableOfContentsParameters,
+): EditTableOfContentsApiParams => ({
+  replaceExisting: parameters.replaceExisting,
+  bookmarkData: JSON.stringify(serializeBookmarkNodes(parameters.bookmarks)),
+});
+
+export const editTableOfContentsFromApiParams = (
+  apiParams: EditTableOfContentsApiParams,
+): Partial<EditTableOfContentsParameters> => {
+  const result: Partial<EditTableOfContentsParameters> = {
+    replaceExisting: apiParams.replaceExisting,
+  };
+
+  // bookmarkData carries JSON in a string field, so a stored step
+  // could hold malformed or non-array content. Degrade to leaving bookmarks unset.
+  if (apiParams.bookmarkData !== undefined) {
+    try {
+      const payload = JSON.parse(apiParams.bookmarkData) as BookmarkPayload[];
+      if (Array.isArray(payload)) {
+        result.bookmarks = hydrateBookmarkPayload(payload);
+      }
+    } catch (error) {
+      console.warn(
+        `editTableOfContents: could not parse bookmarkData; ` +
+          `leaving bookmarks unset. Error: ${error}`,
+      );
+    }
+  }
+
+  return result;
+};
 
 const buildFormData = (
   parameters: EditTableOfContentsParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("replaceExisting", String(parameters.replaceExisting));
-  formData.append(
-    "bookmarkData",
-    JSON.stringify(serializeBookmarkNodes(parameters.bookmarks)),
-  );
-  return formData;
-};
+): FormData =>
+  objectToFormData(editTableOfContentsToApiParams(parameters), {
+    fileInput: file,
+  });
 
 export const editTableOfContentsOperationConfig: ToolOperationConfig<EditTableOfContentsParameters> =
   {
     toolType: ToolType.singleFile,
     operationType: "editTableOfContents",
-    endpoint: "/api/v1/general/edit-table-of-contents",
+    endpoint: ENDPOINT,
     buildFormData,
+    toApiParams: editTableOfContentsToApiParams,
+    fromApiParams: editTableOfContentsFromApiParams,
   };
 
 export const useEditTableOfContentsOperation = () => {
diff --git a/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts b/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
index e52a9d6f2e..4f43ddf3ec 100644
--- a/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
@@ -4,6 +4,11 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   ExtractImagesParameters,
@@ -11,24 +16,38 @@ import {
 } from "@app/hooks/tools/extractImages/useExtractImagesParameters";
 import { useToolResources } from "@app/hooks/tools/shared/useToolResources";
 
+const ENDPOINT = "/api/v1/misc/extract-images" satisfies ToolEndpoint;
+type ExtractImagesApiParams = ToolApiParams[typeof ENDPOINT];
+
+// The frontend param type uses "jpg" while the backend model uses "jpeg"; the
+// wire value is preserved verbatim (as the pre-mapper code did) via the cast.
+export const extractImagesToApiParams = (
+  parameters: ExtractImagesParameters,
+): ExtractImagesApiParams => ({
+  format: parameters.format as ExtractImagesApiParams["format"],
+});
+
+export const extractImagesFromApiParams = (
+  apiParams: ExtractImagesApiParams,
+): Partial<ExtractImagesParameters> => ({
+  format: apiParams.format as ExtractImagesParameters["format"],
+});
+
 // Static configuration that can be used by both the hook and automation executor
 export const buildExtractImagesFormData = (
   parameters: ExtractImagesParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("format", parameters.format);
-  // formData.append("allowDuplicates", parameters.allowDuplicates.toString());
-  return formData;
-};
+): FormData =>
+  objectToFormData(extractImagesToApiParams(parameters), { fileInput: file });
 
 // Static configuration object (without response handler - will be added in hook)
 export const extractImagesOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildExtractImagesFormData,
+  toApiParams: extractImagesToApiParams,
+  fromApiParams: extractImagesFromApiParams,
   operationType: "extractImages",
-  endpoint: "/api/v1/misc/extract-images",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts b/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
index 9138b824ed..7e01678e73 100644
--- a/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
@@ -3,32 +3,69 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   FlattenParameters,
   defaultParameters,
 } from "@app/hooks/tools/flatten/useFlattenParameters";
 
+const ENDPOINT = "/api/v1/misc/flatten" satisfies ToolEndpoint;
+type FlattenApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the flatten request body. The return
+// type is the generated backend model, so a spec change that renames or drops a
+// field breaks the build here.
+export const flattenToApiParams = (
+  parameters: FlattenParameters,
+): FlattenApiParams => {
+  const apiParams: FlattenApiParams = {
+    flattenOnlyForms: parameters.flattenOnlyForms,
+  };
+
+  if (parameters.renderDpi != null) {
+    apiParams.renderDpi = parameters.renderDpi;
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from a flatten request body, so a stored
+// or AI-authored step can be re-rendered in the settings UI.
+export const flattenFromApiParams = (
+  apiParams: FlattenApiParams,
+): Partial<FlattenParameters> => {
+  const result: Partial<FlattenParameters> = {
+    flattenOnlyForms:
+      apiParams.flattenOnlyForms ?? defaultParameters.flattenOnlyForms,
+  };
+
+  if (apiParams.renderDpi != null) {
+    result.renderDpi = apiParams.renderDpi;
+  }
+
+  return result;
+};
+
 // Static function that can be used by both the hook and automation executor
 export const buildFlattenFormData = (
   parameters: FlattenParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("flattenOnlyForms", parameters.flattenOnlyForms.toString());
-  if (parameters.renderDpi != null) {
-    formData.append("renderDpi", parameters.renderDpi.toString());
-  }
-  return formData;
-};
+): FormData =>
+  objectToFormData(flattenToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const flattenOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildFlattenFormData,
+  toApiParams: flattenToApiParams,
+  fromApiParams: flattenFromApiParams,
   operationType: "flatten",
-  endpoint: "/api/v1/misc/flatten",
+  endpoint: ENDPOINT,
   multiFileEndpoint: false,
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.test.ts b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.test.ts
index c637f2fe53..21817ddfcd 100644
--- a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.test.ts
@@ -29,6 +29,10 @@ import {
   ToolOperationHook,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  mergeFromApiParams,
+  mergeToApiParams,
+} from "@app/hooks/tools/merge/useMergeOperation";
 
 describe("useMergeOperation", () => {
   const mockUseToolOperation = vi.mocked(useToolOperation<MergeParameters>);
@@ -128,4 +132,60 @@ describe("useMergeOperation", () => {
     expect(formData2.get("removeCertSign")).toBe("true");
     expect(formData2.get("generateToc")).toBe("true");
   });
+
+  test("should include client file IDs derived from the files", () => {
+    renderHook(() => useMergeOperation());
+
+    const config = getToolConfig();
+    const mockFiles = [
+      new File(["a"], "a.pdf", { type: "application/pdf" }),
+      new File(["b"], "b.pdf", { type: "application/pdf" }),
+    ];
+    const formData = config.buildFormData(
+      { removeDigitalSignature: false, generateTableOfContents: false },
+      mockFiles,
+    );
+
+    expect(formData.get("clientFileIds")).toBe(
+      JSON.stringify(["a.pdf", "b.pdf"]),
+    );
+  });
+});
+
+describe("merge mappers", () => {
+  test("toApiParams renames UI fields to the backend request model", () => {
+    expect(
+      mergeToApiParams({
+        removeDigitalSignature: true,
+        generateTableOfContents: false,
+      }),
+    ).toEqual({
+      sortType: "orderProvided",
+      removeCertSign: true,
+      generateToc: false,
+    });
+  });
+
+  test("fromApiParams maps the backend request model back to UI fields", () => {
+    expect(
+      mergeFromApiParams({ removeCertSign: false, generateToc: true }),
+    ).toEqual({
+      removeDigitalSignature: false,
+      generateTableOfContents: true,
+    });
+  });
+
+  test("round-trips backend params", () => {
+    const api = mergeToApiParams({
+      removeDigitalSignature: true,
+      generateTableOfContents: true,
+    });
+    const roundTripped = mergeToApiParams({
+      removeDigitalSignature: false,
+      generateTableOfContents: false,
+      ...mergeFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
 });
diff --git a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
index 44cee9e134..9b43f35fcd 100644
--- a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
@@ -4,36 +4,54 @@ import {
   ToolOperationConfig,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   MergeParameters,
   defaultParameters,
 } from "@app/hooks/tools/merge/useMergeParameters";
 
+const ENDPOINT = "/api/v1/general/merge-pdfs" satisfies ToolEndpoint;
+type MergeApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the merge-pdfs request body. File-derived
+// fields (clientFileIds) are appended by buildFormData, not here.
+export const mergeToApiParams = (
+  parameters: MergeParameters,
+): MergeApiParams => ({
+  // The UI owns file ordering, so the backend is always told to keep it.
+  sortType: "orderProvided",
+  removeCertSign: parameters.removeDigitalSignature ?? false,
+  generateToc: parameters.generateTableOfContents ?? false,
+});
+
+// Reconstruct the tool's UI parameters from a merge-pdfs request body.
+export const mergeFromApiParams = (
+  apiParams: MergeApiParams,
+): Partial<MergeParameters> => ({
+  removeDigitalSignature:
+    apiParams.removeCertSign ?? defaultParameters.removeDigitalSignature,
+  generateTableOfContents:
+    apiParams.generateToc ?? defaultParameters.generateTableOfContents,
+});
+
 const buildFormData = (
   parameters: MergeParameters,
   files: File[],
 ): FormData => {
-  const formData = new FormData();
-
-  files.forEach((file) => {
-    formData.append("fileInput", file);
+  const formData = objectToFormData(mergeToApiParams(parameters), {
+    fileInput: files,
   });
-  // Provide stable client file IDs (align with files order)
+  // Stable client file IDs, aligned with the fileInput order. Derived from the
+  // files themselves, so it belongs to the file-appending step.
   const clientIds: string[] = files.map((f) =>
     String((f as { fileId?: string }).fileId || f.name),
   );
   formData.append("clientFileIds", JSON.stringify(clientIds));
-  formData.append("sortType", "orderProvided"); // Always use orderProvided since UI handles sorting
-  formData.append(
-    "removeCertSign",
-    (parameters.removeDigitalSignature ?? false).toString(),
-  );
-  formData.append(
-    "generateToc",
-    (parameters.generateTableOfContents ?? false).toString(),
-  );
-
   return formData;
 };
 
@@ -41,8 +59,10 @@ const buildFormData = (
 export const mergeOperationConfig: ToolOperationConfig<MergeParameters> = {
   toolType: ToolType.multiFile,
   buildFormData,
+  toApiParams: mergeToApiParams,
+  fromApiParams: mergeFromApiParams,
   operationType: "merge",
-  endpoint: "/api/v1/general/merge-pdfs",
+  endpoint: ENDPOINT,
   filePrefix: "merged_",
   defaultParameters,
 };
diff --git a/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts b/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
index b7d6d56564..e9b1e92b2d 100644
--- a/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
+++ b/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
@@ -9,9 +9,17 @@ import {
   ToolOperationConfig,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import { useToolResources } from "@app/hooks/tools/shared/useToolResources";
 
+const ENDPOINT = "/api/v1/misc/ocr-pdf" satisfies ToolEndpoint;
+type OCRApiParams = ToolApiParams[typeof ENDPOINT];
+
 // Helper: get MIME type based on file extension
 function getMimeType(filename: string): string {
   const ext = filename.toLowerCase().split(".").pop();
@@ -48,28 +56,49 @@ function stripExt(name: string): string {
   return i > 0 ? name.slice(0, i) : name;
 }
 
+// Convert the tool's UI parameters into the ocr-pdf request body. The return
+// type is the generated backend model, so a spec change that renames or drops a
+// field breaks the build here.
+export const ocrToApiParams = (parameters: OCRParameters): OCRApiParams => {
+  const options = parameters.additionalOptions || [];
+  return {
+    languages: parameters.languages,
+    ocrType: parameters.ocrType as OCRApiParams["ocrType"],
+    ocrRenderType: parameters.ocrRenderType as OCRApiParams["ocrRenderType"],
+    sidecar: options.includes("sidecar"),
+    deskew: options.includes("deskew"),
+    clean: options.includes("clean"),
+    cleanFinal: options.includes("cleanFinal"),
+    removeImagesAfter: options.includes("removeImagesAfter"),
+  };
+};
+
+// Reconstruct the tool's UI parameters from an ocr-pdf request body, so a stored
+// or AI-authored step can be re-rendered in the settings UI.
+export const ocrFromApiParams = (
+  apiParams: OCRApiParams,
+): Partial<OCRParameters> => {
+  const additionalOptions: string[] = [];
+  if (apiParams.sidecar) additionalOptions.push("sidecar");
+  if (apiParams.deskew) additionalOptions.push("deskew");
+  if (apiParams.clean) additionalOptions.push("clean");
+  if (apiParams.cleanFinal) additionalOptions.push("cleanFinal");
+  if (apiParams.removeImagesAfter) additionalOptions.push("removeImagesAfter");
+
+  return {
+    languages: apiParams.languages ?? defaultParameters.languages,
+    ocrType: apiParams.ocrType,
+    ocrRenderType: apiParams.ocrRenderType ?? defaultParameters.ocrRenderType,
+    additionalOptions,
+  };
+};
+
 // Static function that can be used by both the hook and automation executor
 export const buildOCRFormData = (
   parameters: OCRParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  parameters.languages.forEach((lang) => formData.append("languages", lang));
-  formData.append("ocrType", parameters.ocrType);
-  formData.append("ocrRenderType", parameters.ocrRenderType);
-
-  const options = parameters.additionalOptions || [];
-  formData.append("sidecar", options.includes("sidecar").toString());
-  formData.append("deskew", options.includes("deskew").toString());
-  formData.append("clean", options.includes("clean").toString());
-  formData.append("cleanFinal", options.includes("cleanFinal").toString());
-  formData.append(
-    "removeImagesAfter",
-    options.includes("removeImagesAfter").toString(),
-  );
-  return formData;
-};
+): FormData =>
+  objectToFormData(ocrToApiParams(parameters), { fileInput: file });
 
 // Static response handler for OCR - can be used by automation executor
 export const ocrResponseHandler = async (
@@ -125,8 +154,10 @@ export const ocrResponseHandler = async (
 export const ocrOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildOCRFormData,
+  toApiParams: ocrToApiParams,
+  fromApiParams: ocrFromApiParams,
   operationType: "ocr",
-  endpoint: "/api/v1/misc/ocr-pdf",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts b/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
index 02b72e9e1d..448d70346d 100644
--- a/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
@@ -4,41 +4,69 @@ import {
   ToolType,
   type ToolOperationConfig,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
-import { type OverlayPdfsParameters } from "@app/hooks/tools/overlayPdfs/useOverlayPdfsParameters";
+import {
+  type OverlayPdfsParameters,
+  defaultParameters,
+} from "@app/hooks/tools/overlayPdfs/useOverlayPdfsParameters";
+
+const ENDPOINT = "/api/v1/general/overlay-pdfs" satisfies ToolEndpoint;
+type OverlayPdfsApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the overlay-pdfs request body. The
+// overlay documents are actual File uploads sent as repeated `overlayFiles`
+// fields (see buildFormData), so `overlayFiles` here is an empty array: the real
+// uploads are appended separately and an empty array serializes to no fields.
+export const overlayPdfsToApiParams = (
+  parameters: OverlayPdfsParameters,
+): OverlayPdfsApiParams => {
+  const apiParams: OverlayPdfsApiParams = {
+    overlayFiles: [],
+    overlayMode: parameters.overlayMode,
+    overlayPosition: parameters.overlayPosition,
+  };
+
+  // Counts are only relevant for FixedRepeatOverlay; the server accepts repeated
+  // 'counts' fields.
+  if (parameters.overlayMode === "FixedRepeatOverlay") {
+    apiParams.counts = parameters.counts || [];
+  }
+
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from an overlay-pdfs request body. The
+// overlay File uploads cannot be recovered from the request model.
+export const overlayPdfsFromApiParams = (
+  apiParams: OverlayPdfsApiParams,
+): Partial<OverlayPdfsParameters> => ({
+  overlayMode: apiParams.overlayMode,
+  overlayPosition: apiParams.overlayPosition,
+  counts: apiParams.counts ?? defaultParameters.counts,
+});
 
 const buildFormData = (
   parameters: OverlayPdfsParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Overlay files
-  for (const overlay of parameters.overlayFiles || []) {
-    formData.append("overlayFiles", overlay);
-  }
-
-  // Mode and position
-  formData.append("overlayMode", parameters.overlayMode);
-  formData.append("overlayPosition", String(parameters.overlayPosition));
-
-  // Counts (only relevant for FixedRepeatOverlay, server accepts repeated 'counts' fields)
-  if (parameters.overlayMode === "FixedRepeatOverlay") {
-    for (const count of parameters.counts || []) {
-      formData.append("counts", String(count));
-    }
-  }
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(overlayPdfsToApiParams(parameters), {
+    fileInput: file,
+    overlayFiles: parameters.overlayFiles || [],
+  });
 
 export const overlayPdfsOperationConfig: ToolOperationConfig<OverlayPdfsParameters> =
   {
     toolType: ToolType.singleFile,
     buildFormData,
+    toApiParams: overlayPdfsToApiParams,
+    fromApiParams: overlayPdfsFromApiParams,
     operationType: "overlayPdfs",
-    endpoint: "/api/v1/general/overlay-pdfs",
+    endpoint: ENDPOINT,
   };
 
 export const useOverlayPdfsOperation = () => {
diff --git a/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.test.ts b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.test.ts
new file mode 100644
index 0000000000..874fdff811
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, test } from "vitest";
+import {
+  pageLayoutFromApiParams,
+  pageLayoutToApiParams,
+} from "@app/hooks/tools/pageLayout/usePageLayoutOperation";
+import {
+  PageLayoutParameters,
+  defaultParameters,
+} from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+describe("pageLayout mappers", () => {
+  test.each<Partial<PageLayoutParameters>>([
+    {},
+    { addBorder: true, borderWidth: 3, innerMargin: 5, topMargin: 2 },
+  ])("round-trips backend params for %o", (overrides) => {
+    const api = pageLayoutToApiParams({ ...defaultParameters, ...overrides });
+    const roundTripped = pageLayoutToApiParams({
+      ...defaultParameters,
+      ...pageLayoutFromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
index b168f15f6f..dce2101cd4 100644
--- a/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
@@ -3,40 +3,77 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   PageLayoutParameters,
   defaultParameters,
 } from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
 
+const ENDPOINT = "/api/v1/general/multi-page-layout" satisfies ToolEndpoint;
+type PageLayoutApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the multi-page-layout request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const pageLayoutToApiParams = (
+  parameters: PageLayoutParameters,
+): PageLayoutApiParams => ({
+  mode: parameters.mode,
+  pagesPerSheet:
+    parameters.pagesPerSheet as PageLayoutApiParams["pagesPerSheet"],
+  rows: parameters.rows,
+  cols: parameters.cols,
+  orientation: parameters.orientation,
+  arrangement: parameters.arrangement,
+  readingDirection: parameters.readingDirection,
+  innerMargin: parameters.innerMargin ?? 0,
+  topMargin: parameters.topMargin ?? 0,
+  bottomMargin: parameters.bottomMargin ?? 0,
+  leftMargin: parameters.leftMargin ?? 0,
+  rightMargin: parameters.rightMargin ?? 0,
+  addBorder: parameters.addBorder,
+  borderWidth: parameters.borderWidth ?? 1,
+});
+
+// Reconstruct the tool's UI parameters from a multi-page-layout request body, so
+// a stored or AI-authored step can be re-rendered in the settings UI.
+export const pageLayoutFromApiParams = (
+  apiParams: PageLayoutApiParams,
+): Partial<PageLayoutParameters> => ({
+  mode: apiParams.mode,
+  pagesPerSheet: apiParams.pagesPerSheet,
+  rows: apiParams.rows,
+  cols: apiParams.cols,
+  orientation: apiParams.orientation,
+  arrangement: apiParams.arrangement,
+  readingDirection: apiParams.readingDirection,
+  innerMargin: apiParams.innerMargin,
+  topMargin: apiParams.topMargin,
+  bottomMargin: apiParams.bottomMargin,
+  leftMargin: apiParams.leftMargin,
+  rightMargin: apiParams.rightMargin,
+  addBorder: apiParams.addBorder,
+  borderWidth: apiParams.borderWidth,
+});
+
 export const buildPageLayoutFormData = (
   parameters: PageLayoutParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("mode", String(parameters.mode));
-  formData.append("pagesPerSheet", String(parameters.pagesPerSheet));
-  formData.append("rows", String(parameters.rows));
-  formData.append("cols", String(parameters.cols));
-  formData.append("orientation", String(parameters.orientation));
-  formData.append("arrangement", String(parameters.arrangement));
-  formData.append("readingDirection", String(parameters.readingDirection));
-  formData.append("innerMargin", String(parameters.innerMargin ?? 0));
-  formData.append("topMargin", String(parameters.topMargin ?? 0));
-  formData.append("bottomMargin", String(parameters.bottomMargin ?? 0));
-  formData.append("leftMargin", String(parameters.leftMargin ?? 0));
-  formData.append("rightMargin", String(parameters.rightMargin ?? 0));
-  formData.append("addBorder", String(parameters.addBorder));
-  formData.append("borderWidth", String(parameters.borderWidth ?? 1));
-  return formData;
-};
+): FormData =>
+  objectToFormData(pageLayoutToApiParams(parameters), { fileInput: file });
 
 export const pageLayoutOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildPageLayoutFormData,
+  toApiParams: pageLayoutToApiParams,
+  fromApiParams: pageLayoutFromApiParams,
   operationType: "pageLayout",
-  endpoint: "/api/v1/general/multi-page-layout",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
index bc4db5b6c3..c7cefe1f43 100644
--- a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
@@ -3,52 +3,75 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RedactParameters,
   defaultParameters,
 } from "@app/hooks/tools/redact/useRedactParameters";
 
+// Automatic redaction is the only mode that calls the backend; manual redaction
+// is handled client-side by EmbedPDF in the viewer.
+const AUTO_ENDPOINT = "/api/v1/security/auto-redact" satisfies ToolEndpoint;
+type RedactApiParams = ToolApiParams[typeof AUTO_ENDPOINT];
+
+// Convert the tool's UI parameters into the auto-redact request body.
+export const redactToApiParams = (
+  parameters: RedactParameters,
+): RedactApiParams => ({
+  // The backend takes the search terms as a single newline-separated string.
+  listOfText: parameters.wordsToRedact.join("\n"),
+  useRegex: parameters.useRegex,
+  wholeWordSearch: parameters.wholeWordSearch,
+  // The backend expects the hex colour without the leading '#'.
+  redactColor: parameters.redactColor.replace("#", ""),
+  customPadding: parameters.customPadding,
+  convertPDFToImage: parameters.convertPDFToImage,
+});
+
+// Reconstruct the tool's UI parameters from an auto-redact request body.
+export const redactFromApiParams = (
+  apiParams: RedactApiParams,
+): Partial<RedactParameters> => ({
+  mode: "automatic",
+  wordsToRedact: apiParams.listOfText ? apiParams.listOfText.split("\n") : [],
+  useRegex: apiParams.useRegex ?? defaultParameters.useRegex,
+  wholeWordSearch:
+    apiParams.wholeWordSearch ?? defaultParameters.wholeWordSearch,
+  redactColor: apiParams.redactColor
+    ? `#${apiParams.redactColor}`
+    : defaultParameters.redactColor,
+  customPadding: apiParams.customPadding,
+  convertPDFToImage:
+    apiParams.convertPDFToImage ?? defaultParameters.convertPDFToImage,
+});
+
 // Static configuration that can be used by both the hook and automation executor
 export const buildRedactFormData = (
   parameters: RedactParameters,
   file: File,
 ): FormData => {
-  const formData = new FormData();
-
-  // For automatic mode we hit the backend and need full payload
-  if (parameters.mode === "automatic") {
-    formData.append("fileInput", file);
-    // Convert array to newline-separated string as expected by backend
-    formData.append("listOfText", parameters.wordsToRedact.join("\n"));
-    formData.append("useRegex", parameters.useRegex.toString());
-    formData.append("wholeWordSearch", parameters.wholeWordSearch.toString());
-    formData.append("redactColor", parameters.redactColor.replace("#", ""));
-    formData.append("customPadding", parameters.customPadding.toString());
-    formData.append(
-      "convertPDFToImage",
-      parameters.convertPDFToImage.toString(),
-    );
-  } else {
-    // Manual redaction uses EmbedPDF in-viewer; we don't call the API.
-    // Return an empty formData to satisfy shared interfaces without throwing.
+  // Manual redaction uses EmbedPDF in-viewer and makes no API call; return an
+  // empty payload to satisfy the shared interface without throwing.
+  if (parameters.mode !== "automatic") {
+    return new FormData();
   }
-
-  return formData;
+  return objectToFormData(redactToApiParams(parameters), { fileInput: file });
 };
 
 // Static configuration object
 export const redactOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRedactFormData,
+  toApiParams: redactToApiParams,
+  fromApiParams: redactFromApiParams,
   operationType: "redact",
-  endpoint: (parameters: RedactParameters) => {
-    if (parameters.mode === "automatic") {
-      return "/api/v1/security/auto-redact";
-    }
-    // Manual redaction is handled by EmbedPDF in the viewer; no endpoint call.
-    return "";
-  },
+  endpoint: (parameters: RedactParameters) =>
+    parameters.mode === "automatic" ? AUTO_ENDPOINT : null,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts b/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
index 5f24a28dd8..2cde7832e4 100644
--- a/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
@@ -5,6 +5,11 @@ import {
   useToolOperation,
   ToolOperationConfig,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RemoveBlanksParameters,
@@ -12,23 +17,37 @@ import {
 } from "@app/hooks/tools/removeBlanks/useRemoveBlanksParameters";
 import { useToolResources } from "@app/hooks/tools/shared/useToolResources";
 
+const ENDPOINT = "/api/v1/misc/remove-blanks" satisfies ToolEndpoint;
+type RemoveBlanksApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Note: includeBlankPages is not sent to backend as it always returns both files in a ZIP
+export const removeBlanksToApiParams = (
+  parameters: RemoveBlanksParameters,
+): RemoveBlanksApiParams => ({
+  threshold: parameters.threshold,
+  whitePercent: parameters.whitePercent,
+});
+
+export const removeBlanksFromApiParams = (
+  apiParams: RemoveBlanksApiParams,
+): Partial<RemoveBlanksParameters> => ({
+  threshold: apiParams.threshold,
+  whitePercent: apiParams.whitePercent,
+});
+
 export const buildRemoveBlanksFormData = (
   parameters: RemoveBlanksParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("threshold", String(parameters.threshold));
-  formData.append("whitePercent", String(parameters.whitePercent));
-  // Note: includeBlankPages is not sent to backend as it always returns both files in a ZIP
-  return formData;
-};
+): FormData =>
+  objectToFormData(removeBlanksToApiParams(parameters), { fileInput: file });
 
 export const removeBlanksOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRemoveBlanksFormData,
+  toApiParams: removeBlanksToApiParams,
+  fromApiParams: removeBlanksFromApiParams,
   operationType: "removeBlanks",
-  endpoint: "/api/v1/misc/remove-blanks",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const satisfies ToolOperationConfig<RemoveBlanksParameters>;
 
diff --git a/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts b/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
index 1d6604f0ef..55d053fe09 100644
--- a/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
@@ -3,28 +3,35 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  fileOnlyMapping,
+  objectToFormData,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RemoveCertificateSignParameters,
   defaultParameters,
 } from "@app/hooks/tools/removeCertificateSign/useRemoveCertificateSignParameters";
 
-// Static function that can be used by both the hook and automation executor
+const ENDPOINT = "/api/v1/security/remove-cert-sign" satisfies ToolEndpoint;
+
+// Removing certificate signatures takes only a file; no parameters to map.
+const { toApiParams, fromApiParams } = fileOnlyMapping();
+
 export const buildRemoveCertificateSignFormData = (
   _parameters: RemoveCertificateSignParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  return formData;
-};
+): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
 export const removeCertificateSignOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRemoveCertificateSignFormData,
+  toApiParams,
+  fromApiParams,
   operationType: "removeCertSign",
-  endpoint: "/api/v1/security/remove-cert-sign",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts b/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
index 3441623cf6..2ba770c822 100644
--- a/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
@@ -4,24 +4,32 @@ import {
   ToolOperationConfig,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  fileOnlyMapping,
+  objectToFormData,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import type { RemoveImageParameters } from "@app/hooks/tools/removeImage/useRemoveImageParameters";
 
+const ENDPOINT = "/api/v1/general/remove-image-pdf" satisfies ToolEndpoint;
+
+// Remove-image takes only a file; there are no request parameters to map.
+const { toApiParams, fromApiParams } = fileOnlyMapping();
+
 export const buildRemoveImageFormData = (
   _params: RemoveImageParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  return formData;
-};
+): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 export const removeImageOperationConfig: ToolOperationConfig<RemoveImageParameters> =
   {
     toolType: ToolType.singleFile,
     buildFormData: buildRemoveImageFormData,
+    toApiParams,
+    fromApiParams,
     operationType: "removeImage",
-    endpoint: "/api/v1/general/remove-image-pdf",
+    endpoint: ENDPOINT,
   };
 
 export const useRemoveImageOperation = () => {
diff --git a/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts b/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
index 9ff5e6fb62..8d8f14f3b4 100644
--- a/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
@@ -4,6 +4,11 @@ import {
   useToolOperation,
   ToolOperationConfig,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RemovePagesParameters,
@@ -11,22 +16,39 @@ import {
 } from "@app/hooks/tools/removePages/useRemovePagesParameters";
 // import { useToolResources } from '@app/hooks/tools/shared/useToolResources';
 
+const ENDPOINT = "/api/v1/general/remove-pages" satisfies ToolEndpoint;
+type RemovePagesApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the remove-pages request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const removePagesToApiParams = (
+  parameters: RemovePagesParameters,
+): RemovePagesApiParams => ({
+  pageNumbers: parameters.pageNumbers.replace(/\s+/g, ""),
+});
+
+// Reconstruct the tool's UI parameters from a remove-pages request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const removePagesFromApiParams = (
+  apiParams: RemovePagesApiParams,
+): Partial<RemovePagesParameters> => ({
+  pageNumbers: apiParams.pageNumbers ?? defaultParameters.pageNumbers,
+});
+
 export const buildRemovePagesFormData = (
   parameters: RemovePagesParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  const cleaned = parameters.pageNumbers.replace(/\s+/g, "");
-  formData.append("pageNumbers", cleaned);
-  return formData;
-};
+): FormData =>
+  objectToFormData(removePagesToApiParams(parameters), { fileInput: file });
 
 export const removePagesOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRemovePagesFormData,
+  toApiParams: removePagesToApiParams,
+  fromApiParams: removePagesFromApiParams,
   operationType: "removePages",
-  endpoint: "/api/v1/general/remove-pages",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const satisfies ToolOperationConfig<RemovePagesParameters>;
 
diff --git a/frontend/editor/src/core/hooks/tools/removePassword/buildRemovePasswordFormData.ts b/frontend/editor/src/core/hooks/tools/removePassword/buildRemovePasswordFormData.ts
index 8f04c4806f..c55040c7f2 100644
--- a/frontend/editor/src/core/hooks/tools/removePassword/buildRemovePasswordFormData.ts
+++ b/frontend/editor/src/core/hooks/tools/removePassword/buildRemovePasswordFormData.ts
@@ -1,4 +1,35 @@
-import { RemovePasswordParameters } from "@app/hooks/tools/removePassword/useRemovePasswordParameters";
+import {
+  RemovePasswordParameters,
+  defaultParameters,
+} from "@app/hooks/tools/removePassword/useRemovePasswordParameters";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
+
+// Defined here (not in the operation config) so both the mappers and the config
+// share one endpoint constant without a circular import via FileContext.
+export const REMOVE_PASSWORD_ENDPOINT =
+  "/api/v1/security/remove-password" satisfies ToolEndpoint;
+type RemovePasswordApiParams = ToolApiParams[typeof REMOVE_PASSWORD_ENDPOINT];
+
+// Convert the tool's UI parameters into the remove-password request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const removePasswordToApiParams = (
+  parameters: RemovePasswordParameters,
+): RemovePasswordApiParams => ({
+  password: parameters.password,
+});
+
+// Reconstruct the tool's UI parameters from a remove-password request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const removePasswordFromApiParams = (
+  apiParams: RemovePasswordApiParams,
+): Partial<RemovePasswordParameters> => ({
+  password: apiParams.password ?? defaultParameters.password,
+});
 
 /**
  * Builds FormData for remove password API request.
@@ -7,9 +38,5 @@ import { RemovePasswordParameters } from "@app/hooks/tools/removePassword/useRem
 export const buildRemovePasswordFormData = (
   parameters: RemovePasswordParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("password", parameters.password);
-  return formData;
-};
+): FormData =>
+  objectToFormData(removePasswordToApiParams(parameters), { fileInput: file });
diff --git a/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts b/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
index aa71a5befb..2d516b861b 100644
--- a/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
@@ -8,7 +8,12 @@ import {
   RemovePasswordParameters,
   defaultParameters,
 } from "@app/hooks/tools/removePassword/useRemovePasswordParameters";
-import { buildRemovePasswordFormData } from "@app/hooks/tools/removePassword/buildRemovePasswordFormData";
+import {
+  buildRemovePasswordFormData,
+  removePasswordToApiParams,
+  removePasswordFromApiParams,
+  REMOVE_PASSWORD_ENDPOINT,
+} from "@app/hooks/tools/removePassword/buildRemovePasswordFormData";
 
 // Re-export for backwards compatibility with any other imports
 export { buildRemovePasswordFormData };
@@ -17,8 +22,10 @@ export { buildRemovePasswordFormData };
 export const removePasswordOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRemovePasswordFormData,
+  toApiParams: removePasswordToApiParams,
+  fromApiParams: removePasswordFromApiParams,
   operationType: "removePassword",
-  endpoint: "/api/v1/security/remove-password",
+  endpoint: REMOVE_PASSWORD_ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts b/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
index de5aaf5c53..2bdb75f31c 100644
--- a/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
@@ -4,31 +4,64 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
-import { ReorganizePagesParameters } from "@app/hooks/tools/reorganizePages/useReorganizePagesParameters";
+import {
+  ReorganizePagesParameters,
+  defaultReorganizePagesParameters,
+} from "@app/hooks/tools/reorganizePages/useReorganizePagesParameters";
+
+const ENDPOINT = "/api/v1/general/rearrange-pages" satisfies ToolEndpoint;
+type ReorganizePagesApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the rearrange-pages request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const reorganizePagesToApiParams = (
+  parameters: ReorganizePagesParameters,
+): ReorganizePagesApiParams => {
+  const apiParams: ReorganizePagesApiParams = {};
+  if (parameters.customMode) {
+    apiParams.customMode =
+      parameters.customMode as ReorganizePagesApiParams["customMode"];
+  }
+  if (parameters.pageNumbers) {
+    apiParams.pageNumbers = parameters.pageNumbers.replace(/\s+/g, "");
+  }
+  return apiParams;
+};
+
+// Reconstruct the tool's UI parameters from a rearrange-pages request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const reorganizePagesFromApiParams = (
+  apiParams: ReorganizePagesApiParams,
+): Partial<ReorganizePagesParameters> => ({
+  customMode:
+    apiParams.customMode ?? defaultReorganizePagesParameters.customMode,
+  pageNumbers:
+    apiParams.pageNumbers ?? defaultReorganizePagesParameters.pageNumbers,
+});
 
 const buildFormData = (
   parameters: ReorganizePagesParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  if (parameters.customMode) {
-    formData.append("customMode", parameters.customMode);
-  }
-  if (parameters.pageNumbers) {
-    const cleaned = parameters.pageNumbers.replace(/\s+/g, "");
-    formData.append("pageNumbers", cleaned);
-  }
-  return formData;
-};
+): FormData =>
+  objectToFormData(reorganizePagesToApiParams(parameters), {
+    fileInput: file,
+  });
 
 export const reorganizePagesOperationConfig: ToolOperationConfig<ReorganizePagesParameters> =
   {
     toolType: ToolType.singleFile,
     buildFormData,
+    toApiParams: reorganizePagesToApiParams,
+    fromApiParams: reorganizePagesFromApiParams,
     operationType: "reorganizePages",
-    endpoint: "/api/v1/general/rearrange-pages",
+    endpoint: ENDPOINT,
   };
 
 export const useReorganizePagesOperation = () => {
diff --git a/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts b/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
index a62f448bac..ef60151d07 100644
--- a/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
@@ -3,28 +3,35 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  fileOnlyMapping,
+  objectToFormData,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RepairParameters,
   defaultParameters,
 } from "@app/hooks/tools/repair/useRepairParameters";
 
-// Static function that can be used by both the hook and automation executor
+const ENDPOINT = "/api/v1/misc/repair" satisfies ToolEndpoint;
+
+// Repair takes only a file; there are no request parameters to map.
+const { toApiParams, fromApiParams } = fileOnlyMapping();
+
 export const buildRepairFormData = (
   _parameters: RepairParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  return formData;
-};
+): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
 export const repairOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRepairFormData,
+  toApiParams,
+  fromApiParams,
   operationType: "repair",
-  endpoint: "/api/v1/misc/repair",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts b/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
index dd24c10e22..94bbc32d9e 100644
--- a/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
@@ -3,39 +3,72 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   ReplaceColorParameters,
   defaultParameters,
 } from "@app/hooks/tools/replaceColor/useReplaceColorParameters";
 
+const ENDPOINT = "/api/v1/misc/replace-invert-pdf" satisfies ToolEndpoint;
+type ReplaceColorApiParams = ToolApiParams[typeof ENDPOINT];
+
+export const replaceColorToApiParams = (
+  parameters: ReplaceColorParameters,
+): ReplaceColorApiParams => {
+  const apiParams: ReplaceColorApiParams = {
+    replaceAndInvertOption: parameters.replaceAndInvertOption,
+  };
+
+  if (parameters.replaceAndInvertOption === "HIGH_CONTRAST_COLOR") {
+    apiParams.highContrastColorCombination =
+      parameters.highContrastColorCombination;
+  } else if (parameters.replaceAndInvertOption === "CUSTOM_COLOR") {
+    apiParams.textColor = parameters.textColor;
+    apiParams.backGroundColor = parameters.backGroundColor;
+  }
+
+  return apiParams;
+};
+
+export const replaceColorFromApiParams = (
+  apiParams: ReplaceColorApiParams,
+): Partial<ReplaceColorParameters> => {
+  const result: Partial<ReplaceColorParameters> = {
+    replaceAndInvertOption: apiParams.replaceAndInvertOption,
+  };
+
+  if (apiParams.highContrastColorCombination !== undefined) {
+    result.highContrastColorCombination =
+      apiParams.highContrastColorCombination;
+  }
+  if (apiParams.textColor !== undefined) {
+    result.textColor = apiParams.textColor;
+  }
+  if (apiParams.backGroundColor !== undefined) {
+    result.backGroundColor = apiParams.backGroundColor;
+  }
+
+  return result;
+};
+
 export const buildReplaceColorFormData = (
   parameters: ReplaceColorParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  formData.append("replaceAndInvertOption", parameters.replaceAndInvertOption);
-
-  if (parameters.replaceAndInvertOption === "HIGH_CONTRAST_COLOR") {
-    formData.append(
-      "highContrastColorCombination",
-      parameters.highContrastColorCombination,
-    );
-  } else if (parameters.replaceAndInvertOption === "CUSTOM_COLOR") {
-    formData.append("textColor", parameters.textColor);
-    formData.append("backGroundColor", parameters.backGroundColor);
-  }
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(replaceColorToApiParams(parameters), { fileInput: file });
 
 export const replaceColorOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildReplaceColorFormData,
+  toApiParams: replaceColorToApiParams,
+  fromApiParams: replaceColorFromApiParams,
   operationType: "replaceColor",
-  endpoint: "/api/v1/misc/replace-invert-pdf",
+  endpoint: ENDPOINT,
   multiFileEndpoint: false,
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.test.ts b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.test.ts
index 5db2b30788..96973db125 100644
--- a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.test.ts
@@ -30,6 +30,10 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  rotateFromApiParams,
+  rotateToApiParams,
+} from "@app/hooks/tools/rotate/useRotateOperation";
 
 describe("useRotateOperation", () => {
   const mockUseToolOperation = vi.mocked(useToolOperation);
@@ -114,3 +118,30 @@ describe("useRotateOperation", () => {
     expect(callArgs[property]).toBe(expectedValue);
   });
 });
+
+describe("rotate mappers", () => {
+  test.each([
+    { angle: 0, expected: 0 },
+    { angle: 90, expected: 90 },
+    { angle: -90, expected: 270 },
+    { angle: 450, expected: 90 },
+  ])(
+    "toApiParams normalizes angle $angle to $expected",
+    ({ angle, expected }) => {
+      expect(rotateToApiParams({ angle }).angle).toBe(expected);
+    },
+  );
+
+  test("fromApiParams maps the backend angle back to the UI parameter", () => {
+    expect(rotateFromApiParams({ angle: 180 })).toEqual({ angle: 180 });
+  });
+
+  test.each([0, 90, 180, 270] as const)(
+    "round-trips a normalized angle %i",
+    (angle) => {
+      const ui = rotateFromApiParams({ angle });
+      const api = rotateToApiParams({ angle: ui.angle ?? 0 });
+      expect(api).toEqual({ angle });
+    },
+  );
+});
diff --git a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
index e675610eb9..7e73aab99f 100644
--- a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
@@ -3,6 +3,11 @@ import {
   useToolOperation,
   ToolType,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   RotateParameters,
@@ -10,24 +15,41 @@ import {
   normalizeAngle,
 } from "@app/hooks/tools/rotate/useRotateParameters";
 
+const ENDPOINT = "/api/v1/general/rotate-pdf" satisfies ToolEndpoint;
+type RotateApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the rotate-pdf request body. The return
+// type is the generated backend model, so a spec change breaks the build here.
+export const rotateToApiParams = (
+  parameters: RotateParameters,
+): RotateApiParams => ({
+  // The UI angle can be any multiple of 90 (including negatives or values above
+  // 360); normalize to the four values the backend accepts.
+  angle: normalizeAngle(parameters.angle) as RotateApiParams["angle"],
+});
+
+// Reconstruct the tool's UI parameters from a rotate-pdf request body.
+export const rotateFromApiParams = (
+  apiParams: RotateApiParams,
+): Partial<RotateParameters> => ({
+  angle: apiParams.angle,
+});
+
 // Static configuration that can be used by both the hook and automation executor
 export const buildRotateFormData = (
   parameters: RotateParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  // Normalize angle for backend (0, 90, 180, 270)
-  formData.append("angle", normalizeAngle(parameters.angle).toString());
-  return formData;
-};
+): FormData =>
+  objectToFormData(rotateToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const rotateOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildRotateFormData,
+  toApiParams: rotateToApiParams,
+  fromApiParams: rotateFromApiParams,
   operationType: "rotate",
-  endpoint: "/api/v1/general/rotate-pdf",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts b/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
index 9c98b7d57f..93fd64240d 100644
--- a/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
@@ -3,49 +3,65 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   SanitizeParameters,
   defaultParameters,
 } from "@app/hooks/tools/sanitize/useSanitizeParameters";
 
+const ENDPOINT = "/api/v1/security/sanitize-pdf" satisfies ToolEndpoint;
+type SanitizeApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the sanitize-pdf request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const sanitizeToApiParams = (
+  parameters: SanitizeParameters,
+): SanitizeApiParams => ({
+  removeJavaScript: parameters.removeJavaScript ?? false,
+  removeEmbeddedFiles: parameters.removeEmbeddedFiles ?? false,
+  removeXMPMetadata: parameters.removeXMPMetadata ?? false,
+  removeMetadata: parameters.removeMetadata ?? false,
+  removeLinks: parameters.removeLinks ?? false,
+  removeFonts: parameters.removeFonts ?? false,
+});
+
+// Reconstruct the tool's UI parameters from a sanitize-pdf request body, so a
+// stored or AI-authored step can be re-rendered in the settings UI.
+export const sanitizeFromApiParams = (
+  apiParams: SanitizeApiParams,
+): Partial<SanitizeParameters> => ({
+  removeJavaScript:
+    apiParams.removeJavaScript ?? defaultParameters.removeJavaScript,
+  removeEmbeddedFiles:
+    apiParams.removeEmbeddedFiles ?? defaultParameters.removeEmbeddedFiles,
+  removeXMPMetadata:
+    apiParams.removeXMPMetadata ?? defaultParameters.removeXMPMetadata,
+  removeMetadata: apiParams.removeMetadata ?? defaultParameters.removeMetadata,
+  removeLinks: apiParams.removeLinks ?? defaultParameters.removeLinks,
+  removeFonts: apiParams.removeFonts ?? defaultParameters.removeFonts,
+});
+
 // Static function that can be used by both the hook and automation executor
 export const buildSanitizeFormData = (
   parameters: SanitizeParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Add parameters
-  formData.append(
-    "removeJavaScript",
-    (parameters.removeJavaScript ?? false).toString(),
-  );
-  formData.append(
-    "removeEmbeddedFiles",
-    (parameters.removeEmbeddedFiles ?? false).toString(),
-  );
-  formData.append(
-    "removeXMPMetadata",
-    (parameters.removeXMPMetadata ?? false).toString(),
-  );
-  formData.append(
-    "removeMetadata",
-    (parameters.removeMetadata ?? false).toString(),
-  );
-  formData.append("removeLinks", (parameters.removeLinks ?? false).toString());
-  formData.append("removeFonts", (parameters.removeFonts ?? false).toString());
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(sanitizeToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
 export const sanitizeOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildSanitizeFormData,
+  toApiParams: sanitizeToApiParams,
+  fromApiParams: sanitizeFromApiParams,
   operationType: "sanitize",
-  endpoint: "/api/v1/security/sanitize-pdf",
+  endpoint: ENDPOINT,
   multiFileEndpoint: false,
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts b/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
index e035c90ce5..27aadeb98b 100644
--- a/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
@@ -5,6 +5,11 @@ import {
   useToolOperation,
   ToolOperationConfig,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   ScannerImageSplitParameters,
@@ -12,26 +17,50 @@ import {
 } from "@app/hooks/tools/scannerImageSplit/useScannerImageSplitParameters";
 import { useToolResources } from "@app/hooks/tools/shared/useToolResources";
 
+const ENDPOINT = "/api/v1/misc/extract-image-scans" satisfies ToolEndpoint;
+type ScannerImageSplitApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Convert the tool's UI parameters into the extract-image-scans request body.
+// The frontend uses snake_case field names, but the backend model (the contract)
+// uses camelCase, so the keys are renamed here.
+export const scannerImageSplitToApiParams = (
+  parameters: ScannerImageSplitParameters,
+): ScannerImageSplitApiParams => ({
+  angleThreshold: parameters.angle_threshold,
+  tolerance: parameters.tolerance,
+  minArea: parameters.min_area,
+  minContourArea: parameters.min_contour_area,
+  borderSize: parameters.border_size,
+});
+
+// Reconstruct the tool's UI parameters from an extract-image-scans request body,
+// so a stored or AI-authored step can be re-rendered in the settings UI.
+export const scannerImageSplitFromApiParams = (
+  apiParams: ScannerImageSplitApiParams,
+): Partial<ScannerImageSplitParameters> => ({
+  angle_threshold: apiParams.angleThreshold,
+  tolerance: apiParams.tolerance,
+  min_area: apiParams.minArea,
+  min_contour_area: apiParams.minContourArea,
+  border_size: apiParams.borderSize,
+});
+
 export const buildScannerImageSplitFormData = (
   parameters: ScannerImageSplitParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  formData.append("angle_threshold", parameters.angle_threshold.toString());
-  formData.append("tolerance", parameters.tolerance.toString());
-  formData.append("min_area", parameters.min_area.toString());
-  formData.append("min_contour_area", parameters.min_contour_area.toString());
-  formData.append("border_size", parameters.border_size.toString());
-  return formData;
-};
+): FormData =>
+  objectToFormData(scannerImageSplitToApiParams(parameters), {
+    fileInput: file,
+  });
 
 // Static configuration object
 export const scannerImageSplitOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildScannerImageSplitFormData,
+  toApiParams: scannerImageSplitToApiParams,
+  fromApiParams: scannerImageSplitFromApiParams,
   operationType: "scannerImageSplit",
-  endpoint: "/api/v1/misc/extract-image-scans",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
new file mode 100644
index 0000000000..a809ae9604
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
@@ -0,0 +1,163 @@
+import { describe, expect, test } from "vitest";
+import { type RegistryToolOperationConfig } from "@app/hooks/tools/shared/toolOperationTypes";
+import { objectToFormData } from "@app/hooks/tools/shared/toolApiMapping";
+
+// Pilot tools.
+import { compressOperationConfig } from "@app/hooks/tools/compress/useCompressOperation";
+import { rotateOperationConfig } from "@app/hooks/tools/rotate/useRotateOperation";
+import { mergeOperationConfig } from "@app/hooks/tools/merge/useMergeOperation";
+import { splitOperationConfig } from "@app/hooks/tools/split/useSplitOperation";
+// Rolled out in Phase 3.
+import { addAttachmentsOperationConfig } from "@app/hooks/tools/addAttachments/useAddAttachmentsOperation";
+import { addPageNumbersOperationConfig } from "@app/components/tools/addPageNumbers/useAddPageNumbersOperation";
+import { addPasswordOperationConfig } from "@app/hooks/tools/addPassword/useAddPasswordOperation";
+import { addStampOperationConfig } from "@app/components/tools/addStamp/useAddStampOperation";
+import { addWatermarkOperationConfig } from "@app/hooks/tools/addWatermark/useAddWatermarkOperation";
+import { adjustPageScaleOperationConfig } from "@app/hooks/tools/adjustPageScale/useAdjustPageScaleOperation";
+import { autoRenameOperationConfig } from "@app/hooks/tools/autoRename/useAutoRenameOperation";
+import { bookletImpositionOperationConfig } from "@app/hooks/tools/bookletImposition/useBookletImpositionOperation";
+import { certSignOperationConfig } from "@app/hooks/tools/certSign/useCertSignOperation";
+import { changePermissionsOperationConfig } from "@app/hooks/tools/changePermissions/useChangePermissionsOperation";
+import { cropOperationConfig } from "@app/hooks/tools/crop/useCropOperation";
+import { editTableOfContentsOperationConfig } from "@app/hooks/tools/editTableOfContents/useEditTableOfContentsOperation";
+import { extractImagesOperationConfig } from "@app/hooks/tools/extractImages/useExtractImagesOperation";
+import { flattenOperationConfig } from "@app/hooks/tools/flatten/useFlattenOperation";
+import { ocrOperationConfig } from "@app/hooks/tools/ocr/useOCROperation";
+import { overlayPdfsOperationConfig } from "@app/hooks/tools/overlayPdfs/useOverlayPdfsOperation";
+import { pageLayoutOperationConfig } from "@app/hooks/tools/pageLayout/usePageLayoutOperation";
+import { redactOperationConfig } from "@app/hooks/tools/redact/useRedactOperation";
+import { removeBlanksOperationConfig } from "@app/hooks/tools/removeBlanks/useRemoveBlanksOperation";
+import { removeCertificateSignOperationConfig } from "@app/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation";
+import { removeImageOperationConfig } from "@app/hooks/tools/removeImage/useRemoveImageOperation";
+import { removePagesOperationConfig } from "@app/hooks/tools/removePages/useRemovePagesOperation";
+import { removePasswordOperationConfig } from "@app/hooks/tools/removePassword/useRemovePasswordOperation";
+import { reorganizePagesOperationConfig } from "@app/hooks/tools/reorganizePages/useReorganizePagesOperation";
+import { repairOperationConfig } from "@app/hooks/tools/repair/useRepairOperation";
+import { replaceColorOperationConfig } from "@app/hooks/tools/replaceColor/useReplaceColorOperation";
+import { sanitizeOperationConfig } from "@app/hooks/tools/sanitize/useSanitizeOperation";
+import { scannerImageSplitOperationConfig } from "@app/hooks/tools/scannerImageSplit/useScannerImageSplitOperation";
+import { singleLargePageOperationConfig } from "@app/hooks/tools/singleLargePage/useSingleLargePageOperation";
+import { timestampPdfOperationConfig } from "@app/hooks/tools/timestampPdf/useTimestampPdfOperation";
+import { unlockPdfFormsOperationConfig } from "@app/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation";
+
+// Every tool migrated to the mapper seam. Erased to the registry shape so one
+// loop can invoke toApiParams(defaultParameters) uniformly regardless of the
+// tool's own parameter type.
+const MIGRATED_CONFIGS = [
+  compressOperationConfig,
+  rotateOperationConfig,
+  mergeOperationConfig,
+  splitOperationConfig,
+  addAttachmentsOperationConfig,
+  addPageNumbersOperationConfig,
+  addPasswordOperationConfig,
+  addStampOperationConfig,
+  addWatermarkOperationConfig,
+  adjustPageScaleOperationConfig,
+  autoRenameOperationConfig,
+  bookletImpositionOperationConfig,
+  certSignOperationConfig,
+  changePermissionsOperationConfig,
+  cropOperationConfig,
+  editTableOfContentsOperationConfig,
+  extractImagesOperationConfig,
+  flattenOperationConfig,
+  ocrOperationConfig,
+  overlayPdfsOperationConfig,
+  pageLayoutOperationConfig,
+  redactOperationConfig,
+  removeBlanksOperationConfig,
+  removeCertificateSignOperationConfig,
+  removeImageOperationConfig,
+  removePagesOperationConfig,
+  removePasswordOperationConfig,
+  reorganizePagesOperationConfig,
+  repairOperationConfig,
+  replaceColorOperationConfig,
+  sanitizeOperationConfig,
+  scannerImageSplitOperationConfig,
+  singleLargePageOperationConfig,
+  timestampPdfOperationConfig,
+  unlockPdfFormsOperationConfig,
+  // Erase each tool's own TParams to the shared registry shape (the same
+  // existential boundary asRegistryConfig applies) so one loop can call
+  // toApiParams(defaultParameters) uniformly.
+] as unknown as RegistryToolOperationConfig[];
+
+// A few tools have no static defaultParameters (the UI always supplies a value);
+// give the sweep a minimal valid parameter set for those.
+const FALLBACK_PARAMS: Record<string, Record<string, unknown>> = {
+  editTableOfContents: { bookmarks: [], replaceExisting: false },
+};
+
+describe("migrated tool mappers (sweep)", () => {
+  const file = new File(["x"], "test.pdf", { type: "application/pdf" });
+
+  test.each(
+    MIGRATED_CONFIGS.map((config) => [config.operationType, config] as const),
+  )(
+    "%s: exposes both mappers and serializes its default parameters cleanly",
+    (_name, config) => {
+      // Every migrated tool authors both directions of the mapping.
+      expect(config.toApiParams).toBeDefined();
+      expect(config.fromApiParams).toBeDefined();
+
+      // toApiParams(defaults) must produce a body objectToFormData can serialize
+      // (i.e. only primitives / arrays of primitives). A mapper that leaked a
+      // structured value would throw here.
+      const params =
+        config.defaultParameters ?? FALLBACK_PARAMS[config.operationType] ?? {};
+      const apiParams = config.toApiParams!(params);
+      expect(() =>
+        objectToFormData(apiParams, { fileInput: file }),
+      ).not.toThrow();
+    },
+  );
+});
+
+describe("redact mappers", () => {
+  test("toApiParams builds the auto-redact body from UI parameters", () => {
+    const api = redactOperationConfig.toApiParams({
+      mode: "automatic",
+      wordsToRedact: ["foo", "bar"],
+      useRegex: true,
+      wholeWordSearch: false,
+      redactColor: "#ff0000",
+      customPadding: 0.2,
+      convertPDFToImage: false,
+    });
+
+    expect(api).toEqual({
+      listOfText: "foo\nbar",
+      useRegex: true,
+      wholeWordSearch: false,
+      redactColor: "ff0000", // '#' stripped for the backend
+      customPadding: 0.2,
+      convertPDFToImage: false,
+    });
+  });
+
+  test("round-trips through fromApiParams", () => {
+    const api = redactOperationConfig.toApiParams({
+      mode: "automatic",
+      wordsToRedact: ["secret"],
+      useRegex: false,
+      wholeWordSearch: true,
+      redactColor: "#123456",
+      customPadding: 0.1,
+      convertPDFToImage: true,
+    });
+    const roundTripped = redactOperationConfig.toApiParams({
+      mode: "automatic",
+      wordsToRedact: [],
+      useRegex: false,
+      wholeWordSearch: false,
+      redactColor: "#000000",
+      customPadding: 0,
+      convertPDFToImage: false,
+      ...redactOperationConfig.fromApiParams(api),
+    });
+
+    expect(roundTripped).toEqual(api);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
new file mode 100644
index 0000000000..6ed02a49ae
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
@@ -0,0 +1,85 @@
+import { describe, expect, test } from "vitest";
+import {
+  objectToFormData,
+  type ToolApiParams,
+} from "@app/hooks/tools/shared/toolApiMapping";
+
+describe("objectToFormData", () => {
+  test("serializes primitive fields to string form values", () => {
+    const request: ToolApiParams["/api/v1/misc/compress-pdf"] = {
+      optimizeLevel: 3,
+      grayscale: true,
+      linearize: false,
+      expectedOutputSize: "25KB",
+    };
+    const formData = objectToFormData(request);
+
+    expect(formData.get("optimizeLevel")).toBe("3");
+    expect(formData.get("grayscale")).toBe("true");
+    expect(formData.get("linearize")).toBe("false");
+    expect(formData.get("expectedOutputSize")).toBe("25KB");
+  });
+
+  test("omits fields whose value is undefined", () => {
+    const request: ToolApiParams["/api/v1/misc/compress-pdf"] = {
+      optimizeLevel: 5,
+      expectedOutputSize: undefined,
+    };
+    const formData = objectToFormData(request);
+
+    expect(formData.has("optimizeLevel")).toBe(true);
+    expect(formData.has("expectedOutputSize")).toBe(false);
+  });
+
+  test("expands arrays into repeated fields", () => {
+    const request: ToolApiParams["/api/v1/misc/add-attachments"] = {
+      attachments: ["a.png", "b.png", "c.png"],
+    };
+    const formData = objectToFormData(request);
+
+    expect(formData.getAll("attachments")).toEqual(["a.png", "b.png", "c.png"]);
+  });
+
+  test("throws on a non-primitive field value rather than dropping it", () => {
+    // A redact request whose structured field was left un-encoded: the array
+    // items are objects, which cannot be sent as form fields.
+    const request: ToolApiParams["/api/v1/security/redact"] = {
+      redactions: [{ x: 1, y: 2 }],
+    };
+
+    expect(() => objectToFormData(request)).toThrow(/field "redactions"/);
+  });
+
+  test("appends a single file under its field name", () => {
+    const file = new File(["x"], "doc.pdf", { type: "application/pdf" });
+    const request: ToolApiParams["/api/v1/misc/compress-pdf"] = {
+      optimizeLevel: 5,
+    };
+    const formData = objectToFormData(request, { fileInput: file });
+
+    expect(formData.get("fileInput")).toBe(file);
+    expect(formData.get("optimizeLevel")).toBe("5");
+  });
+
+  test("appends multiple files under the same field name", () => {
+    const files = [
+      new File(["1"], "a.pdf", { type: "application/pdf" }),
+      new File(["2"], "b.pdf", { type: "application/pdf" }),
+    ];
+    const formData = objectToFormData({}, { fileInput: files });
+
+    expect(formData.getAll("fileInput")).toEqual(files);
+  });
+
+  test("appends named file fields alongside fileInput", () => {
+    const doc = new File(["d"], "doc.pdf", { type: "application/pdf" });
+    const stamp = new File(["s"], "stamp.png", { type: "image/png" });
+    const formData = objectToFormData(
+      {},
+      { fileInput: doc, stampImage: stamp },
+    );
+
+    expect(formData.get("fileInput")).toBe(doc);
+    expect(formData.get("stampImage")).toBe(stamp);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
new file mode 100644
index 0000000000..760df9ce5e
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
@@ -0,0 +1,88 @@
+import {
+  type ToolApiParams,
+  type ToolApiRequest,
+  type ToolEndpoint,
+} from "@app/types/toolApiTypes";
+
+export type { ToolApiParams, ToolApiRequest, ToolEndpoint };
+
+/**
+ * Mapping for tools that take only a file and have no request parameters (their
+ * generated model is `Record<string, never>`). Both directions are empty; the
+ * tool's buildFormData just appends the file.
+ */
+export function fileOnlyMapping(): {
+  toApiParams: () => Record<string, never>;
+  fromApiParams: () => Record<string, never>;
+} {
+  return { toApiParams: () => ({}), fromApiParams: () => ({}) };
+}
+
+/** Named file fields to append alongside the serialized parameters. */
+export interface FormDataFiles {
+  /** Primary document input(s); appended under the `fileInput` field. */
+  fileInput?: File | File[];
+  /** Any other named file field the endpoint accepts. */
+  [field: string]: File | File[] | undefined;
+}
+
+function appendPrimitive(
+  formData: FormData,
+  key: string,
+  value: unknown,
+): void {
+  if (value === undefined || value === null) return;
+  if (typeof value === "string") {
+    formData.append(key, value);
+  } else if (typeof value === "number" || typeof value === "boolean") {
+    formData.append(key, `${value}`);
+  } else {
+    // A non-primitive here means a mapper produced a value the backend cannot
+    // receive as a form field. Fail loudly rather than silently drop it:
+    // structured fields must be JSON-encoded in the mapper, and Files passed via
+    // the `files` argument.
+    throw new Error(
+      `objectToFormData: field "${key}" has an unsupported value of type ` +
+        `"${typeof value}"; expected a string, number, or boolean.`,
+    );
+  }
+}
+
+/**
+ * Serialize a backend request model (the output of a `toApiParams` function)
+ * into multipart FormData: primitives become string fields, arrays become
+ * repeated fields, and `undefined`/`null` are omitted. Files are appended
+ * separately via `files`, keeping file plumbing out of the parameter mapper.
+ *
+ * Throws if a field holds a non-primitive value, since that cannot be sent as a
+ * form field: structured fields must be JSON-encoded by the mapper.
+ */
+export function objectToFormData(
+  params: ToolApiRequest,
+  files?: FormDataFiles,
+): FormData {
+  const formData = new FormData();
+
+  for (const [key, value] of Object.entries(params)) {
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        appendPrimitive(formData, key, item);
+      }
+    } else {
+      appendPrimitive(formData, key, value);
+    }
+  }
+
+  if (files) {
+    for (const [field, value] of Object.entries(files)) {
+      if (value === undefined) continue;
+      if (Array.isArray(value)) {
+        value.forEach((file) => formData.append(field, file));
+      } else {
+        formData.append(field, value);
+      }
+    }
+  }
+
+  return formData;
+}
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
index 0d48ce6d09..93ade85368 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
@@ -3,9 +3,16 @@ import { StirlingFile } from "@app/types/fileContext";
 import type { ResponseHandler } from "@app/utils/toolResponseProcessor";
 import { ToolId } from "@app/types/toolId";
 import type { ProcessingProgress } from "@app/hooks/tools/shared/useToolState";
+import type { ToolApiRequest, ToolEndpoint } from "@app/types/toolApiTypes";
 
 export type { ProcessingProgress, ResponseHandler };
 
+/**
+ * A tool operation's backend endpoint, checked against the generated ToolEndpoint
+ * set, or `null` when the operation has no backend endpoint.
+ */
+export type ToolOperationEndpoint = ToolEndpoint | null;
+
 export enum ToolType {
   singleFile,
   multiFile,
@@ -72,6 +79,19 @@ interface BaseToolOperationConfig<TParams> {
   /** Default parameter values for automation */
   defaultParameters?: TParams;
 
+  /**
+   * Typed frontend params -> backend request model. When a tool provides this,
+   * it is the spec-checked source of truth for the request body and its
+   * buildFormData is derived from it via objectToFormData.
+   */
+  toApiParams?(params: TParams): ToolApiRequest;
+
+  /**
+   * Backend request model -> partial frontend params, so a stored API call
+   * can be re-hydrated into this tool's settings UI.
+   */
+  fromApiParams?(apiParams: ToolApiRequest): Partial<TParams>;
+
   /**
    * For custom tools: if true, success implies all input files were successfully processed.
    * Use this for tools like Automate or Merge where Many-to-One relationships exist
@@ -89,8 +109,12 @@ export interface SingleFileToolOperationConfig<
   /** Builds FormData for API request. */
   buildFormData: (params: TParams, file: File) => FormData;
 
-  /** API endpoint for the operation. Can be static string or function for dynamic routing. */
-  endpoint: string | ((params: TParams) => string);
+  /**
+   * API endpoint for the operation. Can be static or a function for dynamic routing.
+   */
+  endpoint:
+    | ToolOperationEndpoint
+    | ((params: TParams) => ToolOperationEndpoint);
 
   customProcessor?: undefined;
 }
@@ -107,8 +131,12 @@ export interface MultiFileToolOperationConfig<
   /** Builds FormData for API request. */
   buildFormData: (params: TParams, files: File[]) => FormData;
 
-  /** API endpoint for the operation. Can be static string or function for dynamic routing. */
-  endpoint: string | ((params: TParams) => string);
+  /**
+   * API endpoint for the operation. Can be static or a function for dynamic routing.
+   */
+  endpoint:
+    | ToolOperationEndpoint
+    | ((params: TParams) => ToolOperationEndpoint);
 
   customProcessor?: undefined;
 }
diff --git a/frontend/editor/src/core/hooks/tools/shared/useToolApiCalls.ts b/frontend/editor/src/core/hooks/tools/shared/useToolApiCalls.ts
index 28da62484a..cca1f5e563 100644
--- a/frontend/editor/src/core/hooks/tools/shared/useToolApiCalls.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/useToolApiCalls.ts
@@ -10,7 +10,7 @@ import type { ProcessingProgress } from "@app/hooks/tools/shared/useToolState";
 import type { StirlingFile, FileId } from "@app/types/fileContext";
 
 export interface ApiCallsConfig<TParams = void> {
-  endpoint: string | ((params: TParams) => string);
+  endpoint: string | null | ((params: TParams) => string | null);
   buildFormData: (params: TParams, file: File) => FormData;
   filePrefix?: string;
   responseHandler?: ResponseHandler;
@@ -37,6 +37,19 @@ export const useToolApiCalls = <TParams = void>() => {
       // Create cancel token for this operation
       cancelTokenRef.current = axios.CancelToken.source();
 
+      // Params are the same for every file, so resolve the endpoint once. A null
+      // endpoint means the tool has no backend call (e.g. client-side tools) and
+      // should never reach here, so fail loudly rather than POST to null.
+      const endpoint =
+        typeof config.endpoint === "function"
+          ? config.endpoint(params)
+          : config.endpoint;
+      if (!endpoint) {
+        throw new Error(
+          "This operation has no backend endpoint and cannot be executed directly.",
+        );
+      }
+
       for (let i = 0; i < validFiles.length; i++) {
         const file = validFiles[i];
 
@@ -51,10 +64,6 @@ export const useToolApiCalls = <TParams = void>() => {
 
         try {
           const formData = config.buildFormData(params, file);
-          const endpoint =
-            typeof config.endpoint === "function"
-              ? config.endpoint(params)
-              : config.endpoint;
           console.debug("[processFiles] POST", { endpoint, name: file.name });
           const response = await apiClient.post(endpoint, formData, {
             responseType: "blob",
diff --git a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
index 5629dfe54b..17e4c47442 100644
--- a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
@@ -266,6 +266,11 @@ export const useToolOperation = <TParams>(
               typeof config.endpoint === "function"
                 ? config.endpoint(params)
                 : config.endpoint;
+            if (!endpoint) {
+              throw new Error(
+                "This operation has no backend endpoint and cannot be executed directly.",
+              );
+            }
 
             const response = await apiClient.post(endpoint, formData, {
               responseType: "blob",
diff --git a/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts b/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
index bd92fdd758..175fa744ab 100644
--- a/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
@@ -54,7 +54,10 @@ export const signOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildSignFormData,
   operationType: "sign",
-  endpoint: "/api/v1/security/add-signature",
+  // Signing is applied client-side in the viewer (see createStampTool ->
+  // flattenSignatures); there is no backend endpoint and the standard execute
+  // path is never used.
+  endpoint: null,
   filePrefix: "signed_",
   defaultParameters: DEFAULT_PARAMETERS,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts b/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
index a57a26a7dc..835959c484 100644
--- a/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
@@ -3,28 +3,36 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  fileOnlyMapping,
+  objectToFormData,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   SingleLargePageParameters,
   defaultParameters,
 } from "@app/hooks/tools/singleLargePage/useSingleLargePageParameters";
 
+const ENDPOINT = "/api/v1/general/pdf-to-single-page" satisfies ToolEndpoint;
+
+// Single large page takes only a file; there are no request parameters to map.
+const { toApiParams, fromApiParams } = fileOnlyMapping();
+
 // Static function that can be used by both the hook and automation executor
 export const buildSingleLargePageFormData = (
   _parameters: SingleLargePageParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  return formData;
-};
+): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
 export const singleLargePageOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildSingleLargePageFormData,
+  toApiParams,
+  fromApiParams,
   operationType: "pdfToSinglePage",
-  endpoint: "/api/v1/general/pdf-to-single-page",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.test.ts b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.test.ts
new file mode 100644
index 0000000000..4cf8509c5d
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.test.ts
@@ -0,0 +1,212 @@
+import { describe, expect, test } from "vitest";
+import {
+  buildSplitFormData,
+  getSplitEndpoint,
+  splitFromApiParams,
+  splitToApiParams,
+} from "@app/hooks/tools/split/useSplitOperation";
+import {
+  SplitParameters,
+  defaultParameters,
+} from "@app/hooks/tools/split/useSplitParameters";
+import { SPLIT_METHODS } from "@app/constants/splitConstants";
+
+const params = (overrides: Partial<SplitParameters>): SplitParameters => ({
+  ...defaultParameters,
+  ...overrides,
+});
+
+describe("splitToApiParams", () => {
+  test("byPages sends pageNumbers", () => {
+    expect(
+      splitToApiParams(
+        params({ method: SPLIT_METHODS.BY_PAGES, pages: "2,5" }),
+      ),
+    ).toEqual({ pageNumbers: "2,5" });
+  });
+
+  test("bySections sends divisions and split mode without custom pages", () => {
+    expect(
+      splitToApiParams(
+        params({
+          method: SPLIT_METHODS.BY_SECTIONS,
+          hDiv: "3",
+          vDiv: "2",
+          merge: true,
+          splitMode: "SPLIT_ALL",
+        }),
+      ),
+    ).toEqual({
+      horizontalDivisions: 3,
+      verticalDivisions: 2,
+      merge: true,
+      splitMode: "SPLIT_ALL",
+    });
+  });
+
+  test("bySections includes pageNumbers only for CUSTOM mode", () => {
+    expect(
+      splitToApiParams(
+        params({
+          method: SPLIT_METHODS.BY_SECTIONS,
+          splitMode: "CUSTOM",
+          customPages: "1,2",
+        }),
+      ),
+    ).toMatchObject({ splitMode: "CUSTOM", pageNumbers: "1,2" });
+  });
+
+  test.each([
+    { method: SPLIT_METHODS.BY_SIZE, splitType: 0 },
+    { method: SPLIT_METHODS.BY_PAGE_COUNT, splitType: 1 },
+    { method: SPLIT_METHODS.BY_DOC_COUNT, splitType: 2 },
+  ])("$method maps to splitType $splitType", ({ method, splitType }) => {
+    expect(splitToApiParams(params({ method, splitValue: "5" }))).toEqual({
+      splitType,
+      splitValue: "5",
+    });
+  });
+
+  test("byChapters converts bookmarkLevel to a number", () => {
+    expect(
+      splitToApiParams(
+        params({
+          method: SPLIT_METHODS.BY_CHAPTERS,
+          bookmarkLevel: "2",
+          includeMetadata: true,
+        }),
+      ),
+    ).toEqual({
+      bookmarkLevel: 2,
+      includeMetadata: true,
+      allowDuplicates: false,
+    });
+  });
+
+  test("byPageDivider sends duplexMode", () => {
+    expect(
+      splitToApiParams(
+        params({ method: SPLIT_METHODS.BY_PAGE_DIVIDER, duplexMode: true }),
+      ),
+    ).toEqual({ duplexMode: true });
+  });
+
+  test("byPoster maps the factors to the spec's xFactor/yFactor fields", () => {
+    expect(
+      splitToApiParams(
+        params({
+          method: SPLIT_METHODS.BY_POSTER,
+          pageSize: "A4",
+          xFactor: "3",
+          yFactor: "2",
+          rightToLeft: true,
+        }),
+      ),
+    ).toEqual({ pageSize: "A4", xFactor: 3, yFactor: 2, rightToLeft: true });
+  });
+
+  // A cleared numeric field arrives as "". It must fall back to the default,
+  // not Number("") === 0, which the backend turns into an empty/degenerate PDF.
+  test("byPoster falls back to the default factor for empty fields", () => {
+    expect(
+      splitToApiParams(
+        params({ method: SPLIT_METHODS.BY_POSTER, xFactor: "", yFactor: "" }),
+      ),
+    ).toMatchObject({ xFactor: 2, yFactor: 2 });
+  });
+
+  test("bySections falls back to the default divisions for empty fields", () => {
+    expect(
+      splitToApiParams(
+        params({ method: SPLIT_METHODS.BY_SECTIONS, hDiv: "", vDiv: "" }),
+      ),
+    ).toMatchObject({ horizontalDivisions: 2, verticalDivisions: 2 });
+  });
+
+  test("byChapters falls back to the default bookmark level for an empty field", () => {
+    expect(
+      splitToApiParams(
+        params({ method: SPLIT_METHODS.BY_CHAPTERS, bookmarkLevel: "" }),
+      ),
+    ).toMatchObject({ bookmarkLevel: 1 });
+  });
+});
+
+describe("split round-trip", () => {
+  test.each<Partial<SplitParameters>>([
+    { method: SPLIT_METHODS.BY_PAGES, pages: "2,5" },
+    {
+      method: SPLIT_METHODS.BY_SECTIONS,
+      hDiv: "3",
+      vDiv: "2",
+      merge: true,
+      splitMode: "SPLIT_ALL",
+    },
+    {
+      method: SPLIT_METHODS.BY_SECTIONS,
+      splitMode: "CUSTOM",
+      customPages: "1,2",
+    },
+    { method: SPLIT_METHODS.BY_SIZE, splitValue: "10MB" },
+    { method: SPLIT_METHODS.BY_PAGE_COUNT, splitValue: "5" },
+    { method: SPLIT_METHODS.BY_DOC_COUNT, splitValue: "3" },
+    {
+      method: SPLIT_METHODS.BY_CHAPTERS,
+      bookmarkLevel: "2",
+      includeMetadata: true,
+    },
+    { method: SPLIT_METHODS.BY_PAGE_DIVIDER, duplexMode: true },
+    {
+      method: SPLIT_METHODS.BY_POSTER,
+      pageSize: "A4",
+      xFactor: "3",
+      yFactor: "2",
+    },
+  ])("toApiParams(fromApiParams(x)) reproduces x for %o", (overrides) => {
+    const api = splitToApiParams(params(overrides));
+    const roundTripped = splitToApiParams(params(splitFromApiParams(api)));
+
+    expect(roundTripped).toEqual(api);
+  });
+});
+
+describe("getSplitEndpoint", () => {
+  test.each([
+    { method: SPLIT_METHODS.BY_PAGES, endpoint: "/api/v1/general/split-pages" },
+    {
+      method: SPLIT_METHODS.BY_SECTIONS,
+      endpoint: "/api/v1/general/split-pdf-by-sections",
+    },
+    {
+      method: SPLIT_METHODS.BY_SIZE,
+      endpoint: "/api/v1/general/split-by-size-or-count",
+    },
+    {
+      method: SPLIT_METHODS.BY_CHAPTERS,
+      endpoint: "/api/v1/general/split-pdf-by-chapters",
+    },
+    {
+      method: SPLIT_METHODS.BY_PAGE_DIVIDER,
+      endpoint: "/api/v1/misc/auto-split-pdf",
+    },
+    {
+      method: SPLIT_METHODS.BY_POSTER,
+      endpoint: "/api/v1/general/split-for-poster-print",
+    },
+  ])("$method routes to $endpoint", ({ method, endpoint }) => {
+    expect(getSplitEndpoint(params({ method }))).toBe(endpoint);
+  });
+});
+
+describe("buildSplitFormData", () => {
+  test("appends the file and the serialized parameters", () => {
+    const file = new File(["x"], "test.pdf", { type: "application/pdf" });
+    const formData = buildSplitFormData(
+      params({ method: SPLIT_METHODS.BY_PAGES, pages: "3" }),
+      file,
+    );
+
+    expect(formData.get("fileInput")).toBe(file);
+    expect(formData.get("pageNumbers")).toBe("3");
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
index bedf83d09e..adeb65546a 100644
--- a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
@@ -5,115 +5,176 @@ import {
   useToolOperation,
   ToolOperationConfig,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   SplitParameters,
   defaultParameters,
 } from "@app/hooks/tools/split/useSplitParameters";
-import { SPLIT_METHODS } from "@app/constants/splitConstants";
+import { SPLIT_METHODS, type SplitMethod } from "@app/constants/splitConstants";
 import { useToolResources } from "@app/hooks/tools/shared/useToolResources";
 
-// Static functions that can be used by both the hook and automation executor
-export const buildSplitFormData = (
+// Split routes to a different endpoint per method. This map is the single source
+// of truth: getSplitEndpoint returns from it, and the mapper types below are
+// derived from it, so the endpoint posted and the request shape checked can
+// never point at different endpoints.
+const SPLIT_ENDPOINTS = {
+  [SPLIT_METHODS.BY_PAGES]: "/api/v1/general/split-pages",
+  [SPLIT_METHODS.BY_SECTIONS]: "/api/v1/general/split-pdf-by-sections",
+  [SPLIT_METHODS.BY_SIZE]: "/api/v1/general/split-by-size-or-count",
+  [SPLIT_METHODS.BY_PAGE_COUNT]: "/api/v1/general/split-by-size-or-count",
+  [SPLIT_METHODS.BY_DOC_COUNT]: "/api/v1/general/split-by-size-or-count",
+  [SPLIT_METHODS.BY_CHAPTERS]: "/api/v1/general/split-pdf-by-chapters",
+  [SPLIT_METHODS.BY_PAGE_DIVIDER]: "/api/v1/misc/auto-split-pdf",
+  [SPLIT_METHODS.BY_POSTER]: "/api/v1/general/split-for-poster-print",
+} as const satisfies Record<SplitMethod, ToolEndpoint>;
+
+type SplitApiParams = ToolApiParams[(typeof SPLIT_ENDPOINTS)[SplitMethod]];
+type SectionsApiParams =
+  ToolApiParams[(typeof SPLIT_ENDPOINTS)[typeof SPLIT_METHODS.BY_SECTIONS]];
+type PosterApiParams =
+  ToolApiParams[(typeof SPLIT_ENDPOINTS)[typeof SPLIT_METHODS.BY_POSTER]];
+
+// Convert the tool's UI parameters into the request body for the routed endpoint.
+export const splitToApiParams = (
   parameters: SplitParameters,
-  file: File,
-): FormData => {
-  const formData = new FormData();
-
-  formData.append("fileInput", file);
-
+): SplitApiParams => {
   // Use BY_PAGES as default if no method is selected
   const method = parameters.method || SPLIT_METHODS.BY_PAGES;
 
   switch (method) {
     case SPLIT_METHODS.BY_PAGES:
-      formData.append("pageNumbers", parameters.pages);
-      break;
-    case SPLIT_METHODS.BY_SECTIONS:
-      formData.append("horizontalDivisions", parameters.hDiv);
-      formData.append("verticalDivisions", parameters.vDiv);
-      formData.append("merge", (parameters.merge ?? false).toString());
-      formData.append("splitMode", parameters.splitMode || "SPLIT_ALL");
+      return { pageNumbers: parameters.pages };
+    case SPLIT_METHODS.BY_SECTIONS: {
+      const sections: SectionsApiParams = {
+        horizontalDivisions: Number(parameters.hDiv || "2"),
+        verticalDivisions: Number(parameters.vDiv || "2"),
+        merge: parameters.merge ?? false,
+        splitMode: (parameters.splitMode ||
+          "SPLIT_ALL") as SectionsApiParams["splitMode"],
+      };
       if (parameters.splitMode === "CUSTOM" && parameters.customPages) {
-        formData.append("pageNumbers", parameters.customPages);
+        sections.pageNumbers = parameters.customPages;
       }
-      break;
+      return sections;
+    }
     case SPLIT_METHODS.BY_SIZE:
-      formData.append("splitType", "0");
-      formData.append("splitValue", parameters.splitValue);
-      break;
+      return { splitType: 0, splitValue: parameters.splitValue };
     case SPLIT_METHODS.BY_PAGE_COUNT:
-      formData.append("splitType", "1");
-      formData.append("splitValue", parameters.splitValue);
-      break;
+      return { splitType: 1, splitValue: parameters.splitValue };
     case SPLIT_METHODS.BY_DOC_COUNT:
-      formData.append("splitType", "2");
-      formData.append("splitValue", parameters.splitValue);
-      break;
+      return { splitType: 2, splitValue: parameters.splitValue };
     case SPLIT_METHODS.BY_CHAPTERS:
-      formData.append("bookmarkLevel", parameters.bookmarkLevel);
-      formData.append(
-        "includeMetadata",
-        (parameters.includeMetadata ?? false).toString(),
-      );
-      formData.append(
-        "allowDuplicates",
-        (parameters.allowDuplicates ?? false).toString(),
-      );
-      break;
+      return {
+        bookmarkLevel: Number(parameters.bookmarkLevel || "1"),
+        includeMetadata: parameters.includeMetadata ?? false,
+        allowDuplicates: parameters.allowDuplicates ?? false,
+      };
     case SPLIT_METHODS.BY_PAGE_DIVIDER:
-      formData.append(
-        "duplexMode",
-        (parameters.duplexMode ?? false).toString(),
-      );
-      break;
+      return { duplexMode: parameters.duplexMode ?? false };
     case SPLIT_METHODS.BY_POSTER:
-      formData.append("pageSize", parameters.pageSize || "A4");
-      formData.append("xFactor", parameters.xFactor || "2");
-      formData.append("yFactor", parameters.yFactor || "2");
-      formData.append(
-        "rightToLeft",
-        (parameters.rightToLeft ?? false).toString(),
-      );
-      break;
+      return {
+        pageSize: (parameters.pageSize || "A4") as PosterApiParams["pageSize"],
+        xFactor: Number(parameters.xFactor || "2"),
+        yFactor: Number(parameters.yFactor || "2"),
+        rightToLeft: parameters.rightToLeft ?? false,
+      };
     default:
       throw new Error(`Unknown split method: ${method}`);
   }
-
-  return formData;
 };
 
-export const getSplitEndpoint = (parameters: SplitParameters): string => {
-  // Default to BY_PAGES endpoint if no method selected yet
-  if (!parameters.method) {
-    return "/api/v1/general/split-pages";
+// Reconstruct the tool's UI parameters from a stored request body. The step
+// carries no explicit method, so it is inferred from the fields present.
+export const splitFromApiParams = (
+  apiParams: SplitApiParams,
+): Partial<SplitParameters> => {
+  if ("pageSize" in apiParams) {
+    return {
+      method: SPLIT_METHODS.BY_POSTER,
+      pageSize: apiParams.pageSize,
+      xFactor:
+        apiParams.xFactor !== undefined ? `${apiParams.xFactor}` : undefined,
+      yFactor:
+        apiParams.yFactor !== undefined ? `${apiParams.yFactor}` : undefined,
+      rightToLeft: apiParams.rightToLeft ?? defaultParameters.rightToLeft,
+    };
   }
-
-  switch (parameters.method) {
-    case null:
-    case SPLIT_METHODS.BY_PAGES:
-      return "/api/v1/general/split-pages";
-    case SPLIT_METHODS.BY_SECTIONS:
-      return "/api/v1/general/split-pdf-by-sections";
-    case SPLIT_METHODS.BY_SIZE:
-    case SPLIT_METHODS.BY_PAGE_COUNT:
-    case SPLIT_METHODS.BY_DOC_COUNT:
-      return "/api/v1/general/split-by-size-or-count";
-    case SPLIT_METHODS.BY_CHAPTERS:
-      return "/api/v1/general/split-pdf-by-chapters";
-    case SPLIT_METHODS.BY_PAGE_DIVIDER:
-      return "/api/v1/misc/auto-split-pdf";
-    case SPLIT_METHODS.BY_POSTER:
-      return "/api/v1/general/split-for-poster-print";
-    default:
-      throw new Error(`Unknown split method: ${parameters.method}`);
+  if ("horizontalDivisions" in apiParams || "verticalDivisions" in apiParams) {
+    return {
+      method: SPLIT_METHODS.BY_SECTIONS,
+      hDiv:
+        apiParams.horizontalDivisions !== undefined
+          ? `${apiParams.horizontalDivisions}`
+          : undefined,
+      vDiv:
+        apiParams.verticalDivisions !== undefined
+          ? `${apiParams.verticalDivisions}`
+          : undefined,
+      merge: apiParams.merge ?? false,
+      splitMode: apiParams.splitMode ?? "SPLIT_ALL",
+      customPages:
+        apiParams.splitMode === "CUSTOM"
+          ? apiParams.pageNumbers
+          : defaultParameters.customPages,
+    };
   }
+  if ("bookmarkLevel" in apiParams) {
+    return {
+      method: SPLIT_METHODS.BY_CHAPTERS,
+      bookmarkLevel:
+        apiParams.bookmarkLevel !== undefined
+          ? `${apiParams.bookmarkLevel}`
+          : "",
+      includeMetadata: apiParams.includeMetadata ?? false,
+      allowDuplicates: apiParams.allowDuplicates ?? false,
+    };
+  }
+  if ("splitType" in apiParams) {
+    const methodBySplitType = {
+      0: SPLIT_METHODS.BY_SIZE,
+      1: SPLIT_METHODS.BY_PAGE_COUNT,
+      2: SPLIT_METHODS.BY_DOC_COUNT,
+    } as const;
+    return {
+      method: methodBySplitType[apiParams.splitType as 0 | 1 | 2],
+      splitValue: apiParams.splitValue ?? "",
+    };
+  }
+  if ("duplexMode" in apiParams) {
+    return {
+      method: SPLIT_METHODS.BY_PAGE_DIVIDER,
+      duplexMode: apiParams.duplexMode ?? false,
+    };
+  }
+  const pages = "pageNumbers" in apiParams ? apiParams.pageNumbers : undefined;
+  return {
+    method: SPLIT_METHODS.BY_PAGES,
+    pages: pages ?? defaultParameters.pages,
+  };
 };
 
+// Static functions that can be used by both the hook and automation executor
+export const buildSplitFormData = (
+  parameters: SplitParameters,
+  file: File,
+): FormData =>
+  objectToFormData(splitToApiParams(parameters), { fileInput: file });
+
+export const getSplitEndpoint = (parameters: SplitParameters): ToolEndpoint =>
+  // Default to BY_PAGES when no method is selected yet.
+  SPLIT_ENDPOINTS[parameters.method ?? SPLIT_METHODS.BY_PAGES];
+
 // Static configuration object
 export const splitOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildSplitFormData,
+  toApiParams: splitToApiParams,
+  fromApiParams: splitFromApiParams,
   operationType: "split",
   endpoint: getSplitEndpoint,
   defaultParameters,
diff --git a/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts b/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
index b14f785574..f607a727f0 100644
--- a/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
@@ -3,29 +3,45 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   TimestampPdfParameters,
   defaultParameters,
 } from "@app/hooks/tools/timestampPdf/useTimestampPdfParameters";
 
+const ENDPOINT = "/api/v1/security/timestamp-pdf" satisfies ToolEndpoint;
+type TimestampPdfApiParams = ToolApiParams[typeof ENDPOINT];
+
+export const timestampPdfToApiParams = (
+  parameters: TimestampPdfParameters,
+): TimestampPdfApiParams => ({
+  tsaUrl: parameters.tsaUrl,
+});
+
+export const timestampPdfFromApiParams = (
+  apiParams: TimestampPdfApiParams,
+): Partial<TimestampPdfParameters> => ({
+  tsaUrl: apiParams.tsaUrl,
+});
+
 export const buildTimestampPdfFormData = (
   parameters: TimestampPdfParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  formData.append("tsaUrl", parameters.tsaUrl);
-
-  return formData;
-};
+): FormData =>
+  objectToFormData(timestampPdfToApiParams(parameters), { fileInput: file });
 
 export const timestampPdfOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildTimestampPdfFormData,
+  toApiParams: timestampPdfToApiParams,
+  fromApiParams: timestampPdfFromApiParams,
   operationType: "timestampPdf",
-  endpoint: "/api/v1/security/timestamp-pdf",
+  endpoint: ENDPOINT,
   multiFileEndpoint: false,
   defaultParameters,
 } as const;
diff --git a/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts b/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
index 1e78d2d407..2d3e22fb06 100644
--- a/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
@@ -3,28 +3,36 @@ import {
   ToolType,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  fileOnlyMapping,
+  objectToFormData,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
   UnlockPdfFormsParameters,
   defaultParameters,
 } from "@app/hooks/tools/unlockPdfForms/useUnlockPdfFormsParameters";
 
+const ENDPOINT = "/api/v1/misc/unlock-pdf-forms" satisfies ToolEndpoint;
+
+// Unlock PDF forms takes only a file; there are no request parameters to map.
+const { toApiParams, fromApiParams } = fileOnlyMapping();
+
 // Static function that can be used by both the hook and automation executor
 export const buildUnlockPdfFormsFormData = (
   _parameters: UnlockPdfFormsParameters,
   file: File,
-): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-  return formData;
-};
+): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
 export const unlockPdfFormsOperationConfig = {
   toolType: ToolType.singleFile,
   buildFormData: buildUnlockPdfFormsFormData,
+  toApiParams,
+  fromApiParams,
   operationType: "unlockPDFForms",
-  endpoint: "/api/v1/misc/unlock-pdf-forms",
+  endpoint: ENDPOINT,
   defaultParameters,
 } as const;
 
diff --git a/frontend/editor/src/core/types/toolApiTypes.ts b/frontend/editor/src/core/types/toolApiTypes.ts
new file mode 100644
index 0000000000..d62e13b20f
--- /dev/null
+++ b/frontend/editor/src/core/types/toolApiTypes.ts
@@ -0,0 +1,1594 @@
+// AUTO-GENERATED FILE. DO NOT EDIT.
+// Generated by editor/scripts/generate-tool-api-types.mts from the Java OpenAPI spec
+// (SwaggerDoc.json). Regenerate with: task frontend:tool-models
+// Tools that take only a file input have no parameters; their model is Record<string, never>.
+
+export interface AddAttachmentRequest {
+  /**
+   * The image file to be overlaid onto the PDF.
+   */
+  attachments: string[];
+  /**
+   * Convert the resulting PDF to PDF/A-3b format after adding attachments
+   */
+  convertToPdfA3b?: boolean;
+}
+export interface AddCommentsRequest {
+  /**
+   * JSON array of comment specs. Each element has: {pageIndex, x, y, width, height, text, author?, subject?}. Coordinates are PDF user-space with origin at the page's bottom-left.
+   */
+  comments: string;
+}
+export interface AddPageNumbersRequest {
+  /**
+   * Custom margin: small/medium/large/x-large
+   */
+  customMargin?: "small" | "medium" | "large" | "x-large";
+  /**
+   * Custom text pattern. Available variables: {n}=current page number, {total}=total pages, {filename}=original filename
+   */
+  customText?: string;
+  /**
+   * Hex colour for page numbers (e.g. #FF0000)
+   */
+  fontColor?: string;
+  /**
+   * Font size for page numbers
+   */
+  fontSize?: number;
+  /**
+   * Font type for page numbers
+   */
+  fontType: "helvetica" | "courier" | "times";
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+  /**
+   * Which pages to number (e.g. '1,3-5,7' or 'all')
+   */
+  pagesToNumber?: string;
+  /**
+   * Position: 1-9 representing positions on the page (1=top-left, 2=top-center, 3=top-right, 4=middle-left, 5=middle-center, 6=middle-right, 7=bottom-left, 8=bottom-center, 9=bottom-right)
+   */
+  position: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
+  /**
+   * Starting number for page numbering
+   */
+  startingNumber?: number;
+  /**
+   * Zero-padding width for page numbers (Bates Stamping). Set to 0 to disable padding
+   */
+  zeroPad?: number;
+}
+export interface AddPasswordRequest {
+  /**
+   * The length of the encryption key
+   */
+  keyLength?: 40 | 128 | 256;
+  /**
+   * The owner password to be added to the PDF file (Restricts what can be done with the document once it is opened)
+   */
+  ownerPassword?: string;
+  /**
+   * The password to be added to the PDF file (Restricts the opening of the document itself.)
+   */
+  password?: string;
+  /**
+   * Whether document assembly is prevented
+   */
+  preventAssembly?: boolean;
+  /**
+   * Whether content extraction is prevented
+   */
+  preventExtractContent?: boolean;
+  /**
+   * Whether content extraction for accessibility is prevented
+   */
+  preventExtractForAccessibility?: boolean;
+  /**
+   * Whether form filling is prevented
+   */
+  preventFillInForm?: boolean;
+  /**
+   * Whether document modification is prevented
+   */
+  preventModify?: boolean;
+  /**
+   * Whether modification of annotations is prevented
+   */
+  preventModifyAnnotations?: boolean;
+  /**
+   * Whether printing of the document is prevented
+   */
+  preventPrinting?: boolean;
+  /**
+   * Whether faithful printing is prevented
+   */
+  preventPrintingFaithful?: boolean;
+}
+export interface AddStampRequest {
+  /**
+   * The selected alphabet of the stamp text
+   */
+  alphabet?: "roman" | "arabic" | "japanese" | "korean" | "chinese" | "thai";
+  /**
+   * The color of the stamp text
+   */
+  customColor?: string;
+  /**
+   * Specifies the margin size for the stamp.
+   */
+  customMargin?: "small" | "medium" | "large" | "x-large";
+  /**
+   * The font size of the stamp text and image in points.
+   */
+  fontSize?: number;
+  /**
+   * The opacity of the stamp (0.0 - 1.0)
+   */
+  opacity?: number;
+  /**
+   * Override X coordinate for stamp placement. If set, it will override the position-based calculation. Negative value means no override.
+   */
+  overrideX?: number;
+  /**
+   * Override Y coordinate for stamp placement. If set, it will override the position-based calculation. Negative value means no override.
+   */
+  overrideY?: number;
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+  /**
+   * Position for stamp placement based on a 1-9 grid (1: bottom-left, 2: bottom-center, 3: bottom-right, 4: middle-left, 5: middle-center, 6: middle-right, 7: top-left, 8: top-center, 9: top-right)
+   */
+  position?: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
+  /**
+   * The rotation of the stamp in degrees
+   */
+  rotation?: number;
+  stampImage?: string;
+  /**
+   * The stamp text
+   */
+  stampText?: string;
+  /**
+   * The stamp type (text or image)
+   */
+  stampType: "text" | "image";
+}
+export interface AddWatermarkRequest {
+  /**
+   * The selected alphabet
+   */
+  alphabet?: "roman" | "arabic" | "japanese" | "korean" | "chinese" | "thai";
+  /**
+   * Convert the redacted PDF to an image
+   */
+  convertPDFToImage?: boolean;
+  /**
+   * The color for watermark
+   */
+  customColor?: string;
+  /**
+   * The font size of the watermark text
+   */
+  fontSize?: number;
+  /**
+   * The height spacer between watermark elements
+   */
+  heightSpacer?: number;
+  /**
+   * The opacity of the watermark (0.0 - 1.0)
+   */
+  opacity?: number;
+  /**
+   * The rotation of the watermark in degrees
+   */
+  rotation?: number;
+  watermarkImage?: string;
+  /**
+   * The watermark text
+   */
+  watermarkText?: string;
+  /**
+   * The watermark type (text or image)
+   */
+  watermarkType: "text" | "image";
+  /**
+   * The width spacer between watermark elements
+   */
+  widthSpacer?: number;
+}
+export interface AutoSplitPdfRequest {
+  /**
+   * Flag indicating if the duplex mode is active, where the page after the divider also gets removed.
+   */
+  duplexMode?: boolean;
+}
+export interface BookletImpositionRequest {
+  /**
+   * Boolean for if you wish to add border around the pages
+   */
+  addBorder?: boolean;
+  /**
+   * Add gutter margin (inner margin for binding)
+   */
+  addGutter?: boolean;
+  /**
+   * Generate both front and back sides (double-sided printing)
+   */
+  doubleSided?: boolean;
+  /**
+   * For manual duplex: which pass to generate
+   */
+  duplexPass?: "BOTH" | "FIRST" | "SECOND";
+  /**
+   * Flip back sides for short-edge duplex printing (default is long-edge)
+   */
+  flipOnShortEdge?: boolean;
+  /**
+   * Gutter margin size in points (used when addGutter is true)
+   */
+  gutterSize?: number;
+  /**
+   * The number of pages per side for booklet printing (always 2 for proper booklet).
+   */
+  pagesPerSheet?: 2;
+  /**
+   * The spine location for the booklet.
+   */
+  spineLocation?: "LEFT" | "RIGHT";
+}
+export interface ConvertCbrToPdfRequest {
+  /**
+   * Optimize the output PDF for ebook reading using Ghostscript
+   */
+  optimizeForEbook?: boolean;
+}
+export interface ConvertCbzToPdfRequest {
+  /**
+   * Optimize the output PDF for ebook reading using Ghostscript
+   */
+  optimizeForEbook?: boolean;
+}
+export interface ConvertEbookToPdfRequest {
+  /**
+   * Embed all fonts from the eBook into the generated PDF
+   */
+  embedAllFonts?: true | false;
+  /**
+   * Add page numbers to the generated PDF
+   */
+  includePageNumbers?: true | false;
+  /**
+   * Add a generated table of contents to the resulting PDF
+   */
+  includeTableOfContents?: true | false;
+  /**
+   * Optimize the PDF for eBook reading (smaller file size, better rendering on eInk devices)
+   */
+  optimizeForEbook?: true | false;
+}
+export type ConvertPdfHtmlRequest = Record<string, never>;
+export type ConvertPdfMarkdownRequest = Record<string, never>;
+export type ConvertPdfTextEditorMetadataRequest = Record<string, never>;
+export interface ConvertPdfTextEditorRequest {
+  lightweight?: boolean;
+}
+export interface ConvertPdfToCbrRequest {
+  /**
+   * The DPI (Dots Per Inch) for rendering PDF pages as images
+   */
+  dpi: number;
+}
+export interface ConvertPdfToCbzRequest {
+  /**
+   * The DPI (Dots Per Inch) for rendering PDF pages as images
+   */
+  dpi: number;
+}
+export interface ConvertPdfToEpubRequest {
+  /**
+   * Detect headings that look like chapters and insert EPUB page breaks.
+   */
+  detectChapters?: true | false;
+  /**
+   * Choose the output format for the ebook.
+   */
+  outputFormat?: "EPUB" | "AZW3";
+  /**
+   * Choose an output profile optimized for the reader device.
+   */
+  targetDevice?: "TABLET_PHONE_IMAGES" | "KINDLE_EINK_TEXT";
+}
+export type ConvertPdfXmlRequest = Record<string, never>;
+export interface ConvertToImageRequest {
+  /**
+   * The color type of the output image(s)
+   */
+  colorType?: "color" | "greyscale" | "blackwhite";
+  /**
+   * The DPI (dots per inch) for the output image(s)
+   */
+  dpi?: number;
+  /**
+   * The output image format
+   */
+  imageFormat?: "png" | "jpeg" | "jpg" | "gif" | "webp";
+  /**
+   * Include annotations such as comments in the output image(s)
+   */
+  includeAnnotations?: boolean;
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+  /**
+   * Choose between a single image containing all pages or separate images for each page
+   */
+  singleOrMultiple?: "single" | "multiple";
+}
+export interface ConvertToPdfRequest {
+  /**
+   * Whether to automatically rotate the images to better fit the PDF page
+   */
+  autoRotate?: boolean;
+  /**
+   * The color type of the output image(s)
+   */
+  colorType?: "color" | "greyscale" | "blackwhite";
+  /**
+   * Option to determine how the image will fit onto the page
+   */
+  fitOption?: "fillPage" | "fitDocumentToImage" | "maintainAspectRatio";
+}
+export interface CropPdfForm {
+  /**
+   * Enable auto-crop to detect and remove white space
+   */
+  autoCrop?: boolean;
+  /**
+   * The height of the crop area
+   */
+  height?: number;
+  /**
+   * Whether to remove text outside the crop area (keeps images)
+   */
+  removeDataOutsideCrop?: boolean;
+  /**
+   * The width of the crop area
+   */
+  width?: number;
+  /**
+   * The x-coordinate of the top-left corner of the crop area
+   */
+  x?: number;
+  /**
+   * The y-coordinate of the top-left corner of the crop area
+   */
+  y?: number;
+}
+export interface DeleteAttachmentRequest {
+  /**
+   * The name of the attachment to delete
+   */
+  attachmentName: string;
+}
+export interface EditTableOfContentsRequest {
+  /**
+   * Bookmark structure in JSON format
+   */
+  bookmarkData?: string;
+  /**
+   * Whether to replace existing bookmarks or append to them
+   */
+  replaceExisting?: boolean;
+}
+export interface EditTextRequest {
+  /**
+   * Ordered list of find/replace operations. Each replaces every occurrence on the selected pages, in order; later operations see the result of earlier ones (so 'foo'->'foos' then 'foos'->'bars' turns 'foo' into 'bars').
+   */
+  edits: EditTextOperation[];
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+  /**
+   * Whether matches must be whole words (boundaries determined by non-word characters)
+   */
+  wholeWordSearch?: boolean;
+}
+/**
+ * Ordered list of find/replace operations. Each replaces every occurrence on the selected pages, in order; later operations see the result of earlier ones (so 'foo'->'foos' then 'foos'->'bars' turns 'foo' into 'bars').
+ */
+export interface EditTextOperation {
+  /**
+   * The literal text to find.
+   */
+  find: string;
+  /**
+   * The replacement text. May be empty to delete the matched text.
+   */
+  replace: string;
+}
+export interface EmlToPdfRequest {
+  /**
+   * Download HTML intermediate file instead of PDF
+   */
+  downloadHtml?: boolean;
+  /**
+   * Include CC and BCC recipients in header (if available)
+   */
+  includeAllRecipients?: boolean;
+  /**
+   * Include email attachments in the PDF output
+   */
+  includeAttachments?: boolean;
+  /**
+   * Maximum attachment size in MB to include (default 10MB, range: 1-100)
+   */
+  maxAttachmentSizeMB?: number;
+}
+export type ExtractAttachmentsRequest = Record<string, never>;
+export interface ExtractHeaderRequest {
+  /**
+   * Flag indicating whether to use the first text as a fallback if no suitable title is found. Defaults to false.
+   */
+  useFirstTextAsFallback?: boolean;
+}
+export interface ExtractImageScansRequest {
+  /**
+   * The angle threshold for the image scan extraction
+   */
+  angleThreshold?: number;
+  /**
+   * The border size for the image scan extraction
+   */
+  borderSize?: number;
+  /**
+   * The minimum area for the image scan extraction
+   */
+  minArea?: number;
+  /**
+   * The minimum contour area for the image scan extraction
+   */
+  minContourArea?: number;
+  /**
+   * The tolerance for the image scan extraction
+   */
+  tolerance?: number;
+}
+export interface FlattenRequest {
+  /**
+   * True to flatten only the forms, false to flatten full PDF (Convert page to image)
+   */
+  flattenOnlyForms?: boolean;
+  /**
+   * Optional DPI for page rendering when flattening the full document.
+   */
+  renderDpi?: number;
+}
+export interface GeneralExtractBookmarksRequest {
+  file: string;
+}
+export type GeneralFile = Record<string, never>;
+export type GeneralPdfToSinglePageRequest = Record<string, never>;
+export type GeneralRemoveImagePdfRequest = Record<string, never>;
+export interface HTMLToPdfRequest {
+  /**
+   * Zoom level for displaying the website. Default is '1'.
+   */
+  zoom?: number;
+}
+export type ListAttachmentsRequest = Record<string, never>;
+export interface ManualRedactPdfRequest {
+  /**
+   * Convert the redacted PDF to an image
+   */
+  convertPDFToImage?: boolean;
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+  /**
+   * The color used to fully redact certain pages
+   */
+  pageRedactionColor?: string;
+  /**
+   * A list of areas that should be redacted
+   */
+  redactions: RedactionArea[];
+}
+/**
+ * A list of areas that should be redacted
+ */
+export interface RedactionArea {
+  /**
+   * The color used to redact the specified area.
+   */
+  color?: string;
+  /**
+   * The height of the area to be redacted.
+   */
+  height?: number;
+  /**
+   * The page on which the area should be redacted.
+   */
+  page?: number;
+  /**
+   * The width of the area to be redacted.
+   */
+  width?: number;
+  /**
+   * The left edge point of the area to be redacted.
+   */
+  x?: number;
+  /**
+   * The top edge point of the area to be redacted.
+   */
+  y?: number;
+}
+export interface MergeMultiplePagesRequest {
+  /**
+   * Boolean for if you wish to add border around the pages
+   */
+  addBorder?: boolean;
+  /**
+   * The arrangement of pages on the sheet: BY_ROWS fills pages row by row, while BY_COLUMNS fills pages column by column.
+   */
+  arrangement?: "BY_ROWS" | "BY_COLUMNS";
+  /**
+   * Border width (in points) to apply around each page when merging
+   */
+  borderWidth?: number;
+  /**
+   * Bottom margin (in points) to apply to the output pages when merging
+   */
+  bottomMargin?: number;
+  /**
+   * Number of columns
+   */
+  cols?: number;
+  /**
+   * Inner margin (in points) to apply around each page when merging
+   */
+  innerMargin?: number;
+  /**
+   * Left margin (in points) to apply to the output pages when merging
+   */
+  leftMargin?: number;
+  /**
+   * Input mode: DEFAULT uses pagesPerSheet; CUSTOM uses explicit cols x rows.
+   */
+  mode?: "DEFAULT" | "CUSTOM";
+  /**
+   * The orientation of the output PDF pages
+   */
+  orientation?: "PORTRAIT" | "LANDSCAPE";
+  /**
+   * The number of pages to fit onto a single sheet in the output PDF.
+   */
+  pagesPerSheet?: 2 | 4 | 9 | 16;
+  /**
+   * The direction in which pages are arranged on the sheet: LTR (left-to-right) or RTL (right-to-left).
+   */
+  readingDirection?: "LTR" | "RTL";
+  /**
+   * Right margin (in points) to apply to the output pages when merging
+   */
+  rightMargin?: number;
+  /**
+   * Number of rows
+   */
+  rows?: number;
+  /**
+   * Top margin (in points) to apply to the output pages when merging
+   */
+  topMargin?: number;
+}
+export interface MergePdfsRequest {
+  /**
+   * JSON array of client-provided IDs for each uploaded file (same order as fileInput)
+   */
+  clientFileIds?: string;
+  fileOrder?: string;
+  /**
+   * Flag indicating whether to generate a table of contents for the merged PDF. If true, a table of contents will be created using the input filenames as chapter names.
+   */
+  generateToc?: boolean;
+  /**
+   * Flag indicating whether to remove certification signatures from the merged PDF. If true, all certification signatures will be removed from the final merged document.
+   */
+  removeCertSign?: boolean;
+  /**
+   * The type of sorting to be applied on the input files before merging.
+   */
+  sortType?:
+    | "orderProvided"
+    | "byFileName"
+    | "byDateModified"
+    | "byDateCreated"
+    | "byPDFTitle";
+}
+export interface MetadataRequest {
+  /**
+   * Map list of key and value of custom parameters. Note these must start with customKey and customValue if they are non-standard
+   */
+  allRequestParams?: {
+    /**
+     * Map list of key and value of custom parameters. Note these must start with customKey and customValue if they are non-standard
+     */
+    [k: string]: string | undefined;
+  };
+  /**
+   * The author of the document
+   */
+  author?: string;
+  /**
+   * The creation date of the document (format: yyyy/MM/dd HH:mm:ss)
+   */
+  creationDate?: string;
+  /**
+   * The creator of the document
+   */
+  creator?: string;
+  /**
+   * Delete all metadata if set to true
+   */
+  deleteAll?: boolean;
+  /**
+   * The keywords for the document
+   */
+  keywords?: string;
+  /**
+   * The modification date of the document (format: yyyy/MM/dd HH:mm:ss)
+   */
+  modificationDate?: string;
+  /**
+   * The producer of the document
+   */
+  producer?: string;
+  /**
+   * The subject of the document
+   */
+  subject?: string;
+  /**
+   * The title of the document
+   */
+  title?: string;
+  /**
+   * The trapped status of the document
+   */
+  trapped?: "True" | "False" | "Unknown";
+}
+export type MiscDecompressPdfRequest = Record<string, never>;
+export type MiscRepairRequest = Record<string, never>;
+export type MiscShowJavascriptRequest = Record<string, never>;
+export type MiscUnlockPdfFormsRequest = Record<string, never>;
+export interface OptimizePdfRequest {
+  /**
+   * The expected output size, e.g. '100MB', '25KB', etc.
+   */
+  expectedOutputSize?: string;
+  /**
+   * Whether to convert the PDF to grayscale. Default is false.
+   */
+  grayscale?: boolean;
+  /**
+   * Whether to convert images to high-contrast line art using ImageMagick. Default is false.
+   */
+  lineArt?: boolean;
+  /**
+   * Edge detection strength to use for line art conversion (1-3). This maps to ImageMagick's -edge radius.
+   */
+  lineArtEdgeLevel?: 1 | 2 | 3;
+  /**
+   * Threshold to use for line art conversion (0-100).
+   */
+  lineArtThreshold?: number;
+  /**
+   * Whether to linearize the PDF for faster web viewing. Default is false.
+   */
+  linearize?: boolean;
+  /**
+   * Whether to normalize the PDF content for better compatibility. Default is false.
+   */
+  normalize?: boolean;
+  /**
+   * The level of optimization to apply to the PDF file. Higher values indicate greater compression but may reduce quality.
+   */
+  optimizeLevel: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
+}
+export interface OverlayImageRequest {
+  /**
+   * Whether to overlay the image onto every page of the PDF.
+   */
+  everyPage?: boolean;
+  imageFile: string;
+  /**
+   * The x-coordinate at which to place the top-left corner of the image.
+   */
+  x?: number;
+  /**
+   * The y-coordinate at which to place the top-left corner of the image.
+   */
+  y?: number;
+}
+export interface OverlayPdfsRequest {
+  /**
+   * An array of integers specifying the number of times each corresponding overlay file should be applied in the 'FixedRepeatOverlay' mode. This should match the length of the overlayFiles array.
+   */
+  counts?: number[];
+  /**
+   * An array of PDF files to be used as overlays on the base PDF. The order in these files is applied based on the selected mode.
+   */
+  overlayFiles: string[];
+  /**
+   * The mode of overlaying: 'SequentialOverlay' for sequential application, 'InterleavedOverlay' for round-robin application, 'FixedRepeatOverlay' for fixed repetition based on provided counts
+   */
+  overlayMode:
+    | "SequentialOverlay"
+    | "InterleavedOverlay"
+    | "FixedRepeatOverlay";
+  /**
+   * Overlay position 0 is Foregound, 1 is Background
+   */
+  overlayPosition: 0 | 1;
+}
+export interface PDFExtractImagesRequest {
+  /**
+   * The output image format e.g., 'png', 'jpeg', or 'gif'
+   */
+  format?: "png" | "jpeg" | "gif";
+}
+export interface PDFPasswordRequest {
+  /**
+   * The password of the PDF file
+   */
+  password?: string;
+}
+export type PDFVerificationRequest = Record<string, never>;
+export interface PDFWithPageNums {
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+}
+export interface PdfToPdfARequest {
+  /**
+   * The output format type (PDF/A or PDF/X)
+   */
+  outputFormat:
+    | "pdfa"
+    | "pdfa-1"
+    | "pdfa-2"
+    | "pdfa-2b"
+    | "pdfa-3"
+    | "pdfa-3b"
+    | "pdfx";
+  /**
+   * If true, the conversion will fail if the output is not perfectly compliant
+   */
+  strict?: boolean;
+}
+export interface PdfToPresentationRequest {
+  /**
+   * The output Presentation format
+   */
+  outputFormat: "ppt" | "pptx" | "odp";
+}
+export interface PdfToTextOrRTFRequest {
+  /**
+   * The output Text or RTF format
+   */
+  outputFormat: "rtf" | "txt";
+}
+export interface PdfToWordRequest {
+  /**
+   * The output Word document format
+   */
+  outputFormat: "doc" | "docx" | "odt";
+}
+export interface PdfVectorExportRequest {
+  /**
+   * Target vector format extension
+   */
+  outputFormat?: "eps" | "ps" | "pcl" | "xps";
+  /**
+   * Apply Ghostscript prepress settings
+   */
+  prepress?: true | false;
+}
+export interface Pkcs11CertificatesRequest {
+  libraryPath?: string;
+  pin?: string;
+  slot?: number;
+}
+export interface PosterPdfRequest {
+  /**
+   * Target page size for output chunks (e.g., 'A4', 'Letter', 'A3')
+   */
+  pageSize: "A4" | "Letter" | "A3" | "A5" | "Legal" | "Tabloid";
+  /**
+   * Split right-to-left instead of left-to-right
+   */
+  rightToLeft?: boolean;
+  /**
+   * Horizontal decimation factor (how many columns to split into)
+   */
+  xFactor?: number;
+  /**
+   * Vertical decimation factor (how many rows to split into)
+   */
+  yFactor?: number;
+}
+export interface ProcessPdfWithOcrRequest {
+  /**
+   * Clean the input file if set to true
+   */
+  clean?: boolean;
+  /**
+   * Clean the final output if set to true
+   */
+  cleanFinal?: boolean;
+  /**
+   * Deskew the input file if set to true
+   */
+  deskew?: boolean;
+  /**
+   * List of languages to use in OCR processing, e.g., 'eng', 'deu'
+   */
+  languages?: string[];
+  /**
+   * Specify the OCR render type, either 'hocr' or 'sandwich'
+   */
+  ocrRenderType?: "hocr" | "sandwich";
+  /**
+   * Specify the OCR type, e.g., 'skip-text', 'force-ocr', or 'Normal'
+   */
+  ocrType: "skip-text" | "force-ocr" | "Normal";
+  /**
+   * Remove images from the output PDF if set to true
+   */
+  removeImagesAfter?: boolean;
+  /**
+   * Include OCR text in a sidecar text file if set to true
+   */
+  sidecar?: boolean;
+}
+export interface RearrangePagesRequest {
+  /**
+   * The custom mode for page rearrangement. Valid values are:
+   * CUSTOM: Uses order defined in PageNums DUPLICATE: Duplicate pages n times (if Page order defined as 4, then duplicates each page 4 times)REVERSE_ORDER: Reverses the order of all pages.
+   * DUPLEX_SORT: Sorts pages as if all fronts were scanned then all backs in reverse (1, n, 2, n-1, ...). BOOKLET_SORT: Arranges pages for booklet printing (last, first, second, second last, ...).
+   * ODD_EVEN_SPLIT: Splits and arranges pages into odd and even numbered pages.
+   * REMOVE_FIRST: Removes the first page.
+   * REMOVE_LAST: Removes the last page.
+   * REMOVE_FIRST_AND_LAST: Removes both the first and the last pages.
+   *
+   */
+  customMode?:
+    | "CUSTOM"
+    | "REVERSE_ORDER"
+    | "DUPLEX_SORT"
+    | "BOOKLET_SORT"
+    | "SIDE_STITCH_BOOKLET_SORT"
+    | "ODD_EVEN_SPLIT"
+    | "REMOVE_FIRST"
+    | "REMOVE_LAST"
+    | "REMOVE_FIRST_AND_LAST"
+    | "DUPLICATE";
+  /**
+   * The pages to select, Supports ranges (e.g., '1,3,5-9'), or 'all' or functions in the format 'an+b' where 'a' is the multiplier of the page number 'n', and 'b' is a constant (e.g., '2n+1', '3n', '6n-5')
+   */
+  pageNumbers?: string;
+}
+export interface RedactExecuteRequest {
+  /**
+   * Rectangular areas to black out, each defined by a page number and bounding box coordinates.
+   */
+  imageBoxes?: ImageBox[];
+  /**
+   * Text ranges to redact by specifying a start and end anchor phrase. All content between the two phrases (inclusive) is redacted. Anchors work best when short and unique. They must appear verbatim in the document.
+   */
+  ranges?: TextRange[];
+  /**
+   * 1-indexed page numbers to redact all detected images from. Pass an empty list to redact images from every page. Omit or pass null to skip image redaction entirely.
+   */
+  redactImagePages?: number[];
+  /**
+   * Regex patterns to match and redact. Each match anywhere in the document is blacked out. Uses Java/PCRE regex syntax. Well-suited for strings that follow known patterns, like phone numbers, email addresses, national ID numbers, or dates (which can appear with different separators, optional country codes, etc.). For fixed known strings such as names, use textValues instead.
+   */
+  regexPatterns?: string[];
+  style?: RedactStyle;
+  /**
+   * Exact strings to find and black out. One entry per phrase to redact. Best for known names, identifiers, and specific text found in the document.
+   */
+  textValues?: string[];
+  /**
+   * 1-indexed page numbers to wipe entirely (all content removed from those pages).
+   */
+  wipePages?: number[];
+}
+/**
+ * Rectangular areas to black out, each defined by a page number and bounding box coordinates.
+ */
+export interface ImageBox {
+  /**
+   * 0-indexed page number (first page = 0).
+   */
+  pageIndex: number;
+  /**
+   * Left x coordinate of the redaction rectangle in PDF user-space points.
+   */
+  x1: number;
+  /**
+   * Right x coordinate of the redaction rectangle in PDF user-space points.
+   */
+  x2: number;
+  /**
+   * Top y coordinate of the redaction rectangle in PDF user-space points.
+   */
+  y1: number;
+  /**
+   * Bottom y coordinate of the redaction rectangle in PDF user-space points.
+   */
+  y2: number;
+}
+/**
+ * Text ranges to redact by specifying a start and end anchor phrase. All content between the two phrases (inclusive) is redacted. Anchors work best when short and unique. They must appear verbatim in the document.
+ */
+export interface TextRange {
+  /**
+   * A short, distinctive phrase (5–15 words) that marks where redaction ends (inclusive). Must appear verbatim in the document. Shorter phrases match more reliably.
+   */
+  endString: string;
+  /**
+   * A short, distinctive phrase (5–15 words) that marks where redaction begins (inclusive). Must appear verbatim in the document — e.g. a section heading or a unique sentence fragment.
+   */
+  startString: string;
+}
+/**
+ * Redaction style options
+ */
+export interface RedactStyle {
+  /**
+   * Hex redaction box color
+   */
+  color?: string;
+  /**
+   * Rasterize output to prevent text extraction
+   */
+  convertToImage?: boolean;
+  /**
+   * Extra padding around each box in points
+   */
+  padding?: number;
+  /**
+   * Execution strategy hint for the redaction pipeline
+   */
+  strategy?: "AUTO" | "OVERLAY_ONLY" | "IMAGE_FINALIZE";
+}
+export interface RedactPdfRequest {
+  /**
+   * Convert the redacted PDF to an image
+   */
+  convertPDFToImage?: boolean;
+  /**
+   * Custom padding for redaction
+   */
+  customPadding: number;
+  /**
+   * List of text to redact from the PDF
+   */
+  listOfText?: string;
+  /**
+   * The color for redaction
+   */
+  redactColor?: string;
+  /**
+   * Whether to use regex for the listOfText
+   */
+  useRegex?: boolean;
+  /**
+   * Whether to use whole word search
+   */
+  wholeWordSearch?: boolean;
+}
+export interface RemoveBlankPagesRequest {
+  /**
+   * The threshold value to determine blank pages
+   */
+  threshold?: number;
+  /**
+   * The percentage of white color on a page to consider it as blank
+   */
+  whitePercent?: number;
+}
+export interface RenameAttachmentRequest {
+  /**
+   * The current name of the attachment to rename
+   */
+  attachmentName: string;
+  /**
+   * The new name for the attachment
+   */
+  newName: string;
+}
+export interface ReplaceAndInvertColorRequest {
+  /**
+   * If CUSTOM_COLOR option selected, then pick the custom color for background. Expected color value should be 24bit decimal value of a color
+   */
+  backGroundColor?: string;
+  /**
+   * If HIGH_CONTRAST_COLOR option selected, then pick the default color option for text and background.
+   */
+  highContrastColorCombination?:
+    | "WHITE_TEXT_ON_BLACK"
+    | "BLACK_TEXT_ON_WHITE"
+    | "YELLOW_TEXT_ON_BLACK"
+    | "GREEN_TEXT_ON_BLACK";
+  /**
+   * Replace and Invert color options of a pdf.
+   */
+  replaceAndInvertOption?:
+    | "HIGH_CONTRAST_COLOR"
+    | "CUSTOM_COLOR"
+    | "FULL_INVERSION"
+    | "COLOR_SPACE_CONVERSION";
+  /**
+   * If CUSTOM_COLOR option selected, then pick the custom color for text. Expected color value should be 24bit decimal value of a color
+   */
+  textColor?: string;
+}
+export interface RotatePDFRequest {
+  /**
+   * The clockwise angle by which to rotate all pages in the PDF file. Must be a multiple of 90.
+   */
+  angle: 0 | 90 | 180 | 270;
+}
+export interface SanitizePdfRequest {
+  /**
+   * Remove embedded files from the PDF
+   */
+  removeEmbeddedFiles?: boolean;
+  /**
+   * Remove fonts from the PDF
+   */
+  removeFonts?: boolean;
+  /**
+   * Remove JavaScript actions from the PDF
+   */
+  removeJavaScript?: boolean;
+  /**
+   * Remove links from the PDF
+   */
+  removeLinks?: boolean;
+  /**
+   * Remove document info metadata from the PDF
+   */
+  removeMetadata?: boolean;
+  /**
+   * Remove XMP metadata from the PDF
+   */
+  removeXMPMetadata?: boolean;
+}
+export interface ScalePagesRequest {
+  /**
+   * Orientation to apply to the target page size. Ignored when pageSize is KEEP.
+   */
+  orientation?: "PORTRAIT" | "LANDSCAPE";
+  /**
+   * The scale of pages in the output PDF. Acceptable values are A0-A6, LETTER, LEGAL, KEEP.
+   */
+  pageSize:
+    | "A0"
+    | "A1"
+    | "A2"
+    | "A3"
+    | "A4"
+    | "A5"
+    | "A6"
+    | "LETTER"
+    | "LEGAL"
+    | "KEEP";
+  /**
+   * The scale of the content on the pages of the output PDF. Acceptable values are floats.
+   */
+  scaleFactor?: number;
+}
+export interface ScannerEffectRequest {
+  /**
+   * Whether advanced settings are enabled
+   */
+  advancedEnabled?: boolean;
+  /**
+   * Blur amount (0 = none, higher = more blur)
+   */
+  blur?: number;
+  /**
+   * Border thickness in pixels
+   */
+  border?: number;
+  /**
+   * Brightness multiplier (1.0 = no change)
+   */
+  brightness?: number;
+  /**
+   * Colorspace for output image
+   */
+  colorspace?: "grayscale" | "color";
+  /**
+   * Contrast multiplier (1.0 = no change)
+   */
+  contrast?: number;
+  /**
+   * Noise amount (0 = none, higher = more noise)
+   */
+  noise?: number;
+  /**
+   * Scan quality preset
+   */
+  quality: "low" | "medium" | "high";
+  /**
+   * Rendering resolution in DPI
+   */
+  resolution?: number;
+  /**
+   * Base rotation in degrees
+   */
+  rotate?: number;
+  /**
+   * Random rotation variance in degrees
+   */
+  rotateVariance?: number;
+  /**
+   * Rotation preset
+   */
+  rotation: "none" | "slight" | "moderate" | "severe";
+  rotationValue?: number;
+  /**
+   * Simulate yellowed paper
+   */
+  yellowish?: boolean;
+}
+export interface SecurityCertSignSessionsRequest {
+  file: string;
+  request?: WorkflowCreationRequest;
+}
+export interface WorkflowCreationRequest {
+  documentName?: string;
+  dueDate?: string;
+  message?: string;
+  ownerEmail?: string;
+  participantEmails?: string[];
+  participantUserIds?: number[];
+  workflowMetadata?: string;
+  workflowType?: "SIGNING" | "REVIEW" | "APPROVAL";
+}
+export interface SecurityCertSignValidateCertificateRequest {
+  certType: string;
+  jksFile?: string;
+  p12File?: string;
+  password?: string;
+}
+export type SecurityGetInfoOnPdfRequest = Record<string, never>;
+export type SecurityRemoveCertSignRequest = Record<string, never>;
+export interface SignPDFWithCertRequest {
+  /**
+   * The alias of the certificate to sign with. Required for WINDOWS_STORE and recommended for PKCS11 tokens holding multiple certificates.
+   */
+  alias?: string;
+  certFile?: string;
+  /**
+   * The type of the digital certificate. WINDOWS_STORE and PKCS11 are hardware-backed and only available in the desktop app.
+   */
+  certType:
+    | "PEM"
+    | "PKCS12"
+    | "PFX"
+    | "JKS"
+    | "SERVER"
+    | "WINDOWS_STORE"
+    | "PKCS11";
+  jksFile?: string;
+  /**
+   * The location where the PDF is signed
+   */
+  location?: string;
+  /**
+   * The name of the signer
+   */
+  name?: string;
+  p12File?: string;
+  /**
+   * The page number where the signature should be visible. This is required if showSignature is set to true
+   */
+  pageNumber?: number;
+  /**
+   * The password for the keystore / private key, or the token PIN for PKCS11
+   */
+  password?: string;
+  /**
+   * Absolute path to the PKCS#11 driver library (required for PKCS11 type). Must be an allowed driver - a detected one or configured via STIRLING_PKCS11_LIBRARIES.
+   */
+  pkcs11LibraryPath?: string;
+  /**
+   * Optional PKCS#11 slot index. When omitted the first slot with a token is used.
+   */
+  pkcs11Slot?: number;
+  privateKeyFile?: string;
+  /**
+   * The reason for signing the PDF
+   */
+  reason?: string;
+  /**
+   * Whether to visually show a signature logo along with the signature
+   */
+  showLogo?: boolean;
+  /**
+   * Whether to visually show the signature in the PDF file
+   */
+  showSignature?: boolean;
+}
+export interface SignatureValidationRequest {
+  certFile?: string;
+}
+export interface SplitPagesRequest {
+  /**
+   * Split points - page numbers after which the PDF will be cut. For example, `"2"` produces two documents (pages 1-2 and pages 3+); `"2,5"` produces three (pages 1-2, 3-5, 6+). Supports ranges (e.g. `"1,3,5-9"` splits after pages 1, 3, 5, 6, 7, 8, 9, yielding 8 documents), `"all"` (split after every page), or functions like `"2n+1"`, `"3n"`, `"6n-5"`.
+   */
+  pageNumbers?: string;
+}
+export interface SplitPdfByChaptersRequest {
+  /**
+   * Whether to allow duplicates or not
+   */
+  allowDuplicates?: boolean;
+  /**
+   * Maximum bookmark level required
+   */
+  bookmarkLevel?: number;
+  /**
+   * Whether to include Metadata or not
+   */
+  includeMetadata?: boolean;
+}
+export interface SplitPdfBySectionsRequest {
+  /**
+   * Number of horizontal divisions for each PDF page
+   */
+  horizontalDivisions?: number;
+  /**
+   * Merge the split documents into a single PDF
+   */
+  merge?: boolean;
+  /**
+   * Pages to be split by section
+   */
+  pageNumbers?: string;
+  /**
+   * Modes for page split. Valid values are:
+   * SPLIT_ALL_EXCEPT_FIRST_AND_LAST: Splits all except the first and the last pages.
+   * SPLIT_ALL_EXCEPT_FIRST: Splits all except the first page.
+   * SPLIT_ALL_EXCEPT_LAST: Splits all except the last page.
+   * SPLIT_ALL: Splits all pages.
+   * CUSTOM: Custom split.
+   *
+   */
+  splitMode?:
+    | "CUSTOM"
+    | "SPLIT_ALL_EXCEPT_FIRST_AND_LAST"
+    | "SPLIT_ALL_EXCEPT_FIRST"
+    | "SPLIT_ALL_EXCEPT_LAST"
+    | "SPLIT_ALL";
+  /**
+   * Number of vertical divisions for each PDF page
+   */
+  verticalDivisions?: number;
+}
+export interface SplitPdfBySizeOrCountRequest {
+  /**
+   * Determines the type of split: 0 for size, 1 for page count, 2 for document count
+   */
+  splitType?: number;
+  /**
+   * Value for split: size in MB (e.g., '10MB') or number of pages (e.g., '5')
+   */
+  splitValue?: string;
+}
+export interface SvgToPdfRequest {
+  /**
+   * Whether to combine all SVG files into a single PDF (each SVG as a separate page) or create separate PDF files for each SVG.
+   */
+  combineIntoSinglePdf?: boolean;
+}
+export interface TimestampPdfRequest {
+  /**
+   * URL of the RFC 3161 Time Stamp Authority (TSA) server. Must be one of the built-in presets (DigiCert, Sectigo, SSL.com, FreeTSA, MeSign) or an admin-configured URL in settings.yml (security.timestamp.customTsaUrls). If omitted, the server default is used.
+   */
+  tsaUrl?: string;
+}
+export interface UrlToPdfRequest {
+  /**
+   * The input URL to be converted to a PDF file
+   */
+  urlInput: string;
+}
+
+/** Endpoint path for a generated tool operation (the operation identity across languages). */
+export type ToolEndpoint =
+  | "/api/v1/convert/cbr/pdf"
+  | "/api/v1/convert/cbz/pdf"
+  | "/api/v1/convert/ebook/pdf"
+  | "/api/v1/convert/eml/pdf"
+  | "/api/v1/convert/file/pdf"
+  | "/api/v1/convert/html/pdf"
+  | "/api/v1/convert/img/pdf"
+  | "/api/v1/convert/markdown/pdf"
+  | "/api/v1/convert/pdf/cbr"
+  | "/api/v1/convert/pdf/cbz"
+  | "/api/v1/convert/pdf/csv"
+  | "/api/v1/convert/pdf/epub"
+  | "/api/v1/convert/pdf/html"
+  | "/api/v1/convert/pdf/img"
+  | "/api/v1/convert/pdf/markdown"
+  | "/api/v1/convert/pdf/pdfa"
+  | "/api/v1/convert/pdf/presentation"
+  | "/api/v1/convert/pdf/text"
+  | "/api/v1/convert/pdf/text-editor"
+  | "/api/v1/convert/pdf/text-editor/metadata"
+  | "/api/v1/convert/pdf/vector"
+  | "/api/v1/convert/pdf/word"
+  | "/api/v1/convert/pdf/xlsx"
+  | "/api/v1/convert/pdf/xml"
+  | "/api/v1/convert/svg/pdf"
+  | "/api/v1/convert/text-editor/pdf"
+  | "/api/v1/convert/url/pdf"
+  | "/api/v1/convert/vector/pdf"
+  | "/api/v1/general/booklet-imposition"
+  | "/api/v1/general/crop"
+  | "/api/v1/general/edit-table-of-contents"
+  | "/api/v1/general/edit-text"
+  | "/api/v1/general/extract-bookmarks"
+  | "/api/v1/general/merge-pdfs"
+  | "/api/v1/general/multi-page-layout"
+  | "/api/v1/general/overlay-pdfs"
+  | "/api/v1/general/pdf-to-single-page"
+  | "/api/v1/general/rearrange-pages"
+  | "/api/v1/general/remove-image-pdf"
+  | "/api/v1/general/remove-pages"
+  | "/api/v1/general/rotate-pdf"
+  | "/api/v1/general/scale-pages"
+  | "/api/v1/general/split-by-size-or-count"
+  | "/api/v1/general/split-for-poster-print"
+  | "/api/v1/general/split-pages"
+  | "/api/v1/general/split-pdf-by-chapters"
+  | "/api/v1/general/split-pdf-by-sections"
+  | "/api/v1/misc/add-attachments"
+  | "/api/v1/misc/add-comments"
+  | "/api/v1/misc/add-image"
+  | "/api/v1/misc/add-page-numbers"
+  | "/api/v1/misc/add-stamp"
+  | "/api/v1/misc/auto-rename"
+  | "/api/v1/misc/auto-split-pdf"
+  | "/api/v1/misc/compress-pdf"
+  | "/api/v1/misc/decompress-pdf"
+  | "/api/v1/misc/delete-attachment"
+  | "/api/v1/misc/extract-attachments"
+  | "/api/v1/misc/extract-image-scans"
+  | "/api/v1/misc/extract-images"
+  | "/api/v1/misc/flatten"
+  | "/api/v1/misc/list-attachments"
+  | "/api/v1/misc/ocr-pdf"
+  | "/api/v1/misc/remove-blanks"
+  | "/api/v1/misc/rename-attachment"
+  | "/api/v1/misc/repair"
+  | "/api/v1/misc/replace-invert-pdf"
+  | "/api/v1/misc/scanner-effect"
+  | "/api/v1/misc/show-javascript"
+  | "/api/v1/misc/unlock-pdf-forms"
+  | "/api/v1/misc/update-metadata"
+  | "/api/v1/security/add-password"
+  | "/api/v1/security/add-watermark"
+  | "/api/v1/security/auto-redact"
+  | "/api/v1/security/cert-sign"
+  | "/api/v1/security/cert-sign/hardware/pkcs11-certificates"
+  | "/api/v1/security/cert-sign/sessions"
+  | "/api/v1/security/cert-sign/validate-certificate"
+  | "/api/v1/security/get-info-on-pdf"
+  | "/api/v1/security/redact"
+  | "/api/v1/security/redact-execute"
+  | "/api/v1/security/remove-cert-sign"
+  | "/api/v1/security/remove-password"
+  | "/api/v1/security/sanitize-pdf"
+  | "/api/v1/security/timestamp-pdf"
+  | "/api/v1/security/validate-signature"
+  | "/api/v1/security/verify-pdf";
+
+/** Backend request-parameter model for each tool endpoint. */
+export interface ToolApiParams {
+  "/api/v1/convert/cbr/pdf": ConvertCbrToPdfRequest;
+  "/api/v1/convert/cbz/pdf": ConvertCbzToPdfRequest;
+  "/api/v1/convert/ebook/pdf": ConvertEbookToPdfRequest;
+  "/api/v1/convert/eml/pdf": EmlToPdfRequest;
+  "/api/v1/convert/file/pdf": GeneralFile;
+  "/api/v1/convert/html/pdf": HTMLToPdfRequest;
+  "/api/v1/convert/img/pdf": ConvertToPdfRequest;
+  "/api/v1/convert/markdown/pdf": GeneralFile;
+  "/api/v1/convert/pdf/cbr": ConvertPdfToCbrRequest;
+  "/api/v1/convert/pdf/cbz": ConvertPdfToCbzRequest;
+  "/api/v1/convert/pdf/csv": PDFWithPageNums;
+  "/api/v1/convert/pdf/epub": ConvertPdfToEpubRequest;
+  "/api/v1/convert/pdf/html": ConvertPdfHtmlRequest;
+  "/api/v1/convert/pdf/img": ConvertToImageRequest;
+  "/api/v1/convert/pdf/markdown": ConvertPdfMarkdownRequest;
+  "/api/v1/convert/pdf/pdfa": PdfToPdfARequest;
+  "/api/v1/convert/pdf/presentation": PdfToPresentationRequest;
+  "/api/v1/convert/pdf/text": PdfToTextOrRTFRequest;
+  "/api/v1/convert/pdf/text-editor": ConvertPdfTextEditorRequest;
+  "/api/v1/convert/pdf/text-editor/metadata": ConvertPdfTextEditorMetadataRequest;
+  "/api/v1/convert/pdf/vector": PdfVectorExportRequest;
+  "/api/v1/convert/pdf/word": PdfToWordRequest;
+  "/api/v1/convert/pdf/xlsx": PDFWithPageNums;
+  "/api/v1/convert/pdf/xml": ConvertPdfXmlRequest;
+  "/api/v1/convert/svg/pdf": SvgToPdfRequest;
+  "/api/v1/convert/text-editor/pdf": GeneralFile;
+  "/api/v1/convert/url/pdf": UrlToPdfRequest;
+  "/api/v1/convert/vector/pdf": PdfVectorExportRequest;
+  "/api/v1/general/booklet-imposition": BookletImpositionRequest;
+  "/api/v1/general/crop": CropPdfForm;
+  "/api/v1/general/edit-table-of-contents": EditTableOfContentsRequest;
+  "/api/v1/general/edit-text": EditTextRequest;
+  "/api/v1/general/extract-bookmarks": GeneralExtractBookmarksRequest;
+  "/api/v1/general/merge-pdfs": MergePdfsRequest;
+  "/api/v1/general/multi-page-layout": MergeMultiplePagesRequest;
+  "/api/v1/general/overlay-pdfs": OverlayPdfsRequest;
+  "/api/v1/general/pdf-to-single-page": GeneralPdfToSinglePageRequest;
+  "/api/v1/general/rearrange-pages": RearrangePagesRequest;
+  "/api/v1/general/remove-image-pdf": GeneralRemoveImagePdfRequest;
+  "/api/v1/general/remove-pages": PDFWithPageNums;
+  "/api/v1/general/rotate-pdf": RotatePDFRequest;
+  "/api/v1/general/scale-pages": ScalePagesRequest;
+  "/api/v1/general/split-by-size-or-count": SplitPdfBySizeOrCountRequest;
+  "/api/v1/general/split-for-poster-print": PosterPdfRequest;
+  "/api/v1/general/split-pages": SplitPagesRequest;
+  "/api/v1/general/split-pdf-by-chapters": SplitPdfByChaptersRequest;
+  "/api/v1/general/split-pdf-by-sections": SplitPdfBySectionsRequest;
+  "/api/v1/misc/add-attachments": AddAttachmentRequest;
+  "/api/v1/misc/add-comments": AddCommentsRequest;
+  "/api/v1/misc/add-image": OverlayImageRequest;
+  "/api/v1/misc/add-page-numbers": AddPageNumbersRequest;
+  "/api/v1/misc/add-stamp": AddStampRequest;
+  "/api/v1/misc/auto-rename": ExtractHeaderRequest;
+  "/api/v1/misc/auto-split-pdf": AutoSplitPdfRequest;
+  "/api/v1/misc/compress-pdf": OptimizePdfRequest;
+  "/api/v1/misc/decompress-pdf": MiscDecompressPdfRequest;
+  "/api/v1/misc/delete-attachment": DeleteAttachmentRequest;
+  "/api/v1/misc/extract-attachments": ExtractAttachmentsRequest;
+  "/api/v1/misc/extract-image-scans": ExtractImageScansRequest;
+  "/api/v1/misc/extract-images": PDFExtractImagesRequest;
+  "/api/v1/misc/flatten": FlattenRequest;
+  "/api/v1/misc/list-attachments": ListAttachmentsRequest;
+  "/api/v1/misc/ocr-pdf": ProcessPdfWithOcrRequest;
+  "/api/v1/misc/remove-blanks": RemoveBlankPagesRequest;
+  "/api/v1/misc/rename-attachment": RenameAttachmentRequest;
+  "/api/v1/misc/repair": MiscRepairRequest;
+  "/api/v1/misc/replace-invert-pdf": ReplaceAndInvertColorRequest;
+  "/api/v1/misc/scanner-effect": ScannerEffectRequest;
+  "/api/v1/misc/show-javascript": MiscShowJavascriptRequest;
+  "/api/v1/misc/unlock-pdf-forms": MiscUnlockPdfFormsRequest;
+  "/api/v1/misc/update-metadata": MetadataRequest;
+  "/api/v1/security/add-password": AddPasswordRequest;
+  "/api/v1/security/add-watermark": AddWatermarkRequest;
+  "/api/v1/security/auto-redact": RedactPdfRequest;
+  "/api/v1/security/cert-sign": SignPDFWithCertRequest;
+  "/api/v1/security/cert-sign/hardware/pkcs11-certificates": Pkcs11CertificatesRequest;
+  "/api/v1/security/cert-sign/sessions": SecurityCertSignSessionsRequest;
+  "/api/v1/security/cert-sign/validate-certificate": SecurityCertSignValidateCertificateRequest;
+  "/api/v1/security/get-info-on-pdf": SecurityGetInfoOnPdfRequest;
+  "/api/v1/security/redact": ManualRedactPdfRequest;
+  "/api/v1/security/redact-execute": RedactExecuteRequest;
+  "/api/v1/security/remove-cert-sign": SecurityRemoveCertSignRequest;
+  "/api/v1/security/remove-password": PDFPasswordRequest;
+  "/api/v1/security/sanitize-pdf": SanitizePdfRequest;
+  "/api/v1/security/timestamp-pdf": TimestampPdfRequest;
+  "/api/v1/security/validate-signature": SignatureValidationRequest;
+  "/api/v1/security/verify-pdf": PDFVerificationRequest;
+}
+
+/** Every generated tool endpoint, for iteration. */
+export const TOOL_ENDPOINTS = [
+  "/api/v1/convert/cbr/pdf",
+  "/api/v1/convert/cbz/pdf",
+  "/api/v1/convert/ebook/pdf",
+  "/api/v1/convert/eml/pdf",
+  "/api/v1/convert/file/pdf",
+  "/api/v1/convert/html/pdf",
+  "/api/v1/convert/img/pdf",
+  "/api/v1/convert/markdown/pdf",
+  "/api/v1/convert/pdf/cbr",
+  "/api/v1/convert/pdf/cbz",
+  "/api/v1/convert/pdf/csv",
+  "/api/v1/convert/pdf/epub",
+  "/api/v1/convert/pdf/html",
+  "/api/v1/convert/pdf/img",
+  "/api/v1/convert/pdf/markdown",
+  "/api/v1/convert/pdf/pdfa",
+  "/api/v1/convert/pdf/presentation",
+  "/api/v1/convert/pdf/text",
+  "/api/v1/convert/pdf/text-editor",
+  "/api/v1/convert/pdf/text-editor/metadata",
+  "/api/v1/convert/pdf/vector",
+  "/api/v1/convert/pdf/word",
+  "/api/v1/convert/pdf/xlsx",
+  "/api/v1/convert/pdf/xml",
+  "/api/v1/convert/svg/pdf",
+  "/api/v1/convert/text-editor/pdf",
+  "/api/v1/convert/url/pdf",
+  "/api/v1/convert/vector/pdf",
+  "/api/v1/general/booklet-imposition",
+  "/api/v1/general/crop",
+  "/api/v1/general/edit-table-of-contents",
+  "/api/v1/general/edit-text",
+  "/api/v1/general/extract-bookmarks",
+  "/api/v1/general/merge-pdfs",
+  "/api/v1/general/multi-page-layout",
+  "/api/v1/general/overlay-pdfs",
+  "/api/v1/general/pdf-to-single-page",
+  "/api/v1/general/rearrange-pages",
+  "/api/v1/general/remove-image-pdf",
+  "/api/v1/general/remove-pages",
+  "/api/v1/general/rotate-pdf",
+  "/api/v1/general/scale-pages",
+  "/api/v1/general/split-by-size-or-count",
+  "/api/v1/general/split-for-poster-print",
+  "/api/v1/general/split-pages",
+  "/api/v1/general/split-pdf-by-chapters",
+  "/api/v1/general/split-pdf-by-sections",
+  "/api/v1/misc/add-attachments",
+  "/api/v1/misc/add-comments",
+  "/api/v1/misc/add-image",
+  "/api/v1/misc/add-page-numbers",
+  "/api/v1/misc/add-stamp",
+  "/api/v1/misc/auto-rename",
+  "/api/v1/misc/auto-split-pdf",
+  "/api/v1/misc/compress-pdf",
+  "/api/v1/misc/decompress-pdf",
+  "/api/v1/misc/delete-attachment",
+  "/api/v1/misc/extract-attachments",
+  "/api/v1/misc/extract-image-scans",
+  "/api/v1/misc/extract-images",
+  "/api/v1/misc/flatten",
+  "/api/v1/misc/list-attachments",
+  "/api/v1/misc/ocr-pdf",
+  "/api/v1/misc/remove-blanks",
+  "/api/v1/misc/rename-attachment",
+  "/api/v1/misc/repair",
+  "/api/v1/misc/replace-invert-pdf",
+  "/api/v1/misc/scanner-effect",
+  "/api/v1/misc/show-javascript",
+  "/api/v1/misc/unlock-pdf-forms",
+  "/api/v1/misc/update-metadata",
+  "/api/v1/security/add-password",
+  "/api/v1/security/add-watermark",
+  "/api/v1/security/auto-redact",
+  "/api/v1/security/cert-sign",
+  "/api/v1/security/cert-sign/hardware/pkcs11-certificates",
+  "/api/v1/security/cert-sign/sessions",
+  "/api/v1/security/cert-sign/validate-certificate",
+  "/api/v1/security/get-info-on-pdf",
+  "/api/v1/security/redact",
+  "/api/v1/security/redact-execute",
+  "/api/v1/security/remove-cert-sign",
+  "/api/v1/security/remove-password",
+  "/api/v1/security/sanitize-pdf",
+  "/api/v1/security/timestamp-pdf",
+  "/api/v1/security/validate-signature",
+  "/api/v1/security/verify-pdf",
+] as const satisfies readonly ToolEndpoint[];
+
+/** Union of every generated tool request model. */
+export type ToolApiRequest = ToolApiParams[ToolEndpoint];
diff --git a/frontend/editor/src/core/utils/automationConverter.test.ts b/frontend/editor/src/core/utils/automationConverter.test.ts
index 88e313c604..d61d61f08e 100644
--- a/frontend/editor/src/core/utils/automationConverter.test.ts
+++ b/frontend/editor/src/core/utils/automationConverter.test.ts
@@ -120,6 +120,35 @@ describe("automationConverter", () => {
       const config = convertToFolderScanningConfig(automation, registry);
       expect(config.pipeline[0].operation).toBe("unknownTool");
     });
+
+    test("preserves frontend params on export, even for a tool with a toApiParams mapper", () => {
+      // The folder-scan export keeps frontend param shape; toApiParams runs at
+      // execution time, not here. A tool with a mapper still exports its UI
+      // field name (compressionLevel), not the backend one (optimizeLevel).
+      const withMapper = {
+        ...registry,
+        compress: {
+          operationConfig: {
+            endpoint: "/api/v1/misc/compress-pdf",
+            toApiParams: (p: Record<string, any>) => ({
+              optimizeLevel: p.compressionLevel,
+            }),
+          },
+        },
+      } as unknown as Partial<ToolRegistry>;
+      const automation: AutomationConfig = {
+        ...sampleAutomation,
+        operations: [
+          { operation: "compress", parameters: { compressionLevel: 9 } },
+        ],
+      };
+      const config = convertToFolderScanningConfig(automation, withMapper);
+      // The UI field name and value are preserved as-is (not optimizeLevel).
+      expect(config.pipeline[0].parameters).toEqual({
+        compressionLevel: 9,
+        fileInput: "automated",
+      });
+    });
   });
 
   describe("detectAutomationFormat", () => {
@@ -212,6 +241,72 @@ describe("automationConverter", () => {
       });
     });
 
+    test("round-trips frontend params losslessly, even for a tool with a mapper", () => {
+      // A value set in the UI survives an export then import unchanged. Because
+      // the export keeps frontend shape, a tool with a toApiParams mapper
+      // round-trips just like one without.
+      const withMapper = {
+        ...registry,
+        compress: {
+          operationConfig: {
+            endpoint: "/api/v1/misc/compress-pdf",
+            toApiParams: (p: Record<string, any>) => ({
+              optimizeLevel: p.compressionLevel,
+            }),
+          },
+        },
+      } as unknown as Partial<ToolRegistry>;
+      const automation: AutomationConfig = {
+        ...sampleAutomation,
+        operations: [
+          { operation: "compress", parameters: { compressionLevel: 9 } },
+        ],
+      };
+      const exported = convertToFolderScanningConfig(automation, withMapper);
+      const parsed = parseFolderScanningConfig(exported, withMapper);
+      expect(parsed.automation.operations[0]).toEqual({
+        operation: "compress",
+        parameters: { compressionLevel: 9 },
+      });
+    });
+
+    test("round-trips a tool whose endpoint depends on a frontend-only field", () => {
+      // Split-style tool: the endpoint is chosen from a frontend-only `method`
+      // field. Keeping frontend shape on export lets import replay the endpoint
+      // and resolve the tool.
+      const splitLike = {
+        ...registry,
+        splitLike: {
+          operationConfig: {
+            endpoint: (p: Record<string, any>) =>
+              p.method === "size"
+                ? "/api/v1/general/split-by-size"
+                : "/api/v1/general/split-pages",
+          },
+        },
+      } as unknown as Partial<ToolRegistry>;
+      const automation: AutomationConfig = {
+        ...sampleAutomation,
+        operations: [
+          {
+            operation: "splitLike",
+            parameters: { method: "size", value: "10MB" },
+          },
+        ],
+      };
+      const exported = convertToFolderScanningConfig(automation, splitLike);
+      expect(exported.pipeline[0]).toEqual({
+        operation: "/api/v1/general/split-by-size",
+        parameters: { method: "size", value: "10MB", fileInput: "automated" },
+      });
+      const parsed = parseFolderScanningConfig(exported, splitLike);
+      expect(parsed.unresolvedOperations).toEqual([]);
+      expect(parsed.automation.operations[0]).toEqual({
+        operation: "splitLike",
+        parameters: { method: "size", value: "10MB" },
+      });
+    });
+
     test("keeps unmappable endpoints verbatim and reports them", () => {
       const config = {
         name: "Mystery",
diff --git a/frontend/editor/src/core/utils/automationConverter.ts b/frontend/editor/src/core/utils/automationConverter.ts
index ce29f71bd0..05acbed8a6 100644
--- a/frontend/editor/src/core/utils/automationConverter.ts
+++ b/frontend/editor/src/core/utils/automationConverter.ts
@@ -83,7 +83,7 @@ export function convertToFolderScanningConfig(
         endpoint = endpointConfig;
       } else if (typeof endpointConfig === "function") {
         try {
-          endpoint = endpointConfig(op.parameters);
+          endpoint = endpointConfig(op.parameters) ?? undefined;
         } catch (error) {
           console.warn(
             `Failed to resolve dynamic endpoint for operation "${op.operation}". ` +
diff --git a/frontend/editor/src/core/utils/automationExecutor.ts b/frontend/editor/src/core/utils/automationExecutor.ts
index a29ffbcb83..f47778deda 100644
--- a/frontend/editor/src/core/utils/automationExecutor.ts
+++ b/frontend/editor/src/core/utils/automationExecutor.ts
@@ -88,12 +88,17 @@ const executeSingleFileOperation = async (
 ): Promise<File[]> => {
   const resultFiles: File[] = [];
 
-  for (const file of files) {
-    const endpoint =
-      typeof config.endpoint === "function"
-        ? config.endpoint(parameters)
-        : config.endpoint;
+  const endpoint =
+    typeof config.endpoint === "function"
+      ? config.endpoint(parameters)
+      : config.endpoint;
+  if (!endpoint) {
+    throw new Error(
+      "This operation has no backend endpoint and cannot be executed directly.",
+    );
+  }
 
+  for (const file of files) {
     const formData = config.buildFormData(parameters, file);
 
     const processedFiles = await executeApiRequest(
@@ -122,6 +127,11 @@ const executeMultiFileOperation = async (
     typeof config.endpoint === "function"
       ? config.endpoint(parameters)
       : config.endpoint;
+  if (!endpoint) {
+    throw new Error(
+      "This operation has no backend endpoint and cannot be executed directly.",
+    );
+  }
 
   const formData = config.buildFormData(parameters, files);
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3a9db8016c..3d0ff68cd2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -117,6 +117,7 @@
         "eslint": "^10.0.2",
         "fake-indexeddb": "^6.2.5",
         "jsdom": "^27.0.0",
+        "json-schema-to-typescript": "^15.0.4",
         "license-checker": "^25.0.1",
         "msw": "^2.14.6",
         "msw-storybook-addon": "^2.0.7",
@@ -192,6 +193,24 @@
         "url": "https://github.com/sponsors/antfu"
       }
     },
+    "node_modules/@apidevtools/json-schema-ref-parser": {
+      "version": "11.9.3",
+      "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-11.9.3.tgz",
+      "integrity": "sha512-60vepv88RwcJtSHrD6MjIL6Ta3SOYbgfnkHb+ppAVK+o9mXprRtulx7VlRl3lN3bbvysAfCS7WMVfhUYemB0IQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jsdevtools/ono": "^7.1.3",
+        "@types/json-schema": "^7.0.15",
+        "js-yaml": "^4.1.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/philsturgeon"
+      }
+    },
     "node_modules/@asamuzakjp/css-color": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-4.1.2.tgz",
@@ -2237,6 +2256,13 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@jsdevtools/ono": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/@jsdevtools/ono/-/ono-7.1.3.tgz",
+      "integrity": "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@kessler/tableify": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@kessler/tableify/-/tableify-1.0.2.tgz",
@@ -5663,6 +5689,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/lodash": {
+      "version": "4.17.24",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
+      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/mdast": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
@@ -10581,6 +10614,30 @@
       "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
       "license": "MIT"
     },
+    "node_modules/json-schema-to-typescript": {
+      "version": "15.0.4",
+      "resolved": "https://registry.npmjs.org/json-schema-to-typescript/-/json-schema-to-typescript-15.0.4.tgz",
+      "integrity": "sha512-Su9oK8DR4xCmDsLlyvadkXzX6+GGXJpbhwoLtOGArAG61dvbW4YQmSEno2y66ahpIdmLMg6YUf/QHLgiwvkrHQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@apidevtools/json-schema-ref-parser": "^11.5.5",
+        "@types/json-schema": "^7.0.15",
+        "@types/lodash": "^4.17.7",
+        "is-glob": "^4.0.3",
+        "js-yaml": "^4.1.0",
+        "lodash": "^4.17.21",
+        "minimist": "^1.2.8",
+        "prettier": "^3.2.5",
+        "tinyglobby": "^0.2.9"
+      },
+      "bin": {
+        "json2ts": "dist/src/cli.js"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -11102,6 +11159,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/log-symbols": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index dca6e68c43..e9d57208e2 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -137,6 +137,7 @@
     "eslint": "^10.0.2",
     "fake-indexeddb": "^6.2.5",
     "jsdom": "^27.0.0",
+    "json-schema-to-typescript": "^15.0.4",
     "license-checker": "^25.0.1",
     "msw": "^2.14.6",
     "msw-storybook-addon": "^2.0.7",

From 1df6a1759ce6d11390d89661e81fa879c1949306 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:37:35 +0100
Subject: [PATCH 11/35] Set App version to v2.14.1 (#6891)

Upped version in build.gradle then ran build so version falls through
---
 .github/aur/stirling-pdf-desktop/PKGBUILD                       | 2 +-
 .github/aur/stirling-pdf-server-bin/PKGBUILD                    | 2 +-
 build.gradle                                                    | 2 +-
 frontend/editor/src-tauri/tauri.conf.json                       | 2 +-
 frontend/editor/src/core/testing/serverExperienceSimulations.ts | 2 +-
 .../src/proprietary/testing/serverExperienceSimulations.ts      | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/aur/stirling-pdf-desktop/PKGBUILD b/.github/aur/stirling-pdf-desktop/PKGBUILD
index c02bde345e..5d92425b19 100644
--- a/.github/aur/stirling-pdf-desktop/PKGBUILD
+++ b/.github/aur/stirling-pdf-desktop/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
diff --git a/.github/aur/stirling-pdf-server-bin/PKGBUILD b/.github/aur/stirling-pdf-server-bin/PKGBUILD
index c73b1c5087..f5a2bf3c6c 100644
--- a/.github/aur/stirling-pdf-server-bin/PKGBUILD
+++ b/.github/aur/stirling-pdf-server-bin/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
diff --git a/build.gradle b/build.gradle
index 3946b32449..5c89fd7af2 100644
--- a/build.gradle
+++ b/build.gradle
@@ -91,7 +91,7 @@ springBoot {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.14.0'
+    version = '2.14.1'
 
     configurations.configureEach {
         exclude group: "org.springframework.boot", module: "spring-boot-starter-tomcat"
diff --git a/frontend/editor/src-tauri/tauri.conf.json b/frontend/editor/src-tauri/tauri.conf.json
index 87f3a48a1d..6cfe33cbe6 100644
--- a/frontend/editor/src-tauri/tauri.conf.json
+++ b/frontend/editor/src-tauri/tauri.conf.json
@@ -2,7 +2,7 @@
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "Stirling PDF",
   "mainBinaryName": "Stirling-PDF",
-  "version": "2.14.0",
+  "version": "2.14.1",
   "identifier": "stirling.pdf.dev",
   "build": {
     "frontendDist": "../dist",
diff --git a/frontend/editor/src/core/testing/serverExperienceSimulations.ts b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
index 09344f9234..cd7ed8f2ba 100644
--- a/frontend/editor/src/core/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
@@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.0",
+  appVersion: "2.14.1",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   serverPort: 8080,
diff --git a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
index 50bf5eb230..1aaabfeb33 100644
--- a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
@@ -48,7 +48,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.0",
+  appVersion: "2.14.1",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   enableDesktopInstallSlide: true,

From 20204f0ddcecd9d80dc5c13c802cd878d1ddc3e9 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 7 Jul 2026 12:01:18 +0100
Subject: [PATCH 12/35] Improve consistency and reliability of tools in
 Stirling Engine (#6855)

# Description of Changes
A few changes to improve things in the engine:
- Changed the PDF to Markdown code to be a real tool in Java, to remove
the need for the `pdf_ingest` code, which looked a bit like an agent but
wasn't behaving as an agent. It's now just covered automatically by the
edit agent.
- Noticed that 0-parameter-endpoints were previously being ignored by
the `tool_models` generator, so some tools which require no params were
being mistakenly excluded.
- Removed tools which currently never succeed like Add Stamp, Cert Sign,
and Overlay, because they require the supporting files to be sent in a
different location in the API call, which we don't currently do.
Ideally, we'd add proper support for this, but we're better off now
removing support for these tools rather than just have them crash. We
can re-add these tools in a future PR properly.
---
 .../model/api/ai/AiWorkflowOutcome.java       |   3 +-
 .../service/AiWorkflowService.java            |  68 -----
 .../service/AiWorkflowServiceMoreTest.java    |  28 --
 .../service/AiWorkflowServiceTest.java        |  28 +-
 engine/scripts/generate_tool_models.py        |  36 ++-
 engine/src/stirling/agents/orchestrator.py    |  21 +-
 engine/src/stirling/contracts/__init__.py     |   2 -
 engine/src/stirling/contracts/common.py       |  14 -
 engine/src/stirling/contracts/orchestrator.py |   2 -
 engine/src/stirling/models/tool_models.py     | 273 +++++++-----------
 10 files changed, 157 insertions(+), 318 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/AiWorkflowOutcome.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/AiWorkflowOutcome.java
index 2bed56f0f0..a7239e8f90 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/AiWorkflowOutcome.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/AiWorkflowOutcome.java
@@ -21,8 +21,7 @@ public enum AiWorkflowOutcome {
     COMPLETED("completed"),
     UNSUPPORTED_CAPABILITY("unsupported_capability"),
     CANNOT_CONTINUE("cannot_continue"),
-    GENERATE_FILE("generate_file"),
-    CONVERT_MARKDOWN("convert_markdown");
+    GENERATE_FILE("generate_file");
 
     private final String value;
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
index 4e6c515318..d3b2d21a00 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
@@ -68,7 +68,6 @@ import tools.jackson.databind.ObjectMapper;
 public class AiWorkflowService {
 
     private static final String DOCUMENTS_ENDPOINT = "/api/v1/documents";
-    private static final String PDF_TO_MARKDOWN_ENDPOINT = "/api/v1/convert/pdf/markdown";
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final AiEngineClient aiEngineClient;
@@ -196,7 +195,6 @@ public class AiWorkflowService {
         return switch (response.getOutcome()) {
             case NEED_CONTENT -> onNeedContent(response, filesById, request, listener);
             case NEED_INGEST -> onNeedIngest(response, filesById, request, listener);
-            case CONVERT_MARKDOWN -> onConvertMarkdown(response, filesById, listener);
             case TOOL_CALL -> onToolCall(response, filesById, listener);
             case PLAN -> onPlan(response, filesById, request, listener);
             case ANSWER -> onAnswer(response, filesById, request, listener);
@@ -333,72 +331,6 @@ public class AiWorkflowService {
         return new WorkflowState.Pending(nextRequest);
     }
 
-    /**
-     * Deterministically convert each requested PDF to Markdown via the {@code
-     * /convert/pdf/markdown} endpoint (backed by {@code PdfMarkdownConverter}) and return the
-     * {@code .md} file(s) as a completed result. No AI resume — the conversion output is the final
-     * answer.
-     */
-    private WorkflowState onConvertMarkdown(
-            AiWorkflowResponse response,
-            Map<String, MultipartFile> filesById,
-            ProgressListener listener) {
-        List<AiFile> filesToConvert = response.getFilesToIngest();
-        if (filesToConvert == null || filesToConvert.isEmpty()) {
-            return new WorkflowState.Terminal(
-                    cannotContinue(
-                            "AI engine requested markdown conversion without listing any files."));
-        }
-
-        try {
-            List<Resource> resultFiles = new ArrayList<>();
-            List<String> inputNames = new ArrayList<>();
-            for (int i = 0; i < filesToConvert.size(); i++) {
-                AiFile file = filesToConvert.get(i);
-                MultipartFile multipartFile = filesById.get(file.getId());
-                if (multipartFile == null) {
-                    return new WorkflowState.Terminal(
-                            cannotContinue(
-                                    "AI engine requested markdown conversion for unknown file: "
-                                            + file.getName()));
-                }
-                listener.onProgress(
-                        AiWorkflowProgressEvent.executingTool(
-                                PDF_TO_MARKDOWN_ENDPOINT, i + 1, filesToConvert.size()));
-                Resource input = toResource(multipartFile);
-                PipelineDefinition definition =
-                        new PipelineDefinition(
-                                "convert-markdown",
-                                List.of(new PipelineStep(PDF_TO_MARKDOWN_ENDPOINT, Map.of())),
-                                null);
-                PolicyExecutionResult result =
-                        policyExecutor.execute(
-                                definition,
-                                PolicyInputs.of(List.of(input)),
-                                PolicyProgressListener.NOOP);
-                resultFiles.addAll(result.files());
-                inputNames.add(multipartFile.getOriginalFilename());
-            }
-            return new WorkflowState.Terminal(
-                    buildCompletedResponse(null, resultFiles, inputNames, null));
-        } catch (InternalApiTimeoutException e) {
-            log.error("PDF to Markdown conversion timed out: {}", e.getMessage());
-            return new WorkflowState.Terminal(
-                    cannotContinue(toolTimeoutMessage(PDF_TO_MARKDOWN_ENDPOINT, e)));
-        } catch (Exception e) {
-            AiWorkflowResponse limit = paygLimitResponseOrNull(e);
-            if (limit != null) {
-                log.info(
-                        "AI markdown conversion blocked by downstream entitlement gate ({})",
-                        limit.getErrorCode());
-                return new WorkflowState.Terminal(limit);
-            }
-            log.error("Failed to convert PDF to Markdown: {}", e.getMessage(), e);
-            return new WorkflowState.Terminal(
-                    cannotContinue(toolFailureMessage(PDF_TO_MARKDOWN_ENDPOINT, e)));
-        }
-    }
-
     private Resource toResource(MultipartFile file) throws IOException {
         TempFile tempFile = tempFileManager.createManagedTempFile("ai-workflow");
         file.transferTo(tempFile.getPath());
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceMoreTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceMoreTest.java
index cc8388b8c2..7c44a40a5d 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceMoreTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceMoreTest.java
@@ -221,34 +221,6 @@ class AiWorkflowServiceMoreTest {
         }
     }
 
-    @Nested
-    @DisplayName("convert_markdown guards")
-    class ConvertMarkdownGuards {
-
-        @Test
-        @DisplayName("no files listed yields CANNOT_CONTINUE")
-        void noFiles() throws IOException {
-            stubOrchestrator("{\"outcome\":\"convert_markdown\",\"filesToIngest\":[]}");
-            AiWorkflowResponse result = service.orchestrate(requestFor(pdf("a.pdf", "x"), "to md"));
-            assertThat(result.getOutcome()).isEqualTo(AiWorkflowOutcome.CANNOT_CONTINUE);
-        }
-
-        @Test
-        @DisplayName("unknown file id yields CANNOT_CONTINUE")
-        void unknownFile() throws IOException {
-            when(fileIdStrategy.idFor(any())).thenReturn("real-id");
-            stubOrchestrator(
-                    """
-                    {"outcome":"convert_markdown",
-                     "filesToIngest":[{"id":"other-id","name":"other.pdf"}]}
-                    """);
-            AiWorkflowResponse result =
-                    service.orchestrate(requestFor(pdf("real.pdf", "x"), "to md"));
-            assertThat(result.getOutcome()).isEqualTo(AiWorkflowOutcome.CANNOT_CONTINUE);
-            assertThat(result.getReason()).contains("other.pdf");
-        }
-    }
-
     @Nested
     @DisplayName("plan guards and errors")
     class PlanGuardsAndErrors {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceTest.java
index 9e611cf32e..7dc174c041 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiWorkflowServiceTest.java
@@ -78,6 +78,7 @@ class AiWorkflowServiceTest {
     private static final String SPLIT_ENDPOINT = "/api/v1/general/split-pages";
     private static final String MERGE_ENDPOINT = "/api/v1/general/merge-pdfs";
     private static final String COMPRESS_ENDPOINT = "/api/v1/misc/compress-pdf";
+    private static final String MARKDOWN_ENDPOINT = "/api/v1/convert/pdf/markdown";
 
     @Mock private CustomPDFDocumentFactory pdfDocumentFactory;
     @Mock private AiEngineClient aiEngineClient;
@@ -440,23 +441,23 @@ class AiWorkflowServiceTest {
     }
 
     @Test
-    void convertMarkdownRunsDeterministicConversionAndReturnsMdFile() throws IOException {
+    void planWithMarkdownStepReturnsMdFile() throws IOException {
+        // PDF→Markdown is a normal tool the edit agent emits as a plan step (no bespoke
+        // outcome); the plan executor runs the converter and returns the .md file.
         MockMultipartFile input = pdf("multi-column-test_lorem.pdf", "pdf-bytes");
-        when(fileIdStrategy.idFor(any())).thenReturn("doc-1");
         stubOrchestrator(
                 """
                 {
-                  "outcome":"convert_markdown",
-                  "reason":"PDF to Markdown requested.",
-                  "filesToIngest":[{"id":"doc-1","name":"multi-column-test_lorem.pdf"}]
+                  "outcome":"plan",
+                  "summary":"Convert to Markdown",
+                  "steps":[{"tool":"%s","parameters":{}}]
                 }
-                """);
-        when(toolMetadataService.shouldUnpackZipResponse("/api/v1/convert/pdf/markdown"))
-                .thenReturn(false);
-        stubEndpoint(
-                "/api/v1/convert/pdf/markdown",
-                pdfResource("# Title", "multi-column-test_lorem.md"));
-        AtomicInteger ids = stubFileStorage();
+                """
+                        .formatted(MARKDOWN_ENDPOINT));
+        when(toolMetadataService.isMultiInput(anyString())).thenReturn(false);
+        when(toolMetadataService.shouldUnpackZipResponse(anyString())).thenReturn(false);
+        stubEndpoint(MARKDOWN_ENDPOINT, pdfResource("# Title", "multi-column-test_lorem.md"));
+        stubFileStorage();
 
         AiWorkflowResponse result = service.orchestrate(requestFor(input, "convert to markdown"));
 
@@ -464,8 +465,7 @@ class AiWorkflowServiceTest {
         assertEquals(1, result.getResultFiles().size());
         // Extension changes (pdf -> md), so the converter's response filename wins.
         assertEquals("multi-column-test_lorem.md", result.getResultFiles().get(0).getFileName());
-        assertEquals(1, ids.get());
-        verify(internalApiClient, times(1)).post(eq("/api/v1/convert/pdf/markdown"), any());
+        verify(internalApiClient, times(1)).post(eq(MARKDOWN_ENDPOINT), any());
     }
 
     @Test
diff --git a/engine/scripts/generate_tool_models.py b/engine/scripts/generate_tool_models.py
index 9bc1458fea..dfe461fcca 100644
--- a/engine/scripts/generate_tool_models.py
+++ b/engine/scripts/generate_tool_models.py
@@ -59,6 +59,36 @@ class ToolDiscovery:
         "/api/v1/convert/",
     )
 
+    # Endpoints under the allowed prefixes that are NOT edit-agent operations. A listed
+    # path and everything nested under it is dropped. Several kinds live here:
+    EXCLUDED_PATHS = (
+        # 1. Cert-signing family: needs certificate/key files the agent can't supply, plus
+        #    interactive session and hardware-token management. The whole subtree is dropped.
+        "/api/v1/security/cert-sign",
+        # 2. Interactive PDF text-editor endpoints, not one-shot operations.
+        "/api/v1/convert/pdf/text-editor",
+        "/api/v1/convert/text-editor/pdf",
+        # 3. Introspection / query endpoints that return metadata, a listing, or a
+        #    verification verdict rather than a transformed document, so they belong to
+        #    the question path, not the edit agent. (decompress is a dev-only stream op.)
+        "/api/v1/security/get-info-on-pdf",
+        "/api/v1/security/verify-pdf",
+        "/api/v1/security/validate-signature",
+        "/api/v1/misc/list-attachments",
+        "/api/v1/misc/show-javascript",
+        "/api/v1/misc/decompress-pdf",
+        "/api/v1/general/extract-bookmarks",
+        # 4. Require a secondary file (image, overlay PDF, attachments) on top of the input
+        #    PDF. The agent only ever supplies the input PDF(s), so these can never run.
+        #    (add-stamp / add-watermark stay: their text mode needs no extra file.)
+        "/api/v1/misc/add-image",
+        "/api/v1/misc/add-attachments",
+        "/api/v1/general/overlay-pdfs",
+    )
+
+    def _is_excluded(self, path: str) -> bool:
+        return any(path == p or path.startswith(p + "/") for p in self.EXCLUDED_PATHS)
+
     def __init__(self, spec: dict[str, Any]):
         resource = Resource.from_contents(spec, default_specification=DRAFT202012)
         self.resolver = Registry().with_resource("", resource).resolver()
@@ -73,17 +103,15 @@ class ToolDiscovery:
         for path, path_item in sorted(self.spec.get("paths", {}).items()):
             if "{" in path or not any(path.startswith(p) for p in self.ALLOWED_PATH_PREFIXES):
                 continue
+            if self._is_excluded(path):
+                continue
             body_schema = self._get_request_body_schema(path_item) or {}
             query_props = self._get_query_parameters(path_item)
             body_props = body_schema.get("properties") or {}
             # Body properties win on name collision — body is the canonical param source
             # for the existing tools; query params are additive.
             properties = {**query_props, **body_props}
-            if not properties:
-                continue
             clean_props = self._filter_properties(properties)
-            if not clean_props:
-                continue
 
             enum_name = _deduplicate(_path_to_enum_name(path), used_enum)
             class_name = _deduplicate(_path_to_class_name(path), used_class)
diff --git a/engine/src/stirling/agents/orchestrator.py b/engine/src/stirling/agents/orchestrator.py
index c73d9dab32..e07e771e34 100644
--- a/engine/src/stirling/agents/orchestrator.py
+++ b/engine/src/stirling/agents/orchestrator.py
@@ -15,7 +15,6 @@ from stirling.agents.pdf_review import PdfReviewAgent
 from stirling.agents.user_spec import UserSpecAgent
 from stirling.contracts import (
     AgentDraftWorkflowResponse,
-    ConvertMarkdownResponse,
     ExtractedTextArtifact,
     OrchestratorRequest,
     OrchestratorResponse,
@@ -48,7 +47,7 @@ class OrchestratorAgent:
                 ToolOutput(
                     self.delegate_pdf_edit,
                     name="delegate_pdf_edit",
-                    description="Delegate requests for PDF modifications and return the PDF edit result.",
+                    description="Delegate requests to modify or convert PDFs and return the PDF edit result.",
                 ),
                 ToolOutput(
                     self.delegate_pdf_question,
@@ -71,13 +70,6 @@ class OrchestratorAgent:
                         " feedback')."
                     ),
                 ),
-                ToolOutput(
-                    self.delegate_pdf_ingest,
-                    name="delegate_pdf_ingest",
-                    description=(
-                        "Delegate requests to convert a PDF to Markdown or extract its content as readable text."
-                    ),
-                ),
                 ToolOutput(
                     self.delegate_pdf_create,
                     name="delegate_pdf_create",
@@ -98,7 +90,7 @@ class OrchestratorAgent:
             system_prompt=(
                 "You are the top-level orchestrator. "
                 "Choose exactly one output function that best handles the request. "
-                "Use delegate_pdf_edit for any requested modification of one or more PDFs. "
+                "Use delegate_pdf_edit for any request to modify or convert one or more PDFs. "
                 "Use delegate_pdf_question for questions about the contents of the attached PDFs. "
                 "Use delegate_user_spec for requests to create or define an agent spec. "
                 "Use delegate_pdf_review when the user wants the PDF returned with review"
@@ -106,8 +98,6 @@ class OrchestratorAgent:
                 " 'leave feedback on the PDF'. "
                 "Use delegate_pdf_create when the user wants to generate a new document from"
                 " scratch with no input file — invoices, reports, letters, contracts, etc. "
-                "Use delegate_pdf_ingest for any request to convert a PDF to Markdown "
-                "or extract its content as readable text. "
                 "Use unsupported_capability when the user asks about the assistant itself "
                 "or when none of the other outputs fit; supply a helpful message."
             ),
@@ -177,13 +167,6 @@ class OrchestratorAgent:
     async def _run_agent_draft(self, request: OrchestratorRequest) -> AgentDraftWorkflowResponse:
         return await UserSpecAgent(self.runtime).orchestrate(request)
 
-    async def delegate_pdf_ingest(self, ctx: RunContext[OrchestratorDeps]) -> ConvertMarkdownResponse:
-        request = ctx.deps.request
-        return ConvertMarkdownResponse(
-            reason="PDF to Markdown requested — Java converts deterministically.",
-            files_to_ingest=request.files,
-        )
-
     async def delegate_pdf_review(self, ctx: RunContext[OrchestratorDeps]) -> PdfReviewOrchestrateResponse:
         return await self._run_pdf_review(ctx.deps.request)
 
diff --git a/engine/src/stirling/contracts/__init__.py b/engine/src/stirling/contracts/__init__.py
index 6c8d99d120..77ce40301e 100644
--- a/engine/src/stirling/contracts/__init__.py
+++ b/engine/src/stirling/contracts/__init__.py
@@ -13,7 +13,6 @@ from .common import (
     AiFile,
     ArtifactKind,
     ConversationMessage,
-    ConvertMarkdownResponse,
     ExtractedFileText,
     GenerateFileResponse,
     MathAuditorToolReportArtifact,
@@ -163,7 +162,6 @@ __all__ = [
     "NeedContentFileRequest",
     "NeedContentResponse",
     "NeedIngestResponse",
-    "ConvertMarkdownResponse",
     "NextExecutionAction",
     "OrchestratorRequest",
     "OrchestratorResponse",
diff --git a/engine/src/stirling/contracts/common.py b/engine/src/stirling/contracts/common.py
index 8f35c9ceb4..d9105bad4e 100644
--- a/engine/src/stirling/contracts/common.py
+++ b/engine/src/stirling/contracts/common.py
@@ -62,7 +62,6 @@ class WorkflowOutcome(StrEnum):
     CANNOT_CONTINUE = "cannot_continue"
     UNSUPPORTED_CAPABILITY = "unsupported_capability"
     GENERATE_FILE = "generate_file"
-    CONVERT_MARKDOWN = "convert_markdown"
 
 
 class ArtifactKind(StrEnum):
@@ -184,19 +183,6 @@ class NeedIngestResponse(ApiModel):
     content_types: list[PdfContentType] = Field(default_factory=list)
 
 
-class ConvertMarkdownResponse(ApiModel):
-    """Terminal signal: convert the listed files to Markdown deterministically.
-
-    This is a deterministic, non-AI conversion. Java runs the PDF→Markdown converter
-    (``PdfMarkdownConverter``) on each file and returns the resulting ``.md`` file(s) as a
-    completed result. There is no resume turn — the conversion output is the final answer.
-    """
-
-    outcome: Literal[WorkflowOutcome.CONVERT_MARKDOWN] = WorkflowOutcome.CONVERT_MARKDOWN
-    reason: str
-    files_to_ingest: list[AiFile]
-
-
 class ToolOperationStep(ApiModel):
     kind: Literal[StepKind.TOOL] = StepKind.TOOL
     tool: AnyToolId
diff --git a/engine/src/stirling/contracts/orchestrator.py b/engine/src/stirling/contracts/orchestrator.py
index 8b916ccaff..2d85853c51 100644
--- a/engine/src/stirling/contracts/orchestrator.py
+++ b/engine/src/stirling/contracts/orchestrator.py
@@ -11,7 +11,6 @@ from .common import (
     AiFile,
     ArtifactKind,
     ConversationMessage,
-    ConvertMarkdownResponse,
     ExtractedFileText,
     GenerateFileResponse,
     NeedContentResponse,
@@ -61,7 +60,6 @@ type OrchestratorResponse = Annotated[
     | GenerateFileResponse
     | NeedContentResponse
     | NeedIngestResponse
-    | ConvertMarkdownResponse
     | AgentDraftResponse
     | NextExecutionAction
     | UnsupportedCapabilityResponse,
diff --git a/engine/src/stirling/models/tool_models.py b/engine/src/stirling/models/tool_models.py
index 2591d947a8..1827730283 100644
--- a/engine/src/stirling/models/tool_models.py
+++ b/engine/src/stirling/models/tool_models.py
@@ -11,13 +11,6 @@ from pydantic import Field, RootModel, SecretStr
 from stirling.models.base import ApiModel
 
 
-class AddAttachmentsParams(ApiModel):
-    attachments: list[bytes] = Field(..., description="The image file to be overlaid onto the PDF.")
-    convert_to_pdf_a3b: bool = Field(
-        False, description="Convert the resulting PDF to PDF/A-3b format after adding attachments"
-    )
-
-
 class AddCommentsParams(ApiModel):
     comments: str = Field(
         ...,
@@ -28,12 +21,6 @@ class AddCommentsParams(ApiModel):
     )
 
 
-class AddImageParams(ApiModel):
-    every_page: bool = Field(False, description="Whether to overlay the image onto every page of the PDF.")
-    x: float = Field(0, description="The x-coordinate at which to place the top-left corner of the image.")
-    y: float = Field(0, description="The y-coordinate at which to place the top-left corner of the image.")
-
-
 class CustomMargin(StrEnum):
     """
     Custom margin: small/medium/large/x-large
@@ -312,50 +299,6 @@ class CbzToPdfParams(ApiModel):
     optimize_for_ebook: bool = Field(False, description="Optimize the output PDF for ebook reading using Ghostscript")
 
 
-class CertType(StrEnum):
-    """
-    The type of the digital certificate. WINDOWS_STORE and PKCS11 are hardware-backed and only available in the desktop app.
-    """
-
-    pem = "PEM"
-    pkcs12 = "PKCS12"
-    pfx = "PFX"
-    jks = "JKS"
-    server = "SERVER"
-    windows_store = "WINDOWS_STORE"
-    pkcs11 = "PKCS11"
-
-
-class CertSignParams(ApiModel):
-    alias: str | None = Field(
-        None,
-        description="The alias of the certificate to sign with. Required for WINDOWS_STORE and recommended for PKCS11 tokens holding multiple certificates.",
-    )
-    cert_type: CertType = Field(
-        ...,
-        description="The type of the digital certificate. WINDOWS_STORE and PKCS11 are hardware-backed and only available in the desktop app.",
-    )
-    location: str = Field("SPDF", description="The location where the PDF is signed")
-    name: str = Field("SPDF", description="The name of the signer")
-    page_number: int = Field(
-        1,
-        description="The page number where the signature should be visible. This is required if showSignature is set to true",
-    )
-    password: SecretStr | None = Field(
-        None, description="The password for the keystore / private key, or the token PIN for PKCS11"
-    )
-    pkcs11_library_path: str | None = Field(
-        None,
-        description="Absolute path to the PKCS#11 driver library (required for PKCS11 type). Must be an allowed driver - a detected one or configured via STIRLING_PKCS11_LIBRARIES.",
-    )
-    pkcs11_slot: int | None = Field(
-        None, description="Optional PKCS#11 slot index. When omitted the first slot with a token is used."
-    )
-    reason: str = Field("Signed by SPDF", description="The reason for signing the PDF")
-    show_logo: bool = Field(True, description="Whether to visually show a signature logo along with the signature")
-    show_signature: bool = Field(False, description="Whether to visually show the signature in the PDF file")
-
-
 class LineArtEdgeLevel(IntEnum):
     """
     Edge detection strength to use for line art conversion (1-3). This maps to ImageMagick's -edge radius.
@@ -525,6 +468,10 @@ class EmlToPdfParams(ApiModel):
     )
 
 
+class ExtractAttachmentsParams(ApiModel):
+    pass
+
+
 class ExtractImageScansParams(ApiModel):
     angle_threshold: int = Field(5, description="The angle threshold for the image scan extraction")
     border_size: int = Field(1, description="The border size for the image scan extraction")
@@ -547,6 +494,10 @@ class ExtractImagesParams(ApiModel):
     format: Format = Field(Format.png, description="The output image format e.g., 'png', 'jpeg', or 'gif'")
 
 
+class FileToPdfParams(ApiModel):
+    pass
+
+
 class FlattenParams(ApiModel):
     flatten_only_forms: bool = Field(
         False, description="True to flatten only the forms, false to flatten full PDF (Convert page to image)"
@@ -602,6 +553,10 @@ class ImgToPdfParams(ApiModel):
     )
 
 
+class MarkdownToPdfParams(ApiModel):
+    pass
+
+
 class SortType(StrEnum):
     """
     The type of sorting to be applied on the input files before merging.
@@ -750,41 +705,6 @@ class OcrPdfParams(ApiModel):
     sidecar: bool | None = Field(None, description="Include OCR text in a sidecar text file if set to true")
 
 
-class OverlayMode(StrEnum):
-    """
-    The mode of overlaying: 'SequentialOverlay' for sequential application, 'InterleavedOverlay' for round-robin application, 'FixedRepeatOverlay' for fixed repetition based on provided counts
-    """
-
-    sequential_overlay = "SequentialOverlay"
-    interleaved_overlay = "InterleavedOverlay"
-    fixed_repeat_overlay = "FixedRepeatOverlay"
-
-
-class OverlayPosition(Enum):
-    """
-    Overlay position 0 is Foregound, 1 is Background
-    """
-
-    number_0 = 0
-    number_1 = 1
-
-
-class OverlayPdfsParams(ApiModel):
-    counts: list[int] | None = Field(
-        None,
-        description="An array of integers specifying the number of times each corresponding overlay file should be applied in the 'FixedRepeatOverlay' mode. This should match the length of the overlayFiles array.",
-    )
-    overlay_files: list[bytes] = Field(
-        ...,
-        description="An array of PDF files to be used as overlays on the base PDF. The order in these files is applied based on the selected mode.",
-    )
-    overlay_mode: OverlayMode = Field(
-        ...,
-        description="The mode of overlaying: 'SequentialOverlay' for sequential application, 'InterleavedOverlay' for round-robin application, 'FixedRepeatOverlay' for fixed repetition based on provided counts",
-    )
-    overlay_position: OverlayPosition = Field(..., description="Overlay position 0 is Foregound, 1 is Background")
-
-
 class PdfToCbrParams(ApiModel):
     dpi: int = Field(..., description="The DPI (Dots Per Inch) for rendering PDF pages as images", examples=[150])
 
@@ -841,6 +761,12 @@ class PdfToEpubParams(ApiModel):
     )
 
 
+class PdfToHtmlParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
 class ImageFormat(StrEnum):
     """
     The output image format
@@ -877,6 +803,12 @@ class PdfToImgParams(ApiModel):
     )
 
 
+class PdfToMarkdownParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
 class OutputFormat1(StrEnum):
     """
     The output format type (PDF/A or PDF/X)
@@ -912,13 +844,11 @@ class PdfToPresentationParams(ApiModel):
     output_format: OutputFormat2 = Field(..., description="The output Presentation format")
 
 
-class PdfToTextEditorParams(ApiModel):
+class PdfToSinglePageParams(ApiModel):
     """
     Either upload a file or provide a server-side file ID
     """
 
-    lightweight: bool = False
-
 
 class OutputFormat3(StrEnum):
     """
@@ -979,10 +909,10 @@ class PdfToXlsxParams(ApiModel):
     )
 
 
-class Pkcs11CertificatesParams(ApiModel):
-    library_path: str | None = None
-    pin: str | None = None
-    slot: int | None = None
+class PdfToXmlParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
 
 
 class CustomMode(StrEnum):
@@ -1061,6 +991,18 @@ class RemoveBlanksParams(ApiModel):
     )
 
 
+class RemoveCertSignParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
+class RemoveImagePdfParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
 class RemovePagesParams(ApiModel):
     page_numbers: str = Field(
         "all",
@@ -1077,6 +1019,12 @@ class RenameAttachmentParams(ApiModel):
     new_name: str = Field(..., description="The new name for the attachment")
 
 
+class RepairParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
 class HighContrastColorCombination(StrEnum):
     """
     If HIGH_CONTRAST_COLOR option selected, then pick the default color option for text and background.
@@ -1237,27 +1185,6 @@ class ScannerEffectParams(ApiModel):
     yellowish: bool | None = Field(None, description="Simulate yellowed paper", examples=[False])
 
 
-class WorkflowType(StrEnum):
-    signing = "SIGNING"
-    review = "REVIEW"
-    approval = "APPROVAL"
-
-
-class Request(ApiModel):
-    document_name: str | None = None
-    due_date: str | None = None
-    message: str | None = None
-    owner_email: str | None = None
-    participant_emails: list[str] | None = None
-    participant_user_ids: list[int] | None = None
-    workflow_metadata: str | None = None
-    workflow_type: WorkflowType | None = None
-
-
-class SessionsParams(ApiModel):
-    request: Request | None = None
-
-
 class SplitBySizeOrCountParams(ApiModel):
     split_type: int = Field(
         0, description="Determines the type of split: 0 for size, 1 for page count, 2 for document count"
@@ -1360,6 +1287,12 @@ class TimestampPdfParams(ApiModel):
     )
 
 
+class UnlockPdfFormsParams(ApiModel):
+    """
+    Either upload a file or provide a server-side file ID
+    """
+
+
 class Trapped(StrEnum):
     """
     The trapped status of the document
@@ -1399,11 +1332,6 @@ class UrlToPdfParams(ApiModel):
     url_input: str = Field(..., description="The input URL to be converted to a PDF file")
 
 
-class ValidateCertificateParams(ApiModel):
-    cert_type: str | None = None
-    password: str | None = None
-
-
 class OutputFormat6(StrEnum):
     """
     Target vector format extension
@@ -1462,20 +1390,24 @@ class Model(
         | CbzToPdfParams
         | EbookToPdfParams
         | EmlToPdfParams
+        | FileToPdfParams
         | HtmlToPdfParams
         | ImgToPdfParams
+        | MarkdownToPdfParams
         | PdfToCbrParams
         | PdfToCbzParams
         | PdfToCsvParams
         | PdfToEpubParams
+        | PdfToHtmlParams
         | PdfToImgParams
+        | PdfToMarkdownParams
         | PdfToPdfaParams
         | PdfToPresentationParams
         | PdfToTextParams
-        | PdfToTextEditorParams
         | PdfToVectorParams
         | PdfToWordParams
         | PdfToXlsxParams
+        | PdfToXmlParams
         | SvgToPdfParams
         | UrlToPdfParams
         | VectorToPdfParams
@@ -1485,8 +1417,9 @@ class Model(
         | EditTextParams
         | MergePdfsParams
         | MultiPageLayoutParams
-        | OverlayPdfsParams
+        | PdfToSinglePageParams
         | RearrangePagesParams
+        | RemoveImagePdfParams
         | RemovePagesParams
         | RotatePdfParams
         | ScalePagesParams
@@ -1495,33 +1428,31 @@ class Model(
         | SplitPagesParams
         | SplitPdfByChaptersParams
         | SplitPdfBySectionsParams
-        | AddAttachmentsParams
         | AddCommentsParams
-        | AddImageParams
         | AddPageNumbersParams
         | AddStampParams
         | AutoRenameParams
         | AutoSplitPdfParams
         | CompressPdfParams
         | DeleteAttachmentParams
+        | ExtractAttachmentsParams
         | ExtractImageScansParams
         | ExtractImagesParams
         | FlattenParams
         | OcrPdfParams
         | RemoveBlanksParams
         | RenameAttachmentParams
+        | RepairParams
         | ReplaceInvertPdfParams
         | ScannerEffectParams
+        | UnlockPdfFormsParams
         | UpdateMetadataParams
         | AddPasswordParams
         | AddWatermarkParams
         | AutoRedactParams
-        | CertSignParams
-        | Pkcs11CertificatesParams
-        | SessionsParams
-        | ValidateCertificateParams
         | RedactParams
         | RedactExecuteParams
+        | RemoveCertSignParams
         | RemovePasswordParams
         | SanitizePdfParams
         | TimestampPdfParams
@@ -1532,20 +1463,24 @@ class Model(
         | CbzToPdfParams
         | EbookToPdfParams
         | EmlToPdfParams
+        | FileToPdfParams
         | HtmlToPdfParams
         | ImgToPdfParams
+        | MarkdownToPdfParams
         | PdfToCbrParams
         | PdfToCbzParams
         | PdfToCsvParams
         | PdfToEpubParams
+        | PdfToHtmlParams
         | PdfToImgParams
+        | PdfToMarkdownParams
         | PdfToPdfaParams
         | PdfToPresentationParams
         | PdfToTextParams
-        | PdfToTextEditorParams
         | PdfToVectorParams
         | PdfToWordParams
         | PdfToXlsxParams
+        | PdfToXmlParams
         | SvgToPdfParams
         | UrlToPdfParams
         | VectorToPdfParams
@@ -1555,8 +1490,9 @@ class Model(
         | EditTextParams
         | MergePdfsParams
         | MultiPageLayoutParams
-        | OverlayPdfsParams
+        | PdfToSinglePageParams
         | RearrangePagesParams
+        | RemoveImagePdfParams
         | RemovePagesParams
         | RotatePdfParams
         | ScalePagesParams
@@ -1565,33 +1501,31 @@ class Model(
         | SplitPagesParams
         | SplitPdfByChaptersParams
         | SplitPdfBySectionsParams
-        | AddAttachmentsParams
         | AddCommentsParams
-        | AddImageParams
         | AddPageNumbersParams
         | AddStampParams
         | AutoRenameParams
         | AutoSplitPdfParams
         | CompressPdfParams
         | DeleteAttachmentParams
+        | ExtractAttachmentsParams
         | ExtractImageScansParams
         | ExtractImagesParams
         | FlattenParams
         | OcrPdfParams
         | RemoveBlanksParams
         | RenameAttachmentParams
+        | RepairParams
         | ReplaceInvertPdfParams
         | ScannerEffectParams
+        | UnlockPdfFormsParams
         | UpdateMetadataParams
         | AddPasswordParams
         | AddWatermarkParams
         | AutoRedactParams
-        | CertSignParams
-        | Pkcs11CertificatesParams
-        | SessionsParams
-        | ValidateCertificateParams
         | RedactParams
         | RedactExecuteParams
+        | RemoveCertSignParams
         | RemovePasswordParams
         | SanitizePdfParams
         | TimestampPdfParams
@@ -1603,20 +1537,24 @@ type ParamToolModel = (
     | CbzToPdfParams
     | EbookToPdfParams
     | EmlToPdfParams
+    | FileToPdfParams
     | HtmlToPdfParams
     | ImgToPdfParams
+    | MarkdownToPdfParams
     | PdfToCbrParams
     | PdfToCbzParams
     | PdfToCsvParams
     | PdfToEpubParams
+    | PdfToHtmlParams
     | PdfToImgParams
+    | PdfToMarkdownParams
     | PdfToPdfaParams
     | PdfToPresentationParams
     | PdfToTextParams
-    | PdfToTextEditorParams
     | PdfToVectorParams
     | PdfToWordParams
     | PdfToXlsxParams
+    | PdfToXmlParams
     | SvgToPdfParams
     | UrlToPdfParams
     | VectorToPdfParams
@@ -1626,8 +1564,9 @@ type ParamToolModel = (
     | EditTextParams
     | MergePdfsParams
     | MultiPageLayoutParams
-    | OverlayPdfsParams
+    | PdfToSinglePageParams
     | RearrangePagesParams
+    | RemoveImagePdfParams
     | RemovePagesParams
     | RotatePdfParams
     | ScalePagesParams
@@ -1636,33 +1575,31 @@ type ParamToolModel = (
     | SplitPagesParams
     | SplitPdfByChaptersParams
     | SplitPdfBySectionsParams
-    | AddAttachmentsParams
     | AddCommentsParams
-    | AddImageParams
     | AddPageNumbersParams
     | AddStampParams
     | AutoRenameParams
     | AutoSplitPdfParams
     | CompressPdfParams
     | DeleteAttachmentParams
+    | ExtractAttachmentsParams
     | ExtractImageScansParams
     | ExtractImagesParams
     | FlattenParams
     | OcrPdfParams
     | RemoveBlanksParams
     | RenameAttachmentParams
+    | RepairParams
     | ReplaceInvertPdfParams
     | ScannerEffectParams
+    | UnlockPdfFormsParams
     | UpdateMetadataParams
     | AddPasswordParams
     | AddWatermarkParams
     | AutoRedactParams
-    | CertSignParams
-    | Pkcs11CertificatesParams
-    | SessionsParams
-    | ValidateCertificateParams
     | RedactParams
     | RedactExecuteParams
+    | RemoveCertSignParams
     | RemovePasswordParams
     | SanitizePdfParams
     | TimestampPdfParams
@@ -1675,20 +1612,24 @@ class ToolEndpoint(StrEnum):
     CBZ_TO_PDF = "/api/v1/convert/cbz/pdf"
     EBOOK_TO_PDF = "/api/v1/convert/ebook/pdf"
     EML_TO_PDF = "/api/v1/convert/eml/pdf"
+    FILE_TO_PDF = "/api/v1/convert/file/pdf"
     HTML_TO_PDF = "/api/v1/convert/html/pdf"
     IMG_TO_PDF = "/api/v1/convert/img/pdf"
+    MARKDOWN_TO_PDF = "/api/v1/convert/markdown/pdf"
     PDF_TO_CBR = "/api/v1/convert/pdf/cbr"
     PDF_TO_CBZ = "/api/v1/convert/pdf/cbz"
     PDF_TO_CSV = "/api/v1/convert/pdf/csv"
     PDF_TO_EPUB = "/api/v1/convert/pdf/epub"
+    PDF_TO_HTML = "/api/v1/convert/pdf/html"
     PDF_TO_IMG = "/api/v1/convert/pdf/img"
+    PDF_TO_MARKDOWN = "/api/v1/convert/pdf/markdown"
     PDF_TO_PDFA = "/api/v1/convert/pdf/pdfa"
     PDF_TO_PRESENTATION = "/api/v1/convert/pdf/presentation"
     PDF_TO_TEXT = "/api/v1/convert/pdf/text"
-    PDF_TO_TEXT_EDITOR = "/api/v1/convert/pdf/text-editor"
     PDF_TO_VECTOR = "/api/v1/convert/pdf/vector"
     PDF_TO_WORD = "/api/v1/convert/pdf/word"
     PDF_TO_XLSX = "/api/v1/convert/pdf/xlsx"
+    PDF_TO_XML = "/api/v1/convert/pdf/xml"
     SVG_TO_PDF = "/api/v1/convert/svg/pdf"
     URL_TO_PDF = "/api/v1/convert/url/pdf"
     VECTOR_TO_PDF = "/api/v1/convert/vector/pdf"
@@ -1698,8 +1639,9 @@ class ToolEndpoint(StrEnum):
     EDIT_TEXT = "/api/v1/general/edit-text"
     MERGE_PDFS = "/api/v1/general/merge-pdfs"
     MULTI_PAGE_LAYOUT = "/api/v1/general/multi-page-layout"
-    OVERLAY_PDFS = "/api/v1/general/overlay-pdfs"
+    PDF_TO_SINGLE_PAGE = "/api/v1/general/pdf-to-single-page"
     REARRANGE_PAGES = "/api/v1/general/rearrange-pages"
+    REMOVE_IMAGE_PDF = "/api/v1/general/remove-image-pdf"
     REMOVE_PAGES = "/api/v1/general/remove-pages"
     ROTATE_PDF = "/api/v1/general/rotate-pdf"
     SCALE_PAGES = "/api/v1/general/scale-pages"
@@ -1708,33 +1650,31 @@ class ToolEndpoint(StrEnum):
     SPLIT_PAGES = "/api/v1/general/split-pages"
     SPLIT_PDF_BY_CHAPTERS = "/api/v1/general/split-pdf-by-chapters"
     SPLIT_PDF_BY_SECTIONS = "/api/v1/general/split-pdf-by-sections"
-    ADD_ATTACHMENTS = "/api/v1/misc/add-attachments"
     ADD_COMMENTS = "/api/v1/misc/add-comments"
-    ADD_IMAGE = "/api/v1/misc/add-image"
     ADD_PAGE_NUMBERS = "/api/v1/misc/add-page-numbers"
     ADD_STAMP = "/api/v1/misc/add-stamp"
     AUTO_RENAME = "/api/v1/misc/auto-rename"
     AUTO_SPLIT_PDF = "/api/v1/misc/auto-split-pdf"
     COMPRESS_PDF = "/api/v1/misc/compress-pdf"
     DELETE_ATTACHMENT = "/api/v1/misc/delete-attachment"
+    EXTRACT_ATTACHMENTS = "/api/v1/misc/extract-attachments"
     EXTRACT_IMAGE_SCANS = "/api/v1/misc/extract-image-scans"
     EXTRACT_IMAGES = "/api/v1/misc/extract-images"
     FLATTEN = "/api/v1/misc/flatten"
     OCR_PDF = "/api/v1/misc/ocr-pdf"
     REMOVE_BLANKS = "/api/v1/misc/remove-blanks"
     RENAME_ATTACHMENT = "/api/v1/misc/rename-attachment"
+    REPAIR = "/api/v1/misc/repair"
     REPLACE_INVERT_PDF = "/api/v1/misc/replace-invert-pdf"
     SCANNER_EFFECT = "/api/v1/misc/scanner-effect"
+    UNLOCK_PDF_FORMS = "/api/v1/misc/unlock-pdf-forms"
     UPDATE_METADATA = "/api/v1/misc/update-metadata"
     ADD_PASSWORD = "/api/v1/security/add-password"
     ADD_WATERMARK = "/api/v1/security/add-watermark"
     AUTO_REDACT = "/api/v1/security/auto-redact"
-    CERT_SIGN = "/api/v1/security/cert-sign"
-    PKCS11_CERTIFICATES = "/api/v1/security/cert-sign/hardware/pkcs11-certificates"
-    SESSIONS = "/api/v1/security/cert-sign/sessions"
-    VALIDATE_CERTIFICATE = "/api/v1/security/cert-sign/validate-certificate"
     REDACT = "/api/v1/security/redact"
     REDACT_EXECUTE = "/api/v1/security/redact-execute"
+    REMOVE_CERT_SIGN = "/api/v1/security/remove-cert-sign"
     REMOVE_PASSWORD = "/api/v1/security/remove-password"
     SANITIZE_PDF = "/api/v1/security/sanitize-pdf"
     TIMESTAMP_PDF = "/api/v1/security/timestamp-pdf"
@@ -1745,20 +1685,24 @@ OPERATIONS: dict[ToolEndpoint, ParamToolModelType] = {
     ToolEndpoint.CBZ_TO_PDF: CbzToPdfParams,
     ToolEndpoint.EBOOK_TO_PDF: EbookToPdfParams,
     ToolEndpoint.EML_TO_PDF: EmlToPdfParams,
+    ToolEndpoint.FILE_TO_PDF: FileToPdfParams,
     ToolEndpoint.HTML_TO_PDF: HtmlToPdfParams,
     ToolEndpoint.IMG_TO_PDF: ImgToPdfParams,
+    ToolEndpoint.MARKDOWN_TO_PDF: MarkdownToPdfParams,
     ToolEndpoint.PDF_TO_CBR: PdfToCbrParams,
     ToolEndpoint.PDF_TO_CBZ: PdfToCbzParams,
     ToolEndpoint.PDF_TO_CSV: PdfToCsvParams,
     ToolEndpoint.PDF_TO_EPUB: PdfToEpubParams,
+    ToolEndpoint.PDF_TO_HTML: PdfToHtmlParams,
     ToolEndpoint.PDF_TO_IMG: PdfToImgParams,
+    ToolEndpoint.PDF_TO_MARKDOWN: PdfToMarkdownParams,
     ToolEndpoint.PDF_TO_PDFA: PdfToPdfaParams,
     ToolEndpoint.PDF_TO_PRESENTATION: PdfToPresentationParams,
     ToolEndpoint.PDF_TO_TEXT: PdfToTextParams,
-    ToolEndpoint.PDF_TO_TEXT_EDITOR: PdfToTextEditorParams,
     ToolEndpoint.PDF_TO_VECTOR: PdfToVectorParams,
     ToolEndpoint.PDF_TO_WORD: PdfToWordParams,
     ToolEndpoint.PDF_TO_XLSX: PdfToXlsxParams,
+    ToolEndpoint.PDF_TO_XML: PdfToXmlParams,
     ToolEndpoint.SVG_TO_PDF: SvgToPdfParams,
     ToolEndpoint.URL_TO_PDF: UrlToPdfParams,
     ToolEndpoint.VECTOR_TO_PDF: VectorToPdfParams,
@@ -1768,8 +1712,9 @@ OPERATIONS: dict[ToolEndpoint, ParamToolModelType] = {
     ToolEndpoint.EDIT_TEXT: EditTextParams,
     ToolEndpoint.MERGE_PDFS: MergePdfsParams,
     ToolEndpoint.MULTI_PAGE_LAYOUT: MultiPageLayoutParams,
-    ToolEndpoint.OVERLAY_PDFS: OverlayPdfsParams,
+    ToolEndpoint.PDF_TO_SINGLE_PAGE: PdfToSinglePageParams,
     ToolEndpoint.REARRANGE_PAGES: RearrangePagesParams,
+    ToolEndpoint.REMOVE_IMAGE_PDF: RemoveImagePdfParams,
     ToolEndpoint.REMOVE_PAGES: RemovePagesParams,
     ToolEndpoint.ROTATE_PDF: RotatePdfParams,
     ToolEndpoint.SCALE_PAGES: ScalePagesParams,
@@ -1778,33 +1723,31 @@ OPERATIONS: dict[ToolEndpoint, ParamToolModelType] = {
     ToolEndpoint.SPLIT_PAGES: SplitPagesParams,
     ToolEndpoint.SPLIT_PDF_BY_CHAPTERS: SplitPdfByChaptersParams,
     ToolEndpoint.SPLIT_PDF_BY_SECTIONS: SplitPdfBySectionsParams,
-    ToolEndpoint.ADD_ATTACHMENTS: AddAttachmentsParams,
     ToolEndpoint.ADD_COMMENTS: AddCommentsParams,
-    ToolEndpoint.ADD_IMAGE: AddImageParams,
     ToolEndpoint.ADD_PAGE_NUMBERS: AddPageNumbersParams,
     ToolEndpoint.ADD_STAMP: AddStampParams,
     ToolEndpoint.AUTO_RENAME: AutoRenameParams,
     ToolEndpoint.AUTO_SPLIT_PDF: AutoSplitPdfParams,
     ToolEndpoint.COMPRESS_PDF: CompressPdfParams,
     ToolEndpoint.DELETE_ATTACHMENT: DeleteAttachmentParams,
+    ToolEndpoint.EXTRACT_ATTACHMENTS: ExtractAttachmentsParams,
     ToolEndpoint.EXTRACT_IMAGE_SCANS: ExtractImageScansParams,
     ToolEndpoint.EXTRACT_IMAGES: ExtractImagesParams,
     ToolEndpoint.FLATTEN: FlattenParams,
     ToolEndpoint.OCR_PDF: OcrPdfParams,
     ToolEndpoint.REMOVE_BLANKS: RemoveBlanksParams,
     ToolEndpoint.RENAME_ATTACHMENT: RenameAttachmentParams,
+    ToolEndpoint.REPAIR: RepairParams,
     ToolEndpoint.REPLACE_INVERT_PDF: ReplaceInvertPdfParams,
     ToolEndpoint.SCANNER_EFFECT: ScannerEffectParams,
+    ToolEndpoint.UNLOCK_PDF_FORMS: UnlockPdfFormsParams,
     ToolEndpoint.UPDATE_METADATA: UpdateMetadataParams,
     ToolEndpoint.ADD_PASSWORD: AddPasswordParams,
     ToolEndpoint.ADD_WATERMARK: AddWatermarkParams,
     ToolEndpoint.AUTO_REDACT: AutoRedactParams,
-    ToolEndpoint.CERT_SIGN: CertSignParams,
-    ToolEndpoint.PKCS11_CERTIFICATES: Pkcs11CertificatesParams,
-    ToolEndpoint.SESSIONS: SessionsParams,
-    ToolEndpoint.VALIDATE_CERTIFICATE: ValidateCertificateParams,
     ToolEndpoint.REDACT: RedactParams,
     ToolEndpoint.REDACT_EXECUTE: RedactExecuteParams,
+    ToolEndpoint.REMOVE_CERT_SIGN: RemoveCertSignParams,
     ToolEndpoint.REMOVE_PASSWORD: RemovePasswordParams,
     ToolEndpoint.SANITIZE_PDF: SanitizePdfParams,
     ToolEndpoint.TIMESTAMP_PDF: TimestampPdfParams,

From 17aa71850ca94b67cac5e94d4f76e9d07d408522 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 7 Jul 2026 12:11:24 +0100
Subject: [PATCH 13/35] Convert to consistently use JS modules (#6854)

# Description of Changes
Modernises the codebase and gets rid of warnings where Node complains
that it doesn't know what type of JS it's supposed to be reading on
`.js` files. We might as well update everything to just use correct JS
syntax instead of keeping with some files having Node-specific imports.
---
 frontend/editor/postcss.config.js             |  7 ++-
 frontend/editor/scripts/generate-icons.js     | 12 ++---
 frontend/editor/scripts/generate-licenses.js  | 21 +++------
 frontend/editor/scripts/generate-og-image.mjs | 47 ++++++++++---------
 .../live/encrypted-unlock-then-tool.spec.ts   |  2 +-
 .../stubbed/add-page-numbers-tool.spec.ts     |  5 +-
 .../core/tests/stubbed/add-stamp-tool.spec.ts |  5 +-
 .../tests/stubbed/cert-sign-wizard.spec.ts    |  2 +-
 .../stubbed/certificate-validation.spec.ts    |  2 +-
 .../stubbed/comments-sidebar-order.spec.ts    |  2 +-
 .../src/core/tests/stubbed/compare.spec.ts    |  2 +-
 .../src/core/tests/stubbed/convert.spec.ts    |  2 +-
 .../stubbed/encrypted-pdf-unlock.spec.ts      |  2 +-
 .../stubbed/file-state-across-tools.spec.ts   |  2 +-
 .../stubbed/merge-response-handling.spec.ts   |  2 +-
 .../stubbed/page-editor-rotation.spec.ts      |  5 +-
 .../tests/stubbed/pdf-text-search.spec.ts     |  5 +-
 .../src/core/tests/stubbed/seed.spec.ts       |  9 +++-
 .../tests/stubbed/tour-onboarding.spec.ts     |  5 +-
 .../stubbed/validate-signature-trust.spec.ts  |  2 +-
 .../viewer-sidebar-add-buttons.spec.ts        |  5 +-
 .../stubbed/viewer-text-selection.spec.ts     |  2 +-
 .../core/tests/stubbed/watermark-tool.spec.ts |  5 +-
 frontend/editor/tailwind.config.js            |  2 +-
 frontend/eslint.config.mjs                    |  1 -
 frontend/package.json                         |  1 +
 frontend/scripts/update-minor.js              |  2 +-
 27 files changed, 93 insertions(+), 66 deletions(-)

diff --git a/frontend/editor/postcss.config.js b/frontend/editor/postcss.config.js
index 7b8895cce8..5bb7b5d6ef 100644
--- a/frontend/editor/postcss.config.js
+++ b/frontend/editor/postcss.config.js
@@ -1,3 +1,6 @@
-module.exports = {
-  plugins: [require("@tailwindcss/postcss"), require("autoprefixer")],
+import tailwindcssPostcss from "@tailwindcss/postcss";
+import autoprefixer from "autoprefixer";
+
+export default {
+  plugins: [tailwindcssPostcss, autoprefixer],
 };
diff --git a/frontend/editor/scripts/generate-icons.js b/frontend/editor/scripts/generate-icons.js
index 7e6da2740e..70b4a091d2 100644
--- a/frontend/editor/scripts/generate-icons.js
+++ b/frontend/editor/scripts/generate-icons.js
@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-const { icons } = require("@iconify-json/material-symbols");
-const fs = require("fs");
-const path = require("path");
+import { icons } from "@iconify-json/material-symbols";
+import fs from "node:fs";
+import path from "node:path";
 
 // Check for verbose flag
 const isVerbose =
@@ -19,7 +19,7 @@ const debug = (message) => {
 // Function to scan codebase for LocalIcon usage
 function scanForUsedIcons() {
   const usedIcons = new Set();
-  const srcDir = path.join(__dirname, "..", "src");
+  const srcDir = path.join(import.meta.dirname, "..", "src");
 
   info("🔍 Scanning codebase for LocalIcon usage...");
 
@@ -140,7 +140,7 @@ async function main() {
 
   // Check if we need to regenerate (compare with existing)
   const outputPath = path.join(
-    __dirname,
+    import.meta.dirname,
     "..",
     "src",
     "assets",
@@ -200,7 +200,7 @@ async function main() {
   }
 
   // Create output directory
-  const outputDir = path.join(__dirname, "..", "src", "assets");
+  const outputDir = path.join(import.meta.dirname, "..", "src", "assets");
   if (!fs.existsSync(outputDir)) {
     fs.mkdirSync(outputDir, { recursive: true });
   }
diff --git a/frontend/editor/scripts/generate-licenses.js b/frontend/editor/scripts/generate-licenses.js
index a82ec9a2bd..72da16c6a9 100644
--- a/frontend/editor/scripts/generate-licenses.js
+++ b/frontend/editor/scripts/generate-licenses.js
@@ -1,28 +1,21 @@
 #!/usr/bin/env node
 
-const { execSync } = require("node:child_process");
-const {
-  existsSync,
-  mkdirSync,
-  writeFileSync,
-  readFileSync,
-} = require("node:fs");
-const path = require("node:path");
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { argv } from "node:process";
 
-const { argv } = require("node:process");
 const inputIdx = argv.indexOf("--input");
 const INPUT_FILE = inputIdx > -1 ? argv[inputIdx + 1] : null;
 const POSTPROCESS_ONLY = !!INPUT_FILE;
 
-// __dirname is available in CommonJS by default
-
 /**
  * Generate 3rd party licenses for frontend dependencies
  * This script creates a JSON file similar to the Java backend's 3rdPartyLicenses.json
  */
 
 const OUTPUT_FILE = path.join(
-  __dirname,
+  import.meta.dirname,
   "..",
   "src",
   "assets",
@@ -30,7 +23,7 @@ const OUTPUT_FILE = path.join(
 );
 // package.json lives at the workspace root (frontend/), not editor/. The
 // script is at frontend/editor/scripts/, so walk up two levels.
-const PACKAGE_JSON = path.join(__dirname, "..", "..", "package.json");
+const PACKAGE_JSON = path.join(import.meta.dirname, "..", "..", "package.json");
 
 // Ensure the output directory exists
 const outputDir = path.dirname(OUTPUT_FILE);
@@ -192,7 +185,7 @@ try {
 
     // Write license warnings to a separate file for CI/CD
     const warningsFile = path.join(
-      __dirname,
+      import.meta.dirname,
       "..",
       "src",
       "assets",
diff --git a/frontend/editor/scripts/generate-og-image.mjs b/frontend/editor/scripts/generate-og-image.mjs
index 7cef32c9b0..cf617bf7e8 100644
--- a/frontend/editor/scripts/generate-og-image.mjs
+++ b/frontend/editor/scripts/generate-og-image.mjs
@@ -16,11 +16,10 @@
 /* global document, getComputedStyle */ // used inside page.evaluate (browser context)
 
 import fs from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
 
-const require = createRequire(import.meta.url);
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(HERE, "..");
 
@@ -69,11 +68,14 @@ export const THEME = {
 };
 
 // ---- icon resolution (material-symbols via iconify) ------------------------
-function resolveIcon(icon) {
+async function resolveIcon(icon) {
   if (!icon) return "";
   if (icon.trim().startsWith("<svg")) return icon; // raw svg passed through
-  const { getIconData, iconToSVG } = require("@iconify/utils");
-  const set = require("@iconify-json/material-symbols/icons.json");
+  const { getIconData, iconToSVG } = await import("@iconify/utils");
+  const { default: set } = await import(
+    "@iconify-json/material-symbols/icons.json",
+    { with: { type: "json" } }
+  );
   const data = getIconData(set, icon);
   if (!data) throw new Error(`icon not found in material-symbols: "${icon}"`);
   const { attributes, body } = iconToSVG(data);
@@ -148,7 +150,7 @@ const escapeHtml = (s) =>
 let _browser = null;
 async function getBrowser() {
   if (_browser) return _browser;
-  const puppeteer = require("puppeteer");
+  const { default: puppeteer } = await import("puppeteer");
   _browser = await puppeteer.launch({
     headless: "new",
     args: ["--no-sandbox"],
@@ -163,7 +165,7 @@ export async function renderOgCard({
   outFile,
   theme = THEME,
 }) {
-  const iconSvg = resolveIcon(icon);
+  const iconSvg = await resolveIcon(icon);
   const html = await buildHtml({ name, description, iconSvg, theme });
   const browser = await getBrowser();
   const page = await browser.newPage();
@@ -230,7 +232,7 @@ const kebab = (id) => id.replace(/([A-Z])/g, "-$1").toLowerCase();
 
 // English name/description live next to each tool as the `t(key, fallback)` default.
 function readRegistryStrings() {
-  const src = require("node:fs").readFileSync(
+  const src = readFileSync(
     path.join(ROOT, "src/core/data/useTranslatedToolRegistry.tsx"),
     "utf8",
   );
@@ -268,7 +270,7 @@ export async function generateMissing(theme = THEME) {
 // Each tool's app icon lives as `icon="<material-symbol>"` just before its
 // `name: t("home.<id>.title", …)`. Pair each title with the closest preceding icon.
 function readRegistryIcons() {
-  const src = require("node:fs").readFileSync(
+  const src = readFileSync(
     path.join(ROOT, "src/core/data/useTranslatedToolRegistry.tsx"),
     "utf8",
   );
@@ -288,25 +290,26 @@ function readRegistryIcons() {
   return byId;
 }
 
-function iconExists(name) {
+async function iconExists(name) {
   if (!name) return false;
   try {
-    const { getIconData } = require("@iconify/utils");
-    return !!getIconData(
-      require("@iconify-json/material-symbols/icons.json"),
-      name,
+    const { getIconData } = await import("@iconify/utils");
+    const { default: set } = await import(
+      "@iconify-json/material-symbols/icons.json",
+      { with: { type: "json" } }
     );
+    return !!getIconData(set, name);
   } catch {
     return false;
   }
 }
 
 // First candidate that resolves; also tries dropping a "-rounded" suffix.
-function firstResolvableIcon(candidates) {
+async function firstResolvableIcon(candidates) {
   for (const c of candidates) {
-    if (iconExists(c)) return c;
+    if (await iconExists(c)) return c;
     const alt = c && c.replace(/-rounded$/, "");
-    if (alt && alt !== c && iconExists(alt)) return alt;
+    if (alt && alt !== c && (await iconExists(alt))) return alt;
   }
   return "description-outline";
 }
@@ -324,14 +327,14 @@ export async function generateAll(theme = THEME) {
   const { titles, descs } = readRegistryStrings();
   const regIcons = readRegistryIcons();
   const ogMap = JSON.parse(
-    require("node:fs").readFileSync(
-      path.join(ROOT, "src/core/data/ogImageMap.json"),
-      "utf8",
-    ),
+    readFileSync(path.join(ROOT, "src/core/data/ogImageMap.json"), "utf8"),
   );
   const results = [];
   for (const [id, basename] of Object.entries(ogMap)) {
-    const icon = firstResolvableIcon([regIcons[id], MISSING_TOOL_ICONS[id]]);
+    const icon = await firstResolvableIcon([
+      regIcons[id],
+      MISSING_TOOL_ICONS[id],
+    ]);
     await renderOgCard({
       name: titles[id] || humanizeId(id),
       description: descs[id] || "",
diff --git a/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts b/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
index de9d803d25..d1b3641962 100644
--- a/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
+++ b/frontend/editor/src/core/tests/live/encrypted-unlock-then-tool.spec.ts
@@ -7,7 +7,7 @@ import {
 } from "@app/tests/helpers/ui-helpers";
 import path from "path";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const ENCRYPTED_PDF = path.join(FIXTURES_DIR, "encrypted.pdf");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 
diff --git a/frontend/editor/src/core/tests/stubbed/add-page-numbers-tool.spec.ts b/frontend/editor/src/core/tests/stubbed/add-page-numbers-tool.spec.ts
index ecb6f6ce0b..8fa6a1940c 100644
--- a/frontend/editor/src/core/tests/stubbed/add-page-numbers-tool.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/add-page-numbers-tool.spec.ts
@@ -2,7 +2,10 @@ import { test, expect } from "@app/tests/helpers/stub-test-base";
 import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import path from "path";
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 /**
  * Add Page Numbers walks the user through a multi-step config: position
diff --git a/frontend/editor/src/core/tests/stubbed/add-stamp-tool.spec.ts b/frontend/editor/src/core/tests/stubbed/add-stamp-tool.spec.ts
index 56236d5bb4..6c6adbb4ac 100644
--- a/frontend/editor/src/core/tests/stubbed/add-stamp-tool.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/add-stamp-tool.spec.ts
@@ -2,7 +2,10 @@ import { test, expect } from "@app/tests/helpers/stub-test-base";
 import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import path from "path";
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 /**
  * AddStamp loads, accepts a PDF upload, and remains interactive.
diff --git a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
index 807e4231d4..f72d642a8e 100644
--- a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
@@ -3,7 +3,7 @@ import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import type { Page, Route } from "@playwright/test";
 import path from "path";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 
 // app-config the desktop bundle would return: hardware signing is offered only there.
diff --git a/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts b/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
index 075464c587..a00a91c6ba 100644
--- a/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/certificate-validation.spec.ts
@@ -5,7 +5,7 @@ import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 // ---------------------------------------------------------------------------
 // Test fixtures — pre-generated keystores in test-fixtures/certs/
 // ---------------------------------------------------------------------------
-const CERTS_DIR = path.join(__dirname, "../test-fixtures/certs");
+const CERTS_DIR = path.join(import.meta.dirname, "../test-fixtures/certs");
 const VALID_P12 = path.join(CERTS_DIR, "valid-test.p12");
 const EXPIRED_P12 = path.join(CERTS_DIR, "expired-test.p12");
 const NOT_YET_VALID_P12 = path.join(CERTS_DIR, "not-yet-valid-test.p12");
diff --git a/frontend/editor/src/core/tests/stubbed/comments-sidebar-order.spec.ts b/frontend/editor/src/core/tests/stubbed/comments-sidebar-order.spec.ts
index 097b162c85..91206b1222 100644
--- a/frontend/editor/src/core/tests/stubbed/comments-sidebar-order.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/comments-sidebar-order.spec.ts
@@ -2,7 +2,7 @@ import { test, expect } from "@app/tests/helpers/stub-test-base";
 import path from "path";
 
 const ANNOTATED_PDF = path.join(
-  __dirname,
+  import.meta.dirname,
   "../test-fixtures/annotations_out_of_order.pdf",
 );
 
diff --git a/frontend/editor/src/core/tests/stubbed/compare.spec.ts b/frontend/editor/src/core/tests/stubbed/compare.spec.ts
index 6bcaaee538..6893721465 100644
--- a/frontend/editor/src/core/tests/stubbed/compare.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/compare.spec.ts
@@ -22,7 +22,7 @@ import { test, expect, type Page } from "@playwright/test";
 import path from "path";
 import { mockAppApis } from "@app/tests/helpers/api-stubs";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const PDF_A = path.join(FIXTURES_DIR, "compare_sample_a.pdf");
 const PDF_B = path.join(FIXTURES_DIR, "compare_sample_b.pdf");
 
diff --git a/frontend/editor/src/core/tests/stubbed/convert.spec.ts b/frontend/editor/src/core/tests/stubbed/convert.spec.ts
index de8fa17a9c..52feefcb98 100644
--- a/frontend/editor/src/core/tests/stubbed/convert.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/convert.spec.ts
@@ -10,7 +10,7 @@ import path from "path";
 import { mockAppApis } from "@app/tests/helpers/api-stubs";
 import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 
 // ---------------------------------------------------------------------------
diff --git a/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts b/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
index 2a202b6cfe..430f5e4f24 100644
--- a/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/encrypted-pdf-unlock.spec.ts
@@ -23,7 +23,7 @@ import fs from "fs";
 import { mockAppApis } from "@app/tests/helpers/api-stubs";
 import { suppressNativeFilePicker } from "@app/tests/helpers/ui-helpers";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const ENCRYPTED_PDF = path.join(FIXTURES_DIR, "encrypted.pdf");
 
 const FAKE_UNLOCKED_PDF = Buffer.from(
diff --git a/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts b/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
index 6c84f6020a..09708bbb0a 100644
--- a/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/file-state-across-tools.spec.ts
@@ -2,7 +2,7 @@ import { test, expect } from "@app/tests/helpers/stub-test-base";
 import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import path from "path";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 
 /**
diff --git a/frontend/editor/src/core/tests/stubbed/merge-response-handling.spec.ts b/frontend/editor/src/core/tests/stubbed/merge-response-handling.spec.ts
index 8dd5662c3d..20a96e32f4 100644
--- a/frontend/editor/src/core/tests/stubbed/merge-response-handling.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/merge-response-handling.spec.ts
@@ -13,7 +13,7 @@ import fs from "fs";
 // `result.zip` instead of the merged file. The UI fix uses signature-based
 // detection - %PDF wins regardless of Content-Type.
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 const SAMPLE_PDF_BYTES = fs.readFileSync(SAMPLE_PDF);
 
diff --git a/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts b/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
index 5912c89211..aeb6eb0de2 100644
--- a/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
@@ -10,7 +10,10 @@ import { uploadFiles, dismissTourTooltip } from "@app/tests/helpers/ui-helpers";
 // Fixture: 4 portrait pages whose intrinsic /Rotate is 0, 90, 270, 180.
 // Page 3 (index 2) is 270 so a single rotate-right lands on a net-0 target -
 // the exact case the export used to drop, leaving the source rotation behind.
-const ROTATED_PDF = path.join(__dirname, "../test-fixtures/rotated-pages.pdf");
+const ROTATED_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/rotated-pages.pdf",
+);
 const SOURCE_ROTATIONS = [0, 90, 270, 180];
 
 /** Read the rotation each thumbnail is currently displaying (= page.rotation). */
diff --git a/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts b/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
index ce4bbce081..89d2fcfcce 100644
--- a/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/pdf-text-search.spec.ts
@@ -1,7 +1,10 @@
 import { test, expect } from "@app/tests/helpers/stub-test-base";
 import path from "path";
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 /**
  * The reader/viewer exposes an in-PDF text search via CustomSearchLayer.
diff --git a/frontend/editor/src/core/tests/stubbed/seed.spec.ts b/frontend/editor/src/core/tests/stubbed/seed.spec.ts
index e85e7a723f..6b50e198aa 100644
--- a/frontend/editor/src/core/tests/stubbed/seed.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/seed.spec.ts
@@ -22,7 +22,14 @@ function resolveFixturePath(filename: string): string {
       filename,
     ),
     path.join(process.cwd(), "src", "core", "tests", "test-fixtures", filename),
-    path.join(__dirname, "..", "core", "tests", "test-fixtures", filename),
+    path.join(
+      import.meta.dirname,
+      "..",
+      "core",
+      "tests",
+      "test-fixtures",
+      filename,
+    ),
   ];
   for (const p of candidates) {
     if (fs.existsSync(p)) return p;
diff --git a/frontend/editor/src/core/tests/stubbed/tour-onboarding.spec.ts b/frontend/editor/src/core/tests/stubbed/tour-onboarding.spec.ts
index 658407e263..8d4d07cd8c 100644
--- a/frontend/editor/src/core/tests/stubbed/tour-onboarding.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/tour-onboarding.spec.ts
@@ -17,7 +17,10 @@ import { uploadFiles, openSettings } from "@app/tests/helpers/ui-helpers";
  *   - whatsNewStepsConfig.ts
  */
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 // ---------------------------------------------------------------------------
 // 15.1 Static layout - always visible on the main page
diff --git a/frontend/editor/src/core/tests/stubbed/validate-signature-trust.spec.ts b/frontend/editor/src/core/tests/stubbed/validate-signature-trust.spec.ts
index e699451d9e..322b7cc88f 100644
--- a/frontend/editor/src/core/tests/stubbed/validate-signature-trust.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/validate-signature-trust.spec.ts
@@ -3,7 +3,7 @@ import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import type { Page, Route } from "@playwright/test";
 import path from "path";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 
 // Base backend SignatureValidationResult; tests override the trust-related fields.
diff --git a/frontend/editor/src/core/tests/stubbed/viewer-sidebar-add-buttons.spec.ts b/frontend/editor/src/core/tests/stubbed/viewer-sidebar-add-buttons.spec.ts
index ad3527c9c3..67df3865e1 100644
--- a/frontend/editor/src/core/tests/stubbed/viewer-sidebar-add-buttons.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/viewer-sidebar-add-buttons.spec.ts
@@ -17,7 +17,10 @@ import path from "path";
  * Backend-free spec.
  */
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 async function openViewerWithSample(page: import("@playwright/test").Page) {
   await page.goto("/read");
diff --git a/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts b/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
index 1a7486e37a..d9a08ae9e7 100644
--- a/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/viewer-text-selection.spec.ts
@@ -1,7 +1,7 @@
 import path from "path";
 import { test, expect } from "@app/tests/helpers/stub-test-base";
 
-const FIXTURES_DIR = path.join(__dirname, "../test-fixtures");
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
 const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
 const MULTIPAGE_PDF = path.join(FIXTURES_DIR, "annotations_out_of_order.pdf");
 
diff --git a/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts b/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
index 47ad9cd57c..e2d3ffcb71 100644
--- a/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
@@ -2,7 +2,10 @@ import { test, expect } from "@app/tests/helpers/stub-test-base";
 import { uploadFiles } from "@app/tests/helpers/ui-helpers";
 import path from "path";
 
-const SAMPLE_PDF = path.join(__dirname, "../test-fixtures/sample.pdf");
+const SAMPLE_PDF = path.join(
+  import.meta.dirname,
+  "../test-fixtures/sample.pdf",
+);
 
 /**
  * Watermark has three modes — text / image / file overlay — selected via
diff --git a/frontend/editor/tailwind.config.js b/frontend/editor/tailwind.config.js
index b38eea76ee..37af74b68a 100644
--- a/frontend/editor/tailwind.config.js
+++ b/frontend/editor/tailwind.config.js
@@ -1,5 +1,5 @@
 /** @type {import('tailwindcss').Config} */
-module.exports = {
+export default {
   content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"],
   darkMode: ["class", '[data-mantine-color-scheme="dark"]'],
   theme: {
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 4a3df8ad10..81698ddde6 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -64,7 +64,6 @@ export default defineConfig(
         },
       ],
       "@typescript-eslint/no-explicit-any": "off", // Temporarily disabled until codebase conformant
-      "@typescript-eslint/no-require-imports": "off", // Temporarily disabled until codebase conformant
       "@typescript-eslint/no-unused-vars": [
         "error",
         {
diff --git a/frontend/package.json b/frontend/package.json
index e9d57208e2..f9f035fa0d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -2,6 +2,7 @@
   "name": "frontend",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "license": "SEE LICENSE IN https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/refs/heads/main/proprietary/LICENSE",
   "proxy": "http://localhost:8080",
   "dependencies": {
diff --git a/frontend/scripts/update-minor.js b/frontend/scripts/update-minor.js
index 3765265656..c0bb9467c2 100644
--- a/frontend/scripts/update-minor.js
+++ b/frontend/scripts/update-minor.js
@@ -5,7 +5,7 @@
  * Calculates date from 7 days ago and runs npm update/audit with that date
  */
 
-const { spawn } = require("child_process");
+import { spawn } from "node:child_process";
 
 // Calculate date from 7 days ago in YYYY-MM-DD format
 const date = new Date();

From 7bd38261788be970c4cd32eadeec6e8b83945133 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Tue, 7 Jul 2026 13:02:02 +0100
Subject: [PATCH 14/35] Portal procurement: real pricing/trial/quote spine +
 linked-gated checkout (vertical slice) (#6861)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What this is

The enterprise procurement flow, built into the customer portal as a
**vertical slice** — one linked account can go the whole way from trial
to a paid, committed subscription, using real Stripe under the hood.

Procurement no longer lives as a nav tab. It sits on **Home** as a
deal-status hero and expands into a full-screen takeover, matching the
marketing prototype.

## The journey (what a customer does)

- **Start a trial** in one click — the deadline and next steps show on
the Home hero (no card, mock licence).
- **Build a quote** — a short form (volume → commitment & service →
details); pricing is computed server-side.
- **Generate the quote** — this creates a real **Stripe Quote** with a
proper **PDF** you can download and share, and it becomes a milestone
you can come back to.
- **Review & sign the agreement** — one combined agreement (MSA + Order
Form + EULA + DPA) with an itemised order form and an "I agree" (no
e-signature yet).
- **Accept** — Stripe creates the committed annual **subscription** and
its **first invoice**, which you can **pay or download right in the
app** (no waiting on email).
- Edit a quote any time — it remembers your inputs and company name; the
old Stripe quote is cancelled so it can't still be accepted.
- The hero also has quick actions: **key documents**, **invite
teammates**, **schedule a call**, and a **trial countdown** you can
extend.

## Architecture — Supabase vs Java

Pricing, deal/quote state, and the commercial journey live in **Java
(`:saas`)**. Everything that touches **Stripe** (writes + PDFs) lives in
**Supabase edge functions** — Java has no Stripe SDK and only reads
Stripe via the sync mirror. The portal calls both.

```mermaid
flowchart LR
  Portal["Portal (React · editor/src/portal)"]

  subgraph JAVA["Java :saas backend (trusted cloud)"]
    Pricing["Pricing engine (volume bands, SLA, term, add-ons)"]
    Deal["Deal + quote state, journey, snapshot"]
    Trial["Trial (mock Keygen licence seam)"]
    Authz["Auth: team resolve + leader gating"]
    Mirror["Reads Stripe via sync mirror (stripe.* tables)"]
  end

  subgraph SUPA["Supabase edge functions (own Stripe)"]
    Issue["issue-procurement-quote → create + finalize Stripe Quote"]
    Accept["accept-procurement-quote → subscription + finalize invoice"]
    Pdf["get-procurement-quote-pdf → proxy the quote PDF"]
    RPC["SECURITY DEFINER RPCs (read/write stirling_pdf, enforce team/leader)"]
  end

  Stripe["Stripe (Quotes · Subscription · Invoice)"]

  Portal -->|"price / build / trial / agreement / snapshot"| JAVA
  Portal -->|"issue / accept / download PDF"| SUPA
  SUPA --> Stripe
  SUPA --- RPC
  Mirror -. reads .-> Stripe
```

| Top-level feature | Handled in |
|---|---|
| Quote pricing (bands, SLA, term, add-ons) | **Java** |
| Deal + quote state, journey, snapshot | **Java** |
| Trial start / extend (mock licence) | **Java** |
| AuthN/Z (team resolve, leader gating) | **Java** |
| Issue quote → Stripe Quote + PDF | **Supabase edge fn** |
| Accept → subscription + invoice | **Supabase edge fn** |
| Quote PDF download | **Supabase edge fn** |
| Reading Stripe state | **Java** (sync mirror) |
| `stirling_pdf` writes from edge | **SECURITY DEFINER RPCs**
(service-role only) |

## Screenshots

<!-- Drag each PNG into the box below it before publishing. -->

**Home deal-status hero (trial)**
<img width="1920" height="1009" alt="hero-check"
src="https://github.com/user-attachments/assets/7ae21831-9578-4f4d-b91a-d3ab2cb171dc"
/>

**Issued quote milestone (with breakdown)**
<img width="1920" height="1009" alt="milestone-breakdown"
src="https://github.com/user-attachments/assets/3a463c67-3c6e-4f93-a1cc-59b250d54cc9"
/>


**Agreement step (itemised order form)**
<img width="1920" height="1009" alt="agreement-itemised"
src="https://github.com/user-attachments/assets/1a4efa16-d0a3-41d0-849c-a125b1492a34"
/>

**Key documents**
<img width="1920" height="1009" alt="keydocs-modal"
src="https://github.com/user-attachments/assets/5672d1d2-99d9-499e-9edf-d485df378e7f"
/>

**Subscription created (pay / download invoice)**
<img width="1920" height="1009" alt="accepted-check"
src="https://github.com/user-attachments/assets/3a8cbe9f-e72c-4389-b365-0c1749108b6f"
/>


## Mocked for now (scaffolding, not wired to real backends)

- **Key documents** ledger — static demo list.
- **Schedule a call** — static solutions-engineer + time slots.
- **Invite teammates** — routes to the existing Users view.
- **Simulate payment received** / **Reset procurement** — demo controls,
**off by default** in prod (flag-gated), 404 unless enabled.

## Deferred (separate follow-up PRs)

- **Real `invoice.paid` webhook** → go-live (today a demo button stands
in).
- **Keygen licence controller** — real licensing (currently a mock
seam).
- **Document sharing**.
- **Stirling admin / Deal Desk** view.
- **Minimum ACV floor** — pending a number from marketing (server-side
enforcement is a one-liner once decided).

## How to test

- **Frontend, no backend:** runs against MSW mocks (Storybook + mocks-on
dev) — the whole journey is clickable.
- **Real end-to-end:** apply the migrations (Flyway `V27–V29` / Supabase
`20260701–20260707`), deploy the three edge functions, ensure
**Invoicing Plus** is enabled on Stripe, and set
`STIRLING_PROCUREMENT_DEMO_CONTROLS_ENABLED=true` if you want the demo
controls.
- Paired SaaS PR: **Stirling-Tools/Stirling-PDF-SaaS#318**.

## Notes for reviewers

- Pricing is server-authoritative (client sends config, never amounts).
- Security review done: edge functions validate the JWT and enforce
**team membership** (and **leader** for issue/accept) via the RPC; demo
endpoints are flag-gated off. Only open item is the ACV floor (policy).
---
 .../software/saas/config/SaasJpaConfig.java   |    6 +-
 .../api/ProcurementController.java            |  321 ++++++
 .../ProcurementConfigurationProperties.java   |   33 +
 .../license/EnterpriseLicenseService.java     |   25 +
 .../license/MockEnterpriseLicenseService.java |   54 +
 .../procurement/model/ProcurementDeal.java    |   87 ++
 .../procurement/model/ProcurementQuote.java   |  119 ++
 .../procurement/pricing/PricingRates.java     |   53 +
 .../pricing/ProcurementPricingService.java    |  125 ++
 .../procurement/pricing/QuoteBreakdown.java   |   12 +
 .../saas/procurement/pricing/QuoteConfig.java |   26 +
 .../procurement/pricing/QuoteLineItem.java    |   16 +
 .../repository/ProcurementDealRepository.java |   17 +
 .../ProcurementQuoteRepository.java           |   12 +
 .../service/ProcurementService.java           |  244 ++++
 .../db/migration/saas/V27__procurement.sql    |   72 ++
 .../saas/V28__procurement_stripe_quote.sql    |    8 +
 .../saas/V29__procurement_business_name.sql   |    5 +
 .../ProcurementPricingServiceTest.java        |   87 ++
 frontend/.gitignore                           |    1 +
 frontend/.storybook/preview.tsx               |    6 +-
 .../public/locales/en-US/translation.toml     |  129 ++-
 frontend/editor/src/portal/api/procurement.ts |  163 +++
 .../editor/src/portal/components/Sidebar.tsx  |   12 +-
 .../components/billing/EnterpriseUpsell.tsx   |   12 +-
 .../procurement/DealStatusHero.stories.tsx    |   47 +
 .../components/procurement/DealStatusHero.tsx |  162 +++
 .../procurement/ProcurementAgreement.tsx      |  126 +++
 .../procurement/ProcurementExtras.tsx         |  299 +++++
 .../procurement/ProcurementHome.stories.tsx   |   18 +
 .../procurement/ProcurementHome.tsx           |  296 +++++
 .../procurement/ProcurementModal.stories.tsx  |   42 +
 .../procurement/ProcurementModal.tsx          |  102 ++
 .../procurement/ProcurementStages.tsx         |  160 +++
 .../procurement/QuoteBuilder.stories.tsx      |   20 +
 .../components/procurement/QuoteBuilder.tsx   |  436 +++++++
 .../portal/components/procurement/format.ts   |    9 +
 .../editor/src/portal/mocks/handlers/index.ts |    2 +
 .../portal/mocks/handlers/procurementSaas.ts  |  241 ++++
 frontend/editor/src/portal/views/Home.tsx     |    3 +
 .../editor/src/portal/views/Procurement.css   | 1007 +++++++++++++++++
 .../editor/src/portal/views/Procurement.tsx   |  106 +-
 42 files changed, 4603 insertions(+), 118 deletions(-)
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/config/ProcurementConfigurationProperties.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementDeal.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteBreakdown.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteLineItem.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementDealRepository.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementQuoteRepository.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
 create mode 100644 app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
 create mode 100644 frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementHome.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementModal.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/QuoteBuilder.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
 create mode 100644 frontend/editor/src/portal/mocks/handlers/procurementSaas.ts

diff --git a/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java b/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
index 5e90df6bf5..53a5f34c15 100644
--- a/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
+++ b/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
@@ -18,13 +18,15 @@ import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
             "stirling.software.saas.repository",
             "stirling.software.saas.billing.repository",
             "stirling.software.saas.ai.repository",
-            "stirling.software.saas.payg.repository"
+            "stirling.software.saas.payg.repository",
+            "stirling.software.saas.procurement.repository"
         })
 @EntityScan({
     "stirling.software.saas.accountlink",
     "stirling.software.saas.model",
     "stirling.software.saas.billing.model",
     "stirling.software.saas.ai.model",
-    "stirling.software.saas.payg"
+    "stirling.software.saas.payg",
+    "stirling.software.saas.procurement.model"
 })
 public class SaasJpaConfig {}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java b/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
new file mode 100644
index 0000000000..1f27896b87
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
@@ -0,0 +1,321 @@
+package stirling.software.saas.procurement.api;
+
+import java.util.List;
+import java.util.Objects;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.swagger.v3.oas.annotations.Hidden;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.enumeration.TeamRole;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.saas.model.TeamMembership;
+import stirling.software.saas.procurement.config.ProcurementConfigurationProperties;
+import stirling.software.saas.procurement.model.ProcurementDeal;
+import stirling.software.saas.procurement.model.ProcurementQuote;
+import stirling.software.saas.procurement.pricing.QuoteConfig;
+import stirling.software.saas.procurement.pricing.QuoteLineItem;
+import stirling.software.saas.procurement.service.ProcurementService;
+import stirling.software.saas.repository.TeamMembershipRepository;
+import stirling.software.saas.util.AuthenticationUtils;
+
+/**
+ * The enterprise procurement journey for a linked team: read the deal snapshot, start/extend a
+ * (mock-licensed) trial, build a server-priced quote, and accept it. Stripe checkout itself is a
+ * Supabase edge function the portal calls with the accepted quote — this controller never touches
+ * Stripe. The caller's team is resolved from the authenticated principal; a team id is never
+ * trusted from the request. Mutations require the team leader.
+ */
+@Slf4j
+@Hidden
+@RestController
+@RequestMapping("/api/v1/procurement")
+@Profile("saas")
+public class ProcurementController {
+
+    // Local mapper to parse the stored line-items JSON; the saas context exposes no injectable
+    // ObjectMapper bean.
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+    private final ProcurementService procurement;
+    private final TeamMembershipRepository memberRepo;
+    private final UserRepository userRepository;
+    private final ProcurementConfigurationProperties config;
+
+    public ProcurementController(
+            ProcurementService procurement,
+            TeamMembershipRepository memberRepo,
+            UserRepository userRepository,
+            ProcurementConfigurationProperties config) {
+        this.procurement = Objects.requireNonNull(procurement);
+        this.memberRepo = Objects.requireNonNull(memberRepo);
+        this.userRepository = Objects.requireNonNull(userRepository);
+        this.config = Objects.requireNonNull(config);
+    }
+
+    // ---- request / response DTOs -------------------------------------------
+
+    public record QuoteRequest(
+            long volume,
+            int users,
+            String deployment,
+            int termYears,
+            String serviceLevel,
+            boolean indemnification,
+            boolean training,
+            boolean qbr,
+            String currency,
+            String businessName) {
+        QuoteConfig toConfig() {
+            return new QuoteConfig(
+                    volume,
+                    users,
+                    deployment,
+                    termYears,
+                    serviceLevel,
+                    indemnification,
+                    training,
+                    qbr,
+                    currency);
+        }
+    }
+
+    public record QuoteResponse(
+            Long quoteId,
+            String quoteNumber,
+            String status,
+            String currency,
+            long annualNetMinor,
+            long tcvMinor,
+            List<QuoteLineItem> lineItems,
+            String validUntil,
+            String stripeQuoteId,
+            String invoiceUrl,
+            QuoteConfigEcho config) {}
+
+    /**
+     * The inputs the quote was priced from, echoed back so the builder can seed itself when the
+     * buyer re-edits an existing quote. {@code users} is not persisted (only the resulting volume
+     * is), so it is always 0 here; the builder treats the seeded volume as manually set.
+     */
+    public record QuoteConfigEcho(
+            long volume,
+            int users,
+            String deployment,
+            int termYears,
+            String serviceLevel,
+            boolean indemnification,
+            boolean training,
+            boolean qbr,
+            String currency,
+            String businessName) {}
+
+    public record SnapshotResponse(
+            Long dealId,
+            String stage,
+            String trialStartedAt,
+            String trialEndsAt,
+            int trialExtensionsUsed,
+            boolean licensed,
+            QuoteResponse latestQuote) {}
+
+    // ---- endpoints ----------------------------------------------------------
+
+    /**
+     * The team's deal snapshot. Always 200 with a single shape; an unstarted procurement returns an
+     * empty snapshot ({@code dealId == null}) so the portal can render the "start" state without
+     * special-casing an empty body.
+     */
+    @GetMapping
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> snapshot(Authentication auth) {
+        Long teamId = resolveTeam(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        return ResponseEntity.ok(
+                procurement.getDeal(teamId).map(this::toSnapshot).orElse(EMPTY_SNAPSHOT));
+    }
+
+    private static final SnapshotResponse EMPTY_SNAPSHOT =
+            new SnapshotResponse(null, null, null, null, 0, false, null);
+
+    @PostMapping("/trial/start")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> startTrial(Authentication auth) {
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        return ResponseEntity.ok(toSnapshot(procurement.startTrial(teamId)));
+    }
+
+    @PostMapping("/trial/extend")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> extendTrial(Authentication auth) {
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        try {
+            return ResponseEntity.ok(toSnapshot(procurement.extendTrial(teamId)));
+        } catch (IllegalStateException e) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        }
+    }
+
+    @PostMapping("/quote")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<QuoteResponse> buildQuote(
+            @RequestBody QuoteRequest request, Authentication auth) {
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        return ResponseEntity.ok(
+                toQuote(
+                        procurement.buildQuote(
+                                teamId, request.toConfig(), request.businessName())));
+    }
+
+    // Issue + accept are Supabase edge functions (they own Stripe): issue-procurement-quote turns a
+    // draft into a finalized Stripe Quote; accept-procurement-quote accepts it into a subscription.
+    // Both persist their results via SECURITY DEFINER RPCs; the snapshot above reflects them.
+
+    /**
+     * Advance an issued quote to the agreement (security) stage, where the buyer reviews + agrees.
+     */
+    @PostMapping("/agreement")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> startAgreement(Authentication auth) {
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        try {
+            return ResponseEntity.ok(toSnapshot(procurement.startAgreement(teamId)));
+        } catch (IllegalStateException e) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        }
+    }
+
+    /**
+     * Demo/manual stand-in for the {@code invoice.paid} webhook: mark the deal live (issue the
+     * annual licence, advance to active). The real go-live is webhook-driven once payment settles.
+     */
+    @PostMapping("/go-live")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> goLive(Authentication auth) {
+        if (!config.isDemoControlsEnabled()) return ResponseEntity.notFound().build();
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        try {
+            return ResponseEntity.ok(toSnapshot(procurement.markLive(teamId)));
+        } catch (IllegalStateException e) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        }
+    }
+
+    /** Reset the team's procurement (delete the deal + quotes); returns the empty snapshot. */
+    @PostMapping("/reset")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<SnapshotResponse> reset(Authentication auth) {
+        if (!config.isDemoControlsEnabled()) return ResponseEntity.notFound().build();
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        procurement.resetDeal(teamId);
+        return ResponseEntity.ok(EMPTY_SNAPSHOT);
+    }
+
+    // ---- helpers ------------------------------------------------------------
+
+    /**
+     * Resolve the caller's team from their primary membership; null when unauthenticated/teamless.
+     */
+    private Long resolveTeam(Authentication auth) {
+        User user;
+        try {
+            user = AuthenticationUtils.getCurrentUser(auth, userRepository);
+        } catch (SecurityException e) {
+            return null;
+        }
+        List<TeamMembership> rows = memberRepo.findPrimaryMembership(user.getId());
+        return rows.isEmpty() ? null : rows.get(0).getTeam().getId();
+    }
+
+    /** Team id only when the caller is the team leader; null otherwise (commercial actions). */
+    private Long requireLeader(Authentication auth) {
+        User user;
+        try {
+            user = AuthenticationUtils.getCurrentUser(auth, userRepository);
+        } catch (SecurityException e) {
+            return null;
+        }
+        List<TeamMembership> rows = memberRepo.findPrimaryMembership(user.getId());
+        if (rows.isEmpty() || rows.get(0).getRole() != TeamRole.LEADER) return null;
+        return rows.get(0).getTeam().getId();
+    }
+
+    private SnapshotResponse toSnapshot(ProcurementDeal deal) {
+        QuoteResponse latest =
+                procurement.quotesForDeal(deal.getDealId()).stream()
+                        .findFirst()
+                        .map(this::toQuote)
+                        .orElse(null);
+        return new SnapshotResponse(
+                deal.getDealId(),
+                deal.getStage(),
+                str(deal.getTrialStartedAt()),
+                str(deal.getTrialEndsAt()),
+                deal.getTrialExtensionsUsed(),
+                deal.getLicenseRef() != null,
+                latest);
+    }
+
+    private QuoteResponse toQuote(ProcurementQuote q) {
+        return new QuoteResponse(
+                q.getQuoteId(),
+                q.getQuoteNumber(),
+                q.getStatus(),
+                q.getCurrency(),
+                q.getAnnualNetMinor(),
+                q.getTcvMinor(),
+                parseLineItems(q.getLineItemsJson()),
+                q.getValidUntil() == null ? null : q.getValidUntil().toString(),
+                q.getStripeQuoteId(),
+                q.getStripeInvoiceUrl(),
+                new QuoteConfigEcho(
+                        q.getVolume(),
+                        0,
+                        q.getDeployment(),
+                        q.getTermYears(),
+                        q.getServiceLevel(),
+                        q.isIndemnification(),
+                        q.isTraining(),
+                        q.isQbr(),
+                        q.getCurrency(),
+                        q.getBusinessName()));
+    }
+
+    private List<QuoteLineItem> parseLineItems(String json) {
+        if (json == null || json.isBlank()) return List.of();
+        try {
+            return OBJECT_MAPPER.readValue(
+                    json,
+                    OBJECT_MAPPER
+                            .getTypeFactory()
+                            .constructCollectionType(List.class, QuoteLineItem.class));
+        } catch (Exception e) {
+            log.warn("[procurement] failed to parse line items", e);
+            return List.of();
+        }
+    }
+
+    private static String str(Object o) {
+        return o == null ? null : o.toString();
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/config/ProcurementConfigurationProperties.java b/app/saas/src/main/java/stirling/software/saas/procurement/config/ProcurementConfigurationProperties.java
new file mode 100644
index 0000000000..98ec0cd573
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/config/ProcurementConfigurationProperties.java
@@ -0,0 +1,33 @@
+package stirling.software.saas.procurement.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/** Tunables for the enterprise procurement flow. Prefix {@code stirling.procurement}. */
+@Getter
+@Setter
+@Component
+@Profile("saas")
+@ConfigurationProperties(prefix = "stirling.procurement")
+public class ProcurementConfigurationProperties {
+
+    /** Free trial length, in days (no card). */
+    private int trialDurationDays = 14;
+
+    /** Days added per trial extension. */
+    private int trialExtensionDays = 7;
+
+    /** Maximum number of trial extensions a buyer may take. */
+    private int maxTrialExtensions = 2;
+
+    /**
+     * Enables the demo-only endpoints (POST /reset, POST /go-live) that reset a team's procurement
+     * or mark it live without payment. Off by default; turn on ONLY in demo/dev environments —
+     * /go-live is a stand-in for the invoice.paid webhook and would let a leader activate unpaid.
+     */
+    private boolean demoControlsEnabled = false;
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
new file mode 100644
index 0000000000..0f0c242601
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
@@ -0,0 +1,25 @@
+package stirling.software.saas.procurement.license;
+
+import java.time.LocalDateTime;
+
+/**
+ * Issues and modifies the customer-facing entitlement that actually unlocks the product for an
+ * enterprise deal — a Keygen licence (trial or annual, connected or air-gapped). This is the seam
+ * the real Keygen management client plugs into; today {@link MockEnterpriseLicenseService} records
+ * intent without calling Keygen. Distinct from the EE {@code KeygenLicenseVerifier}, which only
+ * verifies this instance's own licence.
+ */
+public interface EnterpriseLicenseService {
+
+    /** Issue a time-boxed trial licence for the team; returns the licence reference. */
+    String issueTrialLicense(Long teamId, LocalDateTime expiresAt);
+
+    /** Move a licence's expiry out (trial extension). */
+    void extendLicense(String licenseRef, LocalDateTime newExpiry);
+
+    /** Issue/upgrade to a committed annual licence with the quote's entitlements. */
+    String issueAnnualLicense(Long teamId, String deployment, LocalDateTime expiresAt);
+
+    /** Suspend a licence (e.g. payment failed, deal lost). */
+    void suspendLicense(String licenseRef);
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
new file mode 100644
index 0000000000..bde31a4119
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
@@ -0,0 +1,54 @@
+package stirling.software.saas.procurement.license;
+
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Mock implementation of {@link EnterpriseLicenseService}: records the intended licence action and
+ * returns a synthetic reference, without calling Keygen. Lets the whole procurement journey run
+ * end-to-end while the real Keygen management client is a later drop-in — the seam and the stored
+ * {@code license_ref} on the deal stay identical.
+ */
+@Slf4j
+@Service
+@Profile("saas")
+public class MockEnterpriseLicenseService implements EnterpriseLicenseService {
+
+    @Override
+    public String issueTrialLicense(Long teamId, LocalDateTime expiresAt) {
+        String ref = "mock-trial-" + UUID.randomUUID();
+        log.info(
+                "[procurement][mock-license] issue trial team={} expires={} ref={}",
+                teamId,
+                expiresAt,
+                ref);
+        return ref;
+    }
+
+    @Override
+    public void extendLicense(String licenseRef, LocalDateTime newExpiry) {
+        log.info("[procurement][mock-license] extend ref={} newExpiry={}", licenseRef, newExpiry);
+    }
+
+    @Override
+    public String issueAnnualLicense(Long teamId, String deployment, LocalDateTime expiresAt) {
+        String ref = "mock-annual-" + UUID.randomUUID();
+        log.info(
+                "[procurement][mock-license] issue annual team={} deployment={} expires={} ref={}",
+                teamId,
+                deployment,
+                expiresAt,
+                ref);
+        return ref;
+    }
+
+    @Override
+    public void suspendLicense(String licenseRef) {
+        log.info("[procurement][mock-license] suspend ref={}", licenseRef);
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementDeal.java b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementDeal.java
new file mode 100644
index 0000000000..f97d66f365
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementDeal.java
@@ -0,0 +1,87 @@
+package stirling.software.saas.procurement.model;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.CreationTimestamp;
+import org.hibernate.annotations.UpdateTimestamp;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.Version;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * A linked team's enterprise commercial journey (one per team). Stage mirrors the buyer journey the
+ * portal renders (trial -&gt; quote -&gt; agreement -&gt; payment -&gt; live). The entitlement that
+ * actually unlocks the product is the Keygen licence in {@code licenseRef}; the paid subscription,
+ * once commercial, is mirrored in {@code billing_subscriptions} and referenced by {@code
+ * subscriptionId}.
+ */
+@Entity
+@Table(name = "procurement_deal")
+@NoArgsConstructor
+@Getter
+@Setter
+public class ProcurementDeal implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    public static final String STAGE_TRIAL = "trial";
+    public static final String STAGE_QUOTE = "quote";
+    public static final String STAGE_AGREEMENT = "security";
+    public static final String STAGE_PAYMENT = "procurement";
+    public static final String STAGE_LIVE = "active";
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "deal_id")
+    private Long dealId;
+
+    @Column(name = "team_id", nullable = false, unique = true)
+    private Long teamId;
+
+    @Column(name = "stage", nullable = false, length = 32)
+    private String stage = STAGE_TRIAL;
+
+    @Column(name = "trial_started_at")
+    private LocalDateTime trialStartedAt;
+
+    @Column(name = "trial_ends_at")
+    private LocalDateTime trialEndsAt;
+
+    @Column(name = "trial_extensions_used", nullable = false)
+    private int trialExtensionsUsed;
+
+    @Column(name = "license_ref", length = 128)
+    private String licenseRef;
+
+    @Column(name = "subscription_id", length = 255)
+    private String subscriptionId;
+
+    @Column(name = "accepted_quote_id")
+    private Long acceptedQuoteId;
+
+    @CreationTimestamp
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private LocalDateTime createdAt;
+
+    @UpdateTimestamp
+    @Column(name = "updated_at", nullable = false)
+    private LocalDateTime updatedAt;
+
+    @Version
+    @Column(name = "version", nullable = false)
+    private Long version;
+
+    public ProcurementDeal(Long teamId) {
+        this.teamId = teamId;
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
new file mode 100644
index 0000000000..d8f4c3edb7
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
@@ -0,0 +1,119 @@
+package stirling.software.saas.procurement.model;
+
+import java.io.Serializable;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.CreationTimestamp;
+import org.hibernate.annotations.UpdateTimestamp;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.Version;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * A priced, itemised offer built against a {@link ProcurementDeal}. The config columns are the
+ * buyer's choices; {@code annualNetMinor}/{@code tcvMinor} and {@code lineItemsJson} are the
+ * server-computed result (never trusted from the client). Stripe fields are populated when the
+ * accepted quote is turned into a checkout.
+ */
+@Entity
+@Table(name = "procurement_quote")
+@NoArgsConstructor
+@Getter
+@Setter
+public class ProcurementQuote implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    public static final String STATUS_DRAFT = "draft";
+    public static final String STATUS_SENT = "sent";
+    public static final String STATUS_ACCEPTED = "accepted";
+    public static final String STATUS_EXPIRED = "expired";
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "quote_id")
+    private Long quoteId;
+
+    @Column(name = "deal_id", nullable = false)
+    private Long dealId;
+
+    @Column(name = "quote_number", nullable = false, length = 64)
+    private String quoteNumber;
+
+    @Column(name = "status", nullable = false, length = 24)
+    private String status = STATUS_DRAFT;
+
+    @Column(name = "currency", nullable = false, length = 8)
+    private String currency = "USD";
+
+    @Column(name = "volume", nullable = false)
+    private long volume;
+
+    @Column(name = "seats")
+    private Integer seats;
+
+    @Column(name = "deployment", length = 24)
+    private String deployment;
+
+    @Column(name = "term_years", nullable = false)
+    private int termYears;
+
+    @Column(name = "service_level", nullable = false, length = 24)
+    private String serviceLevel;
+
+    @Column(name = "indemnification", nullable = false)
+    private boolean indemnification;
+
+    @Column(name = "training", nullable = false)
+    private boolean training;
+
+    @Column(name = "qbr", nullable = false)
+    private boolean qbr;
+
+    @Column(name = "annual_net_minor", nullable = false)
+    private long annualNetMinor;
+
+    @Column(name = "tcv_minor", nullable = false)
+    private long tcvMinor;
+
+    @Column(name = "line_items", columnDefinition = "text")
+    private String lineItemsJson;
+
+    // The Stripe Quote this was issued as (finalized → has a number + PDF). Set by the edge fn.
+    @Column(name = "stripe_quote_id", length = 128)
+    private String stripeQuoteId;
+
+    // Hosted Stripe invoice URL for the subscription's first invoice, set once the quote is
+    // accepted.
+    @Column(name = "stripe_invoice_url", columnDefinition = "text")
+    private String stripeInvoiceUrl;
+
+    // Buyer's company name (shown on the quote/agreement); echoed back so an edit remembers it.
+    @Column(name = "business_name", length = 255)
+    private String businessName;
+
+    @Column(name = "valid_until")
+    private LocalDate validUntil;
+
+    @CreationTimestamp
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private LocalDateTime createdAt;
+
+    @UpdateTimestamp
+    @Column(name = "updated_at", nullable = false)
+    private LocalDateTime updatedAt;
+
+    @Version
+    @Column(name = "version", nullable = false)
+    private Long version;
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
new file mode 100644
index 0000000000..19a3ab759d
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
@@ -0,0 +1,53 @@
+package stirling.software.saas.procurement.pricing;
+
+/**
+ * The enterprise rate card: the inputs pricing multiplies against. In production these are read
+ * from the Stripe price mirror (see {@code StripeMirrorPriceCatalog}); {@link #defaults()} is the
+ * fallback used when the {@code stripe} schema isn't synced (dev / tests) and is the single source
+ * of the numbers the marketing prototype encodes.
+ *
+ * <p>Per-PDF rates are in minor units (cents) per document. Multipliers are fractions (e.g. 0.15 =
+ * +15%). Flat/one-time fees are in minor units.
+ */
+public record PricingRates(
+        long perPdfMinorUnder1M,
+        long perPdfMinorUnder5M,
+        long perPdfMinor5MPlus,
+        double priorityUplift,
+        double dedicatedUplift,
+        double indemnificationUplift,
+        double[] termDiscountByYear, // index 0 = 1yr … index 4 = 5yr
+        long qbrAnnualMinor,
+        long trainingOneTimeMinor) {
+
+    public static PricingRates defaults() {
+        return new PricingRates(
+                5, // $0.05 / PDF under 1M/yr
+                4, // $0.04 / PDF at 1M–5M/yr
+                3, // $0.03 / PDF at 5M+/yr
+                0.15, // priority +15%
+                0.30, // dedicated +30%
+                0.05, // IP indemnification +5%
+                new double[] {0.0, 0.05, 0.10, 0.12, 0.15},
+                800_000, // QBRs $8,000 / yr
+                750_000); // onboarding & training $7,500 one-time
+    }
+
+    /** Volume-banded per-PDF rate for an annual volume, in minor units. */
+    public long perPdfMinor(long annualVolume) {
+        if (annualVolume >= 5_000_000) return perPdfMinor5MPlus;
+        if (annualVolume >= 1_000_000) return perPdfMinorUnder5M;
+        return perPdfMinorUnder1M;
+    }
+
+    public double termDiscount(int termYears) {
+        int idx = Math.max(1, Math.min(termYears, 5)) - 1;
+        return termDiscountByYear[idx];
+    }
+
+    public double serviceLevelUplift(String serviceLevel) {
+        if ("priority".equalsIgnoreCase(serviceLevel)) return priorityUplift;
+        if ("dedicated".equalsIgnoreCase(serviceLevel)) return dedicatedUplift;
+        return 0.0;
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
new file mode 100644
index 0000000000..62d5baed9d
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
@@ -0,0 +1,125 @@
+package stirling.software.saas.procurement.pricing;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+/**
+ * The canonical enterprise pricing engine — the single server-side definition the quote builder,
+ * the order form, and the Stripe checkout all derive from. A faithful port of the marketing
+ * prototype's {@code quotePricing}:
+ *
+ * <pre>
+ *   annual        = volume x perPdfRate x serviceLevelMult x (indemnification ? 1.05 : 1)
+ *   annualNet     = round(annual x (1 - termDiscount)) + qbr
+ *   tcv           = annualNet x termYears + training
+ * </pre>
+ *
+ * The multi-year discount applies to usage + service level + indemnification, but NOT to the flat
+ * QBR fee (added after), and one-time training sits outside the recurring total. All money is in
+ * minor units (cents). Rates come from {@link PricingRates} (Stripe-backed in prod).
+ */
+@Service
+public class ProcurementPricingService {
+
+    /** Bespoke/committed deals don't price below this ACV; the builder floors against it. */
+    public static final long MIN_ACV_MINOR = 5_000_000L; // $50,000
+
+    /**
+     * Estimated annual PDF volume from seat count (~2,012.5 PDFs/user/yr = 5 docs/day x 230 working
+     * days x 1.75), used to prefill the builder's volume step. Rounded, matching the prototype's
+     * {@code users x 5 x 230 x 1.75}.
+     */
+    public long estimateAnnualVolume(int users) {
+        return Math.round(Math.max(0, users) * 5.0 * 230.0 * 1.75);
+    }
+
+    public QuoteBreakdown price(QuoteConfig cfg) {
+        return price(cfg, PricingRates.defaults());
+    }
+
+    public QuoteBreakdown price(QuoteConfig cfg, PricingRates rates) {
+        // Never trust the client's volume: clamp to non-negative so a tampered request can't drive
+        // a
+        // negative amount. The rate card and formula are server-side, so the browser can't lower
+        // the
+        // price — only pick a smaller, legitimate config. (See MIN_ACV_MINOR for the committed
+        // floor,
+        // a policy decision that is intentionally not force-applied here — see the review notes.)
+        long volume = Math.max(0, cfg.volume());
+        long perPdf = rates.perPdfMinor(volume);
+        long usage = Math.round(volume * (double) perPdf); // base, pre-service-level
+        double slaUplift = rates.serviceLevelUplift(cfg.serviceLevel());
+        long withSla = Math.round(usage * (1.0 + slaUplift));
+        long withIndemnity =
+                cfg.indemnification()
+                        ? Math.round(withSla * (1.0 + rates.indemnificationUplift()))
+                        : withSla;
+
+        double termDiscount = rates.termDiscount(cfg.termYears());
+        long discount = Math.round(withIndemnity * termDiscount);
+        long qbr = cfg.qbr() ? rates.qbrAnnualMinor() : 0L;
+        long training = cfg.training() ? rates.trainingOneTimeMinor() : 0L;
+
+        long annualNet = (withIndemnity - discount) + qbr;
+        long tcv = annualNet * cfg.termYears() + training;
+
+        List<QuoteLineItem> lines = new ArrayList<>();
+        lines.add(
+                new QuoteLineItem("usage", "PDF processing", QuoteLineItem.Kind.RECURRING, usage));
+        lines.add(
+                new QuoteLineItem(
+                        "seats",
+                        "Unlimited users + SSO / SCIM / RBAC",
+                        QuoteLineItem.Kind.INCLUDED,
+                        0L));
+        if (withSla != usage) {
+            lines.add(
+                    new QuoteLineItem(
+                            "service-level",
+                            serviceLevelLabel(cfg.serviceLevel()),
+                            QuoteLineItem.Kind.RECURRING,
+                            withSla - usage));
+        }
+        if (withIndemnity != withSla) {
+            lines.add(
+                    new QuoteLineItem(
+                            "indemnification",
+                            "IP indemnification",
+                            QuoteLineItem.Kind.RECURRING,
+                            withIndemnity - withSla));
+        }
+        if (qbr > 0) {
+            lines.add(
+                    new QuoteLineItem(
+                            "qbr",
+                            "Quarterly business reviews",
+                            QuoteLineItem.Kind.RECURRING,
+                            qbr));
+        }
+        if (discount > 0) {
+            lines.add(
+                    new QuoteLineItem(
+                            "multi-year",
+                            cfg.termYears() + "-year commitment",
+                            QuoteLineItem.Kind.DISCOUNT,
+                            -discount));
+        }
+        if (training > 0) {
+            lines.add(
+                    new QuoteLineItem(
+                            "training",
+                            "Onboarding & training",
+                            QuoteLineItem.Kind.ONE_TIME,
+                            training));
+        }
+        return new QuoteBreakdown(lines, annualNet, tcv, cfg.currency());
+    }
+
+    private static String serviceLevelLabel(String serviceLevel) {
+        if ("priority".equalsIgnoreCase(serviceLevel)) return "Priority service level";
+        if ("dedicated".equalsIgnoreCase(serviceLevel)) return "Dedicated service level";
+        return "Standard service level";
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteBreakdown.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteBreakdown.java
new file mode 100644
index 0000000000..10ffde5271
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteBreakdown.java
@@ -0,0 +1,12 @@
+package stirling.software.saas.procurement.pricing;
+
+import java.util.List;
+
+/**
+ * The priced result of a {@link QuoteConfig}: the itemised lines plus the two headline figures the
+ * order form and Stripe checkout are built from. {@code annualNetMinor} is the recurring annual fee
+ * after the multi-year discount; {@code tcvMinor} is total contract value across the term including
+ * one-time fees. Minor units (cents).
+ */
+public record QuoteBreakdown(
+        List<QuoteLineItem> lineItems, long annualNetMinor, long tcvMinor, String currency) {}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
new file mode 100644
index 0000000000..30917a73a6
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
@@ -0,0 +1,26 @@
+package stirling.software.saas.procurement.pricing;
+
+/**
+ * The buyer-configurable inputs to an enterprise quote. Mirrors the quote builder's four steps
+ * (volume, commitment &amp; service, add-ons) and is the sole input to {@link
+ * ProcurementPricingService}. Amounts are never carried here — the service derives them from these
+ * choices and the rate card.
+ */
+public record QuoteConfig(
+        long volume, // committed PDFs per year
+        int users, // seats (drives the volume auto-estimate when the buyer hasn't overridden)
+        String deployment, // cloud | selfhost | airgap (inherited from the trial; not priced)
+        int termYears, // 1..5
+        String serviceLevel, // standard | priority | dedicated
+        boolean indemnification,
+        boolean training,
+        boolean qbr,
+        String currency) { // USD | EUR | GBP
+
+    public QuoteConfig {
+        if (termYears < 1) termYears = 1;
+        if (termYears > 5) termYears = 5;
+        if (serviceLevel == null || serviceLevel.isBlank()) serviceLevel = "standard";
+        if (currency == null || currency.isBlank()) currency = "USD";
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteLineItem.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteLineItem.java
new file mode 100644
index 0000000000..a8b0d29352
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteLineItem.java
@@ -0,0 +1,16 @@
+package stirling.software.saas.procurement.pricing;
+
+/**
+ * One line on the itemised quote. {@code amountMinor} is in the currency's minor unit (cents);
+ * discounts are negative. {@code kind} drives how the portal groups it (recurring annual vs a
+ * one-time fee vs a discount line).
+ */
+public record QuoteLineItem(String key, String label, Kind kind, long amountMinor) {
+
+    public enum Kind {
+        RECURRING,
+        ONE_TIME,
+        DISCOUNT,
+        INCLUDED
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementDealRepository.java b/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementDealRepository.java
new file mode 100644
index 0000000000..14247ba1ba
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementDealRepository.java
@@ -0,0 +1,17 @@
+package stirling.software.saas.procurement.repository;
+
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import stirling.software.saas.procurement.model.ProcurementDeal;
+
+public interface ProcurementDealRepository extends JpaRepository<ProcurementDeal, Long> {
+
+    Optional<ProcurementDeal> findByTeamId(Long teamId);
+
+    boolean existsByTeamId(Long teamId);
+
+    /** Reset: drop the team's deal (quotes + activity cascade via FK). */
+    void deleteByTeamId(Long teamId);
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementQuoteRepository.java b/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementQuoteRepository.java
new file mode 100644
index 0000000000..45f7af8225
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/repository/ProcurementQuoteRepository.java
@@ -0,0 +1,12 @@
+package stirling.software.saas.procurement.repository;
+
+import java.util.List;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import stirling.software.saas.procurement.model.ProcurementQuote;
+
+public interface ProcurementQuoteRepository extends JpaRepository<ProcurementQuote, Long> {
+
+    List<ProcurementQuote> findByDealIdOrderByCreatedAtDesc(Long dealId);
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java b/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
new file mode 100644
index 0000000000..52e19f751e
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
@@ -0,0 +1,244 @@
+package stirling.software.saas.procurement.service;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Locale;
+import java.util.Optional;
+import java.util.UUID;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.saas.procurement.config.ProcurementConfigurationProperties;
+import stirling.software.saas.procurement.license.EnterpriseLicenseService;
+import stirling.software.saas.procurement.model.ProcurementDeal;
+import stirling.software.saas.procurement.model.ProcurementQuote;
+import stirling.software.saas.procurement.pricing.ProcurementPricingService;
+import stirling.software.saas.procurement.pricing.QuoteBreakdown;
+import stirling.software.saas.procurement.pricing.QuoteConfig;
+import stirling.software.saas.procurement.repository.ProcurementDealRepository;
+import stirling.software.saas.procurement.repository.ProcurementQuoteRepository;
+
+/**
+ * Orchestrates a linked team's procurement journey: start a (mock-licensed) trial, build a
+ * server-priced quote, and accept it. Stripe checkout itself lives in a Supabase edge function the
+ * portal calls with the accepted quote; on payment the webhook seeds {@code billing_subscriptions}
+ * and this service issues the annual licence. All amounts are minor units (cents).
+ */
+@Slf4j
+@Service
+@Profile("saas")
+public class ProcurementService {
+
+    // Local mapper for the line-items JSON snapshot; the saas context exposes no injectable
+    // ObjectMapper bean, and this (de)serialisation doesn't need Spring's configured one.
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+    private final ProcurementDealRepository dealRepo;
+    private final ProcurementQuoteRepository quoteRepo;
+    private final ProcurementPricingService pricing;
+    private final EnterpriseLicenseService licenses;
+    private final ProcurementConfigurationProperties config;
+
+    public ProcurementService(
+            ProcurementDealRepository dealRepo,
+            ProcurementQuoteRepository quoteRepo,
+            ProcurementPricingService pricing,
+            EnterpriseLicenseService licenses,
+            ProcurementConfigurationProperties config) {
+        this.dealRepo = dealRepo;
+        this.quoteRepo = quoteRepo;
+        this.pricing = pricing;
+        this.licenses = licenses;
+        this.config = config;
+    }
+
+    @Transactional(readOnly = true)
+    public Optional<ProcurementDeal> getDeal(Long teamId) {
+        return dealRepo.findByTeamId(teamId);
+    }
+
+    @Transactional(readOnly = true)
+    public List<ProcurementQuote> quotesForDeal(Long dealId) {
+        return quoteRepo.findByDealIdOrderByCreatedAtDesc(dealId);
+    }
+
+    /**
+     * Start (or restart) the free trial for a team: issue a mock trial licence and stamp the trial
+     * window on the deal. No Stripe: a no-card trial has no subscription; the entitlement is the
+     * Keygen licence, and the deal row is the journey state.
+     */
+    @Transactional
+    public ProcurementDeal startTrial(Long teamId) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId).orElseGet(() -> new ProcurementDeal(teamId));
+        LocalDateTime now = LocalDateTime.now();
+        LocalDateTime ends = now.plusDays(config.getTrialDurationDays());
+        deal.setStage(ProcurementDeal.STAGE_TRIAL);
+        deal.setTrialStartedAt(now);
+        deal.setTrialEndsAt(ends);
+        deal.setTrialExtensionsUsed(0);
+        deal.setLicenseRef(licenses.issueTrialLicense(teamId, ends));
+        deal = dealRepo.save(deal);
+        log.info(
+                "[procurement] trial started team={} deal={} ends={}",
+                teamId,
+                deal.getDealId(),
+                ends);
+        return deal;
+    }
+
+    /** Extend the current trial by the configured increment, up to the cap. */
+    @Transactional
+    public ProcurementDeal extendTrial(Long teamId) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId)
+                        .orElseThrow(() -> new IllegalStateException("No deal for team " + teamId));
+        // Only extend while still in the trial. Past the trial (e.g. active), licenseRef points at
+        // the committed annual licence — extending would rewind its expiry.
+        if (!ProcurementDeal.STAGE_TRIAL.equals(deal.getStage())) {
+            throw new IllegalStateException("Trial extension only allowed during the trial stage");
+        }
+        if (deal.getTrialExtensionsUsed() >= config.getMaxTrialExtensions()) {
+            throw new IllegalStateException("Trial extension cap reached");
+        }
+        LocalDateTime base =
+                deal.getTrialEndsAt() != null ? deal.getTrialEndsAt() : LocalDateTime.now();
+        LocalDateTime newEnd = base.plusDays(config.getTrialExtensionDays());
+        deal.setTrialEndsAt(newEnd);
+        deal.setTrialExtensionsUsed(deal.getTrialExtensionsUsed() + 1);
+        if (deal.getLicenseRef() != null) {
+            licenses.extendLicense(deal.getLicenseRef(), newEnd);
+        }
+        return dealRepo.save(deal);
+    }
+
+    /** Price a quote config server-side and persist it as a draft against the team's deal. */
+    @Transactional
+    public ProcurementQuote buildQuote(Long teamId, QuoteConfig cfg, String businessName) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId).orElseGet(() -> new ProcurementDeal(teamId));
+        if (ProcurementDeal.STAGE_LIVE.equals(deal.getStage())) {
+            throw new IllegalStateException("Cannot rebuild a quote on a live deal");
+        }
+        // (Re)building a quote returns the deal to the quote stage and drops any prior acceptance,
+        // so a rebuild from security/payment can't leave a stale stage or accepted-quote pointer.
+        deal.setStage(ProcurementDeal.STAGE_QUOTE);
+        deal.setAcceptedQuoteId(null);
+        deal = dealRepo.save(deal);
+
+        QuoteBreakdown breakdown = pricing.price(cfg);
+
+        ProcurementQuote quote = new ProcurementQuote();
+        quote.setDealId(deal.getDealId());
+        quote.setQuoteNumber(nextQuoteNumber(deal.getDealId()));
+        // Priced but not yet issued: the edge fn creates the Stripe Quote and flips this to SENT.
+        quote.setStatus(ProcurementQuote.STATUS_DRAFT);
+        quote.setCurrency(cfg.currency());
+        quote.setVolume(cfg.volume());
+        quote.setSeats(cfg.users() > 0 ? cfg.users() : null);
+        quote.setDeployment(cfg.deployment());
+        quote.setTermYears(cfg.termYears());
+        quote.setServiceLevel(cfg.serviceLevel());
+        quote.setIndemnification(cfg.indemnification());
+        quote.setTraining(cfg.training());
+        quote.setQbr(cfg.qbr());
+        quote.setBusinessName(businessName);
+        quote.setAnnualNetMinor(breakdown.annualNetMinor());
+        quote.setTcvMinor(breakdown.tcvMinor());
+        quote.setLineItemsJson(writeLineItems(breakdown));
+        quote.setValidUntil(LocalDate.now().plusDays(30));
+        quote = quoteRepo.save(quote);
+        log.info(
+                "[procurement] quote built team={} quote={} annualNet={} tcv={}",
+                teamId,
+                quote.getQuoteNumber(),
+                quote.getAnnualNetMinor(),
+                quote.getTcvMinor());
+        return quote;
+    }
+
+    /**
+     * Advance the deal to the agreement (security) stage: the buyer has an issued quote and is
+     * reviewing the enterprise agreement before it's accepted into a subscription. Requires an
+     * issued quote on the deal.
+     */
+    @Transactional
+    public ProcurementDeal startAgreement(Long teamId) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId)
+                        .orElseThrow(() -> new IllegalStateException("No deal for team " + teamId));
+        boolean hasIssuedQuote =
+                quoteRepo.findByDealIdOrderByCreatedAtDesc(deal.getDealId()).stream()
+                        .anyMatch(q -> ProcurementQuote.STATUS_SENT.equals(q.getStatus()));
+        if (!hasIssuedQuote) {
+            throw new IllegalStateException("No issued quote for team " + teamId);
+        }
+        deal.setStage(ProcurementDeal.STAGE_AGREEMENT);
+        deal = dealRepo.save(deal);
+        log.info("[procurement] agreement stage team={} deal={}", teamId, deal.getDealId());
+        return deal;
+    }
+
+    /**
+     * Mark the deal live: issue the annual licence and advance to the active stage. In production
+     * this is driven by the {@code invoice.paid} webhook once the first invoice is settled; this
+     * method is the demo/manual stand-in until that webhook lands.
+     */
+    @Transactional
+    public ProcurementDeal markLive(Long teamId) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId)
+                        .orElseThrow(() -> new IllegalStateException("No deal for team " + teamId));
+        int term = 1;
+        String deployment = "cloud";
+        if (deal.getAcceptedQuoteId() != null) {
+            ProcurementQuote q = quoteRepo.findById(deal.getAcceptedQuoteId()).orElse(null);
+            if (q != null) {
+                term = Math.max(1, q.getTermYears());
+                if (q.getDeployment() != null && !q.getDeployment().isBlank()) {
+                    deployment = q.getDeployment();
+                }
+            }
+        }
+        deal.setLicenseRef(
+                licenses.issueAnnualLicense(
+                        teamId, deployment, LocalDateTime.now().plusYears(term)));
+        deal.setStage(ProcurementDeal.STAGE_LIVE);
+        deal = dealRepo.save(deal);
+        log.info("[procurement] deal live team={} deal={}", teamId, deal.getDealId());
+        return deal;
+    }
+
+    /**
+     * Reset a team's procurement: delete the deal (quotes + activity cascade). For
+     * re-demos/testing.
+     */
+    @Transactional
+    public void resetDeal(Long teamId) {
+        dealRepo.deleteByTeamId(teamId);
+        log.info("[procurement] deal reset team={}", teamId);
+    }
+
+    private String nextQuoteNumber(Long dealId) {
+        int seq = quoteRepo.findByDealIdOrderByCreatedAtDesc(dealId).size() + 1;
+        String token = UUID.randomUUID().toString().substring(0, 4).toUpperCase(Locale.ROOT);
+        return String.format(Locale.ROOT, "QT-%s-%04d", token, seq);
+    }
+
+    private String writeLineItems(QuoteBreakdown breakdown) {
+        try {
+            return OBJECT_MAPPER.writeValueAsString(breakdown.lineItems());
+        } catch (JsonProcessingException e) {
+            log.warn("[procurement] failed to serialise line items", e);
+            return "[]";
+        }
+    }
+}
diff --git a/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql b/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
new file mode 100644
index 0000000000..0048f999c1
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
@@ -0,0 +1,72 @@
+-- Enterprise procurement: the tables that track a linked team's journey from trial to live.
+--
+-- One deal per team (the commercial journey: trial -> quote -> agreement -> payment -> live), the
+-- quotes built against it (the itemised, priced offers), and an append-only activity log for the
+-- money/licence-touching actions. The resulting subscription is mirrored in billing_subscriptions
+-- (seeded on trial start / payment); the entitlement that unlocks the product is a Keygen licence
+-- referenced by procurement_deal.license_ref. Prices are computed server-side (ProcurementPricingService).
+--
+-- Additive and idempotent (IF NOT EXISTS) — safe on the shared dev branch.
+
+CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_deal (
+    deal_id               BIGSERIAL    PRIMARY KEY,
+    team_id               BIGINT       NOT NULL UNIQUE REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
+    -- one active deal per team; the journey lives on this row.
+    stage                 VARCHAR(32)  NOT NULL DEFAULT 'trial',
+    -- trial | quote | security (agreement) | procurement (payment) | active (live)
+    trial_started_at      TIMESTAMP,
+    trial_ends_at         TIMESTAMP,
+    trial_extensions_used INT          NOT NULL DEFAULT 0,
+    license_ref           VARCHAR(128),
+    -- Keygen licence id issued for this deal (trial or annual). Mocked until Keygen mgmt lands.
+    subscription_id       VARCHAR(255),
+    -- Stripe subscription id, mirrored into billing_subscriptions once commercial.
+    accepted_quote_id     BIGINT,
+    created_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version               BIGINT       NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_quote (
+    quote_id            BIGSERIAL    PRIMARY KEY,
+    deal_id             BIGINT       NOT NULL REFERENCES stirling_pdf.procurement_deal(deal_id) ON DELETE CASCADE,
+    quote_number        VARCHAR(64)  NOT NULL,
+    status              VARCHAR(24)  NOT NULL DEFAULT 'draft',
+    -- draft | sent | accepted | expired
+    currency            VARCHAR(8)   NOT NULL DEFAULT 'USD',
+    volume              BIGINT       NOT NULL,
+    seats               INT,
+    deployment          VARCHAR(24),
+    term_years          INT          NOT NULL,
+    service_level       VARCHAR(24)  NOT NULL,
+    indemnification     BOOLEAN      NOT NULL DEFAULT FALSE,
+    training            BOOLEAN      NOT NULL DEFAULT FALSE,
+    qbr                 BOOLEAN      NOT NULL DEFAULT FALSE,
+    annual_net_minor    BIGINT       NOT NULL,
+    -- recurring annual fee after the multi-year discount, in minor units (cents).
+    tcv_minor           BIGINT       NOT NULL,
+    -- total contract value across the term incl. one-time fees, minor units.
+    line_items          TEXT,
+    -- JSON snapshot of the itemised lines the order form renders.
+    stripe_price_id     VARCHAR(128),
+    checkout_session_id VARCHAR(255),
+    checkout_url        TEXT,
+    valid_until         DATE,
+    created_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version             BIGINT       NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_activity (
+    activity_id   BIGSERIAL    PRIMARY KEY,
+    deal_id       BIGINT       NOT NULL REFERENCES stirling_pdf.procurement_deal(deal_id) ON DELETE CASCADE,
+    actor_user_id BIGINT,
+    -- the internal/portal user who took the action; informational (no FK).
+    action        VARCHAR(48)  NOT NULL,
+    -- trial_started | trial_extended | quote_built | quote_accepted | checkout_created | went_live ...
+    detail        TEXT,
+    created_at    TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_procurement_quote_deal ON stirling_pdf.procurement_quote (deal_id);
+CREATE INDEX IF NOT EXISTS idx_procurement_activity_deal ON stirling_pdf.procurement_activity (deal_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql b/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
new file mode 100644
index 0000000000..5d83ee35f8
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
@@ -0,0 +1,8 @@
+-- Stripe Quote support: a procurement quote is issued as a real Stripe Quote (finalized → PDF +
+-- shareable), and on acceptance Stripe creates the committed subscription + first invoice. The
+-- Stripe operations live in Supabase edge functions; these columns hold the references they write
+-- back. Twin of Supabase migration 20260703000000_procurement_stripe_quote.sql.
+
+ALTER TABLE stirling_pdf.procurement_quote
+    ADD COLUMN IF NOT EXISTS stripe_quote_id    VARCHAR(128),
+    ADD COLUMN IF NOT EXISTS stripe_invoice_url TEXT;
diff --git a/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql b/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
new file mode 100644
index 0000000000..ba9c74dde8
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
@@ -0,0 +1,5 @@
+-- Persist the buyer's company name on the quote so re-editing remembers it and it can be shown on
+-- the quote/agreement. Twin of Supabase migration 20260705000000_procurement_business_name.sql.
+
+ALTER TABLE stirling_pdf.procurement_quote
+    ADD COLUMN IF NOT EXISTS business_name VARCHAR(255);
diff --git a/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java b/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
new file mode 100644
index 0000000000..1f903a1ee2
--- /dev/null
+++ b/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
@@ -0,0 +1,87 @@
+package stirling.software.saas.procurement.pricing;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.saas.procurement.pricing.QuoteLineItem.Kind;
+
+/**
+ * Locks the pricing engine to the numbers the marketing prototype encodes — most importantly the
+ * canonical quote QT-AC9F-0001 (1M PDFs, priority, 3-year) = $41,400/yr, $124,200 TCV.
+ */
+class ProcurementPricingServiceTest {
+
+    private final ProcurementPricingService pricing = new ProcurementPricingService();
+
+    private static QuoteConfig cfg(long volume, String sla, int term) {
+        return new QuoteConfig(volume, 0, "cloud", term, sla, false, false, false, "USD");
+    }
+
+    @Test
+    void canonicalQuoteMatchesPrototype() {
+        QuoteBreakdown q = pricing.price(cfg(1_000_000, "priority", 3));
+
+        assertThat(q.annualNetMinor()).isEqualTo(4_140_000L); // $41,400
+        assertThat(q.tcvMinor()).isEqualTo(12_420_000L); // $124,200
+        assertThat(lineAmount(q, "usage")).isEqualTo(4_000_000L); // $40,000 @ $0.04
+        assertThat(lineAmount(q, "service-level")).isEqualTo(600_000L); // +15%
+        assertThat(lineAmount(q, "multi-year")).isEqualTo(-460_000L); // -10%
+    }
+
+    @Test
+    void volumeBandsPickTheRightPerPdfRate() {
+        assertThat(lineAmount(pricing.price(cfg(500_000, "standard", 1)), "usage"))
+                .isEqualTo(2_500_000L); // 500k @ $0.05
+        assertThat(lineAmount(pricing.price(cfg(1_000_000, "standard", 1)), "usage"))
+                .isEqualTo(4_000_000L); // 1M @ $0.04
+        assertThat(lineAmount(pricing.price(cfg(5_000_000, "standard", 1)), "usage"))
+                .isEqualTo(15_000_000L); // 5M @ $0.03
+    }
+
+    @Test
+    void addOnsAndTermStack() {
+        QuoteConfig c =
+                new QuoteConfig(1_000_000, 0, "cloud", 5, "dedicated", true, true, true, "USD");
+        QuoteBreakdown q = pricing.price(c);
+
+        long usage = 4_000_000L;
+        long withSla = Math.round(usage * 1.30); // 5,200,000
+        long withIndemnity = Math.round(withSla * 1.05); // 5,460,000
+        long discount = Math.round(withIndemnity * 0.15); // 819,000
+        long qbr = 800_000L;
+        long expectedAnnual = (withIndemnity - discount) + qbr;
+        long expectedTcv = expectedAnnual * 5 + 750_000L; // + training one-time
+
+        assertThat(q.annualNetMinor()).isEqualTo(expectedAnnual);
+        assertThat(q.tcvMinor()).isEqualTo(expectedTcv);
+        assertThat(q.lineItems())
+                .anyMatch(l -> l.key().equals("training") && l.kind() == Kind.ONE_TIME);
+        assertThat(q.lineItems()).anyMatch(l -> l.key().equals("qbr"));
+        assertThat(q.lineItems()).anyMatch(l -> l.key().equals("indemnification"));
+    }
+
+    @Test
+    void standardSingleYearHasNoUpliftOrDiscountLines() {
+        QuoteBreakdown q = pricing.price(cfg(1_000_000, "standard", 1));
+        assertThat(q.annualNetMinor()).isEqualTo(4_000_000L);
+        assertThat(q.tcvMinor()).isEqualTo(4_000_000L);
+        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("service-level"));
+        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("multi-year"));
+    }
+
+    @Test
+    void volumeEstimateFromSeats() {
+        // ~2,013 PDFs/user/yr
+        assertThat(pricing.estimateAnnualVolume(100)).isEqualTo(201_250L);
+        assertThat(pricing.estimateAnnualVolume(0)).isZero();
+    }
+
+    private static long lineAmount(QuoteBreakdown q, String key) {
+        return q.lineItems().stream()
+                .filter(l -> l.key().equals(key))
+                .mapToLong(QuoteLineItem::amountMinor)
+                .findFirst()
+                .orElseThrow();
+    }
+}
diff --git a/frontend/.gitignore b/frontend/.gitignore
index e07dce196a..0605e6e79f 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -11,6 +11,7 @@
 # production
 /build
 /dist
+/dist-portal
 /storybook-static
 
 /editor/build
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index d086613f44..dd8e379a8a 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -2,7 +2,7 @@
 // the decorators below transpiles to React.createElement and needs React in
 // scope. (The app + story files use the automatic runtime via the portal vite
 // config; this import is specifically for the preview config file.)
-import React, { useEffect } from "react";
+import React, { Suspense, useEffect } from "react";
 import type { Decorator, Preview } from "@storybook/react-vite";
 import { initialize, mswLoader } from "msw-storybook-addon";
 import { MemoryRouter } from "react-router-dom";
@@ -109,7 +109,9 @@ const withProviders: Decorator = (Story, context) => {
             <TierKey tier={tier}>
               <UIProvider>
                 <ThemeWatcher />
-                <Story />
+                <Suspense fallback={null}>
+                  <Story />
+                </Suspense>
               </UIProvider>
             </TierKey>
           </LinkProvider>
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 346ece1523..241289d1db 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7430,7 +7430,7 @@ upgrade = "Upgrade"
 volumeSuffix = "PDFs processed · last 30 days"
 
 [portal.procurement]
-enterpriseBadge = "Enterprise"
+reset = "Reset procurement (demo)"
 subtitle = "Get your team evaluated, contracted, and onboarded. Every document in one place."
 title = "Procurement"
 
@@ -7441,6 +7441,63 @@ request = "Request"
 sign = "Review & sign"
 upload = "Upload"
 
+[portal.procurement.agreement]
+agreeCta = "Agree & subscribe"
+confirm = "I have read and agree to the Stirling Enterprise Agreement."
+eyebrow = "Agreement"
+intro = "One combined agreement covers your deal: Master Service Agreement, Order Form, EULA, and Data Processing Agreement. Review it, then agree to accept the quote into a committed subscription."
+title = "Review your enterprise agreement"
+
+[portal.procurement.builder]
+addons = "Add-ons"
+back = "Back"
+businessName = "Business name"
+businessNamePlaceholder = "Your company"
+continue = "Continue"
+country = "Country"
+countryEuro = "Eurozone (EUR €)"
+countryUK = "United Kingdom (GBP £)"
+countryUS = "United States (USD $)"
+eula = "I have read and agree to the Stirling Enterprise EULA. It governs the agreement generated from this quote."
+generate = "Generate quote"
+included = "Included"
+indemnification = "IP indemnification"
+indemnificationSub = "We defend qualifying IP claims, per the EULA"
+qbr = "Quarterly business reviews"
+qbrSub = "Your SE reviews usage and roadmap each quarter"
+running = "{{annual}} / yr · {{years}}-yr {{tcv}}"
+s1Sub = "Your team, and the PDFs you expect to run each year."
+# Step 1 — volume
+s1Title = "How much will you process?"
+s2Sub = "Longer terms discount the rate; your service level sets support."
+# Step 2 — commitment & service
+s2Title = "Commitment and service"
+s3Sub = "For the quote and the agreement it generates."
+# Step 3 — details
+s3Title = "Your details"
+serviceLevel = "Service level"
+slDedicated = "Dedicated"
+slDedicatedSub = "4 business hours · dedicated account manager · +30%"
+slPriority = "Priority"
+slPrioritySub = "Same business day · named CSM · +15%"
+slStandard = "Standard"
+slStandardSub = "Next business day · shared CSM · included"
+stepOf = "Step {{n}} of {{total}}"
+term = "Term"
+termDiscount = "{{pct}}% multi-year commitment discount applied"
+title = "Build your quote"
+training = "Onboarding & training"
+trainingSub = "Live sessions to get your team running"
+users = "Total users"
+usersPlaceholder = "e.g. 250"
+volEstimated = "Estimated from {{count}} users (~2,000 PDFs each, including automation). Edit if you know better."
+volManual = "Using your figure. Re-estimate from your team size any time."
+volNoUsers = "Not sure? Enter your team size and we'll estimate it."
+volume = "Annual PDF volume"
+volumePlaceholder = "e.g. 1,000,000"
+years_one = "{{count}} year"
+years_other = "{{count}} years"
+
 [portal.procurement.docs]
 count_one = "{{count}} doc"
 count_other = "{{count}} docs"
@@ -7456,6 +7513,30 @@ supportingTitle = "Supporting your evaluation"
 title = "Documents"
 upcoming = "Upcoming"
 
+[portal.procurement.error]
+title = "Something went wrong"
+
+[portal.procurement.hero]
+company = "Your enterprise deal"
+ctaAgreement = "Review & sign agreement"
+ctaLive = "You're live"
+ctaPayment = "Add payment"
+ctaQuote = "Review your quote"
+ctaTrial = "Build your quote"
+eyebrow = "Enterprise procurement"
+inviteTeammates = "Invite teammates"
+keyDocs = "Key documents"
+nextStep = "Next step: {{action}}"
+notStarted = "Not started"
+open = "Open procurement"
+scheduleCall = "Schedule a call"
+setup1Sub = "Invite your teammates"
+setup1Title = "Deploy the PDF Editor"
+setup2Sub = "Turn on processing across editors and other sources"
+setup2Title = "Connect the PDF Processor"
+setup3Sub = "Turn on Security, Compliance, Routing, or Retention when you need them"
+setup3Title = "Add recommended policies"
+
 [portal.procurement.journey]
 daysLeft_one = "{{count}} day left"
 daysLeft_other = "{{count}} days left"
@@ -7467,15 +7548,39 @@ subtitle = "Your solutions engineer is on every step. One next action at a time;
 title = "From trial to live, one guided path"
 trialTitle = "Enterprise trial"
 
+[portal.procurement.link]
+cta = "Link account"
+description = "Procurement runs on your linked Stirling account: it's how we provision the trial, price your quote, and start billing. Link an account to start."
+eyebrow = "Enterprise"
+title = "Link your account to begin"
+
+[portal.procurement.live]
+description = "Your subscription is active and your licence is issued. Your team is provisioned and billing has started."
+eyebrow = "Live"
+title = "You're live on Stirling Enterprise"
+
 [portal.procurement.locked]
 description = "Trial keys, committed-volume quotes, the one-signature agreement, payment, and your document ledger all live here once you start an enterprise evaluation."
 eyebrow = "Enterprise only"
 talkToSales = "Talk to sales"
 title = "The procurement track opens with Enterprise"
 
+[portal.procurement.milestone]
+accept = "Accept & continue"
+description = "Download the PDF to share it with your team, come back to accept when you're ready, or make changes."
+download = "Download PDF"
+downloadError = "Could not download the quote PDF just yet — please try again in a moment."
+edit = "Edit quote"
+eyebrow = "Quote {{number}}"
+perYear = " / yr"
+preparedFor = "Prepared for {{company}}"
+tcv = "{{value}} total contract value"
+title = "Your quote is ready"
+
 [portal.procurement.modal]
 cancel = "Cancel"
 chooseFile = "Choose file"
+close = "Close"
 downloadBody = "Your download will begin shortly."
 downloadCta = "Download"
 downloadTitle = "Download"
@@ -7494,6 +7599,13 @@ uploadBody = "Send us your PO and we invoice against it on your terms. Drag in t
 uploadCta = "Upload purchase order"
 uploadTitle = "Upload your purchase order"
 
+[portal.procurement.payment]
+description = "Your quote is accepted and a committed annual subscription has been created. Pay the first invoice to go live — you can pay or download it right here, no email needed."
+downloadInvoice = "Download invoice"
+simulate = "Simulate payment received (demo)"
+title = "Subscription created"
+viewInvoice = "View & pay invoice"
+
 [portal.procurement.status]
 action = "Action needed"
 available = "Available"
@@ -7501,6 +7613,21 @@ complete = "Complete"
 pending = "Pending"
 request = "On request"
 
+[portal.procurement.trial]
+body = "Extending adds 7 days and notifies your solutions engineer."
+bodyMaxed = "You have used all your extensions — talk to your solutions engineer if you need more time."
+cancel = "Cancel trial"
+extend = "Extend 7 days"
+maxed = "Maxed out"
+subtitle = "Your free trial runs through {{date}}. No card required."
+title = "Enterprise trial"
+
+[portal.procurement.upsell]
+homeBadge = "Enterprise"
+homeBody = "Committed volume pricing, org-wide SSO + SCIM + RBAC, 90-day immutable audit, and a dedicated SE."
+homeCta = "Start Trial →"
+homeHeadline = "Process millions of PDFs."
+
 [portal.recentActivity]
 title = "Recent activity"
 viewAll = "View all"
diff --git a/frontend/editor/src/portal/api/procurement.ts b/frontend/editor/src/portal/api/procurement.ts
index 3a2b9fe0f2..9327179c03 100644
--- a/frontend/editor/src/portal/api/procurement.ts
+++ b/frontend/editor/src/portal/api/procurement.ts
@@ -1,4 +1,5 @@
 import { apiClient } from "@portal/api/http";
+import { getSupabaseClient } from "@app/auth/supabase/supabaseClient";
 import type { Tier } from "@portal/contexts/TierContext";
 import type {
   DealStage,
@@ -92,3 +93,165 @@ export async function requestDocument(
     { method: "POST", body: { action } },
   );
 }
+
+// ============================================================================
+// Enterprise procurement — real SaaS backend (/api/v1/procurement).
+//
+// The journey/ledger visuals above still ride the MSW mock; the commercial spine
+// below (trial, server-priced quote, accept -> Stripe checkout) is the real thing,
+// served by the saas Java backend and gated on a linked account.
+// ============================================================================
+
+export type QuoteLineItemKind =
+  | "RECURRING"
+  | "ONE_TIME"
+  | "DISCOUNT"
+  | "INCLUDED";
+
+export interface QuoteLineItem {
+  key: string;
+  label: string;
+  kind: QuoteLineItemKind;
+  amountMinor: number;
+}
+
+export interface QuoteResult {
+  quoteId: number;
+  quoteNumber: string;
+  /** draft (priced, editable) | sent (issued Stripe quote — PDF + shareable) | accepted | expired. */
+  status: string;
+  currency: string;
+  annualNetMinor: number;
+  tcvMinor: number;
+  lineItems: QuoteLineItem[];
+  validUntil: string | null;
+  /** The Stripe Quote id once issued; null while still a local draft. */
+  stripeQuoteId: string | null;
+  /** Hosted Stripe invoice URL, present once the quote is accepted and the subscription invoice exists. */
+  invoiceUrl: string | null;
+  /** The inputs this quote was priced from, so the builder can seed itself on re-edit. */
+  config: QuoteConfigInput;
+}
+
+/** Outcome of accepting an issued quote: Stripe creates the subscription + first invoice. */
+export interface AcceptResult {
+  status: string;
+  subscriptionId: string | null;
+  invoiceUrl: string | null;
+  invoicePdf: string | null;
+}
+
+/** One shape for every state; an unstarted procurement has {@link ProcurementSnapshot.dealId} null. */
+export interface ProcurementSnapshot {
+  dealId: number | null;
+  stage: DealStage | null;
+  trialStartedAt: string | null;
+  trialEndsAt: string | null;
+  trialExtensionsUsed: number;
+  licensed: boolean;
+  latestQuote: QuoteResult | null;
+}
+
+export interface QuoteConfigInput {
+  volume: number;
+  users: number;
+  deployment: string;
+  termYears: number;
+  serviceLevel: string;
+  indemnification: boolean;
+  training: boolean;
+  qbr: boolean;
+  currency: string;
+  /** Buyer's company name — shown on the quote/agreement and remembered when re-editing. */
+  businessName: string;
+}
+
+export function fetchSnapshot(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>("/api/v1/procurement");
+}
+
+export function startTrial(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>(
+    "/api/v1/procurement/trial/start",
+    { method: "POST" },
+  );
+}
+
+export function extendTrial(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>(
+    "/api/v1/procurement/trial/extend",
+    { method: "POST" },
+  );
+}
+
+/** Advance an issued quote to the agreement (security) stage for review + agree. */
+export function startAgreement(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>(
+    "/api/v1/procurement/agreement",
+    { method: "POST" },
+  );
+}
+
+/** Price a config server-side and persist it as a local DRAFT (no Stripe object yet). */
+export function buildQuote(cfg: QuoteConfigInput): Promise<QuoteResult> {
+  return apiClient.saas.json<QuoteResult>("/api/v1/procurement/quote", {
+    method: "POST",
+    body: cfg,
+  });
+}
+
+// ---- Stripe Quote operations (Supabase edge functions) ---------------------
+// Java has no Stripe SDK, so issuing/accepting the quote and fetching its PDF run in edge functions
+// that own Stripe; they persist results back through SECURITY DEFINER RPCs. The portal invokes them
+// directly (same pattern the PAYG checkout uses).
+
+async function invokeEdge<T>(fn: string, quoteId: number): Promise<T> {
+  const supabase = getSupabaseClient();
+  if (!supabase) throw new Error("No SaaS session");
+  const { data, error } = await supabase.functions.invoke<T>(fn, {
+    body: { quote_id: quoteId },
+  });
+  if (error) throw error;
+  if (data == null) throw new Error(`${fn} returned no data`);
+  return data;
+}
+
+/** Turn a draft into an issued Stripe Quote (finalized → gets a number + PDF, shareable). */
+export function issueQuote(quoteId: number): Promise<QuoteResult> {
+  return invokeEdge<QuoteResult>("issue-procurement-quote", quoteId);
+}
+
+/** Accept an issued quote → Stripe creates the committed subscription + first invoice. */
+export function acceptQuote(quoteId: number): Promise<AcceptResult> {
+  return invokeEdge<AcceptResult>("accept-procurement-quote", quoteId);
+}
+
+/** Fetch the Stripe-generated quote PDF as a blob (for download / share). */
+export async function fetchQuotePdf(quoteId: number): Promise<Blob> {
+  const supabase = getSupabaseClient();
+  if (!supabase) throw new Error("No SaaS session");
+  const { data, error } = await supabase.functions.invoke<Blob>(
+    "get-procurement-quote-pdf",
+    { body: { quote_id: quoteId } },
+  );
+  if (error) throw error;
+  if (!data) throw new Error("No PDF returned");
+  return data;
+}
+
+/**
+ * Demo/manual stand-in for the invoice.paid webhook: mark the deal live (issue licence, go active).
+ */
+export function goLive(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>(
+    "/api/v1/procurement/go-live",
+    { method: "POST" },
+  );
+}
+
+/** Reset the team's procurement (delete the deal) and get the fresh empty snapshot. */
+export function resetProcurement(): Promise<ProcurementSnapshot> {
+  return apiClient.saas.json<ProcurementSnapshot>("/api/v1/procurement/reset", {
+    method: "POST",
+  });
+}
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index d9ced4ae65..0deb3c0dda 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -22,7 +22,6 @@ import {
   UsageIcon,
   LinkIcon,
   DocsIcon,
-  ProcurementIcon,
   SettingsIcon,
   ChevronDownIcon,
 } from "@portal/components/icons";
@@ -136,15 +135,10 @@ export function Sidebar() {
   const { activeView, setActiveView } = useView();
   const { theme } = useTheme();
   const { openSettings } = useUI();
-  const { tier } = useTier();
   const { t } = useTranslation();
 
-  // Procurement is the enterprise buyer's commercial journey — surfaced only to
-  // enterprise tenants (it has no free/pro equivalent).
-  const platformGroup: NavEntry[] =
-    tier === "enterprise"
-      ? [{ id: "procurement", icon: <ProcurementIcon /> }, ...GROUP_PLATFORM]
-      : GROUP_PLATFORM;
+  // Procurement is no longer a nav tab — it lives on Home as the deal-status hero and expands into
+  // a takeover modal (matching the marketing prototype).
 
   function renderGroup(entries: NavEntry[]) {
     return entries.map((entry) => (
@@ -227,7 +221,7 @@ export function Sidebar() {
         </div>
         <div className="portal-sidebar__divider" aria-hidden />
         <div className="portal-sidebar__group">
-          {renderGroup(platformGroup)}
+          {renderGroup(GROUP_PLATFORM)}
         </div>
       </nav>
 
diff --git a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
index b303c530ff..6525e66970 100644
--- a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
+++ b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
@@ -1,5 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { Button, Card } from "@app/ui";
+import { useView } from "@portal/contexts/ViewContext";
 
 interface Props {
   /** Render without the Card wrapper, to embed inside another card's column. */
@@ -8,10 +9,12 @@ interface Props {
 
 /**
  * Volume-discount / Enterprise upsell, shared by the free and subscribed billing
- * views. The CTA is intentionally inert until the sales/quote URL is confirmed.
+ * views. The CTA opens the procurement journey (/procurement auto-opens the quote
+ * builder in the takeover modal).
  */
 export function EnterpriseUpsell({ bare = false }: Props) {
   const { t } = useTranslation();
+  const { setActiveView } = useView();
   const body = (
     <>
       <span className="portal-billing__eyebrow">
@@ -32,8 +35,11 @@ export function EnterpriseUpsell({ bare = false }: Props) {
             )}
           </p>
         </div>
-        {/* Destination wired when the enterprise/sales URL is confirmed. */}
-        <Button variant="gradient" size="sm" disabled>
+        <Button
+          variant="gradient"
+          size="sm"
+          onClick={() => setActiveView("procurement")}
+        >
           {t(
             "portal.billing.enterpriseUpsell.cta",
             "Build your Enterprise quote",
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
new file mode 100644
index 0000000000..dc4d7cb368
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DealStatusHero } from "@portal/components/procurement/DealStatusHero";
+import type { ProcurementSnapshot } from "@portal/api/procurement";
+
+const base: ProcurementSnapshot = {
+  dealId: 1,
+  stage: "trial",
+  trialStartedAt: "2026-06-25T00:00:00Z",
+  trialEndsAt: "2026-07-09T00:00:00Z",
+  trialExtensionsUsed: 0,
+  licensed: false,
+  latestQuote: null,
+};
+
+/** The Home deal-status hero across the commercial stages; the CTA expands the takeover modal. */
+const meta: Meta<typeof DealStatusHero> = {
+  title: "Portal/Procurement/DealStatusHero",
+  component: DealStatusHero,
+  parameters: { layout: "padded" },
+  args: {
+    onExpand: () => {},
+    onKeyDocs: () => {},
+    onInvite: () => {},
+    onSchedule: () => {},
+    onManageTrial: () => {},
+    onNavigate: () => {},
+  },
+};
+export default meta;
+
+type Story = StoryObj<typeof DealStatusHero>;
+
+export const Trial: Story = { args: { snapshot: base } };
+export const Quote: Story = {
+  args: { snapshot: { ...base, stage: "quote", trialEndsAt: null } },
+};
+export const Agreement: Story = {
+  args: { snapshot: { ...base, stage: "security", trialEndsAt: null } },
+};
+export const Payment: Story = {
+  args: { snapshot: { ...base, stage: "procurement", trialEndsAt: null } },
+};
+export const Live: Story = {
+  args: {
+    snapshot: { ...base, stage: "active", licensed: true, trialEndsAt: null },
+  },
+};
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
new file mode 100644
index 0000000000..296ccc1a52
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
@@ -0,0 +1,162 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import type { ViewId } from "@portal/contexts/ViewContext";
+import { JOURNEY, type ProcurementSnapshot } from "@portal/api/procurement";
+import { StageStepper } from "@portal/components/procurement/StageStepper";
+import "@portal/views/Procurement.css";
+
+/**
+ * The enterprise deal-status hero on Home (procurement lives here, not as a nav tab). Adapts to the
+ * deal stage: quick-action chips (trial countdown → manage, key documents, invite teammates,
+ * schedule a call), a rollout checklist during the trial, and a stage-specific primary CTA that
+ * expands the flow into the takeover modal. Matches the marketing prototype.
+ */
+export function DealStatusHero({
+  snapshot,
+  busy = false,
+  onExpand,
+  onKeyDocs,
+  onInvite,
+  onSchedule,
+  onManageTrial,
+  onNavigate,
+}: {
+  snapshot: ProcurementSnapshot;
+  busy?: boolean;
+  onExpand: () => void;
+  onKeyDocs: () => void;
+  onInvite: () => void;
+  onSchedule: () => void;
+  onManageTrial: () => void;
+  onNavigate: (view: ViewId) => void;
+}) {
+  const { t } = useTranslation();
+  const stage = snapshot.stage ?? "trial";
+  const inTrial = stage === "trial";
+  const cta =
+    stage === "trial"
+      ? t("portal.procurement.hero.ctaTrial")
+      : stage === "quote"
+        ? t("portal.procurement.hero.ctaQuote")
+        : stage === "security"
+          ? t("portal.procurement.hero.ctaAgreement")
+          : stage === "procurement"
+            ? t("portal.procurement.hero.ctaPayment")
+            : t("portal.procurement.hero.ctaLive");
+
+  const setupSteps: { title: string; sub: string; view: ViewId }[] = [
+    {
+      title: t("portal.procurement.hero.setup1Title"),
+      sub: t("portal.procurement.hero.setup1Sub"),
+      view: "users",
+    },
+    {
+      title: t("portal.procurement.hero.setup2Title"),
+      sub: t("portal.procurement.hero.setup2Sub"),
+      view: "sources",
+    },
+    {
+      title: t("portal.procurement.hero.setup3Title"),
+      sub: t("portal.procurement.hero.setup3Sub"),
+      view: "policies",
+    },
+  ];
+
+  return (
+    <div className="portal-hero">
+      <div className="portal-hero__top">
+        <div>
+          <span className="portal-hero__eyebrow">
+            {t("portal.procurement.hero.eyebrow")}
+          </span>
+          <span className="portal-hero__company">
+            {t("portal.procurement.hero.company")}
+          </span>
+        </div>
+        <div className="portal-hero__chips">
+          {inTrial && snapshot.trialEndsAt && (
+            <button
+              type="button"
+              className="portal-hero__chip portal-hero__chip--action"
+              onClick={onManageTrial}
+            >
+              {t("portal.procurement.journey.daysLeft", {
+                count: daysLeft(snapshot.trialEndsAt),
+              })}
+            </button>
+          )}
+          {stage !== "active" && (
+            <button
+              type="button"
+              className="portal-hero__chip portal-hero__chip--action"
+              onClick={onKeyDocs}
+            >
+              {t("portal.procurement.hero.keyDocs")}
+            </button>
+          )}
+          {stage !== "active" && (
+            <button
+              type="button"
+              className="portal-hero__chip portal-hero__chip--action"
+              onClick={onInvite}
+            >
+              {t("portal.procurement.hero.inviteTeammates")}
+            </button>
+          )}
+          <button
+            type="button"
+            className="portal-hero__chip portal-hero__chip--action"
+            onClick={onSchedule}
+          >
+            {t("portal.procurement.hero.scheduleCall")}
+          </button>
+        </div>
+      </div>
+
+      <div className="portal-hero__stepper">
+        <StageStepper journey={JOURNEY} currentStage={stage} />
+      </div>
+
+      {inTrial && (
+        <ul className="portal-hero__checklist">
+          {setupSteps.map((s) => (
+            <li key={s.title}>
+              <button type="button" onClick={() => onNavigate(s.view)}>
+                <span className="portal-hero__check-dot" aria-hidden />
+                <span className="portal-hero__check-text">
+                  <span className="portal-hero__check-title">{s.title}</span>
+                  <span className="portal-hero__check-sub">{s.sub}</span>
+                </span>
+                <span className="portal-hero__check-pill">
+                  {t("portal.procurement.hero.notStarted")}
+                </span>
+              </button>
+            </li>
+          ))}
+        </ul>
+      )}
+
+      <div className="portal-hero__next">
+        <span className="portal-hero__next-label">
+          <span className="portal-hero__next-dot" />
+          {t("portal.procurement.hero.nextStep", { action: cta })}
+        </span>
+        <div className="portal-hero__next-actions">
+          <Button
+            variant="gradient"
+            accent="purple"
+            loading={busy}
+            onClick={onExpand}
+          >
+            {stage === "active" ? t("portal.procurement.hero.open") : cta}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function daysLeft(iso: string): number {
+  const end = new Date(iso).getTime();
+  return Math.max(0, Math.ceil((end - Date.now()) / 86_400_000));
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
new file mode 100644
index 0000000000..bd00a93904
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
@@ -0,0 +1,126 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button, Card } from "@app/ui";
+import type { QuoteResult } from "@portal/api/procurement";
+import { money } from "@portal/components/procurement/format";
+import "@portal/views/Procurement.css";
+
+/**
+ * The agreement (security) step: a single combined Stirling Enterprise Agreement — Master Service
+ * Agreement + Order Form (from the issued quote) + EULA + Data Processing Agreement — that the buyer
+ * reviews and agrees to before it's accepted into a subscription. No e-signature for now: an explicit
+ * "I agree" click stands in (the terms reference the accepted quote). Document body is static legal
+ * copy; the surrounding UI is translated.
+ */
+export function ProcurementAgreement({
+  quote,
+  busy,
+  onAgree,
+}: {
+  quote: QuoteResult;
+  busy: boolean;
+  onAgree: () => void;
+}) {
+  const { t } = useTranslation();
+  const [checked, setChecked] = useState(false);
+  const annual = money(quote.annualNetMinor, quote.currency);
+  const tcv = money(quote.tcvMinor, quote.currency);
+  const years = quote.config.termYears;
+
+  return (
+    <Card padding="loose">
+      <span className="portal-proc__eyebrow">
+        {t("portal.procurement.agreement.eyebrow")}
+      </span>
+      <h3 className="portal-proc__builder-title">
+        {t("portal.procurement.agreement.title")}
+      </h3>
+      <p className="portal-proc__subtitle">
+        {t("portal.procurement.agreement.intro")}
+      </p>
+
+      <div className="portal-agreement__doc">
+        <h4>1. Master Service Agreement</h4>
+        <p>
+          This Stirling Enterprise Agreement ("Agreement") is entered into
+          between Stirling PDF Inc. ("Stirling") and the customer identified on
+          the Order Form ("Customer"). It governs Customer's access to and use
+          of the Stirling enterprise platform and related services (the
+          "Service"). Stirling will provide the Service with commercially
+          reasonable skill and care and in accordance with the service levels
+          set out in the Order Form.
+        </p>
+
+        <h4>2. Order Form</h4>
+        <p>
+          Quote <strong>{quote.quoteNumber}</strong> forms the Order Form for
+          this Agreement. Customer commits to a {years}-year term at{" "}
+          <strong>{annual}</strong> per year (total contract value{" "}
+          <strong>{tcv}</strong>), billed annually in advance by invoice. Fees
+          are exclusive of taxes. The committed volume, service level, and
+          add-ons are itemised below:
+        </p>
+        <ul className="portal-qb__lines portal-agreement__lines">
+          {quote.lineItems.map((li) => (
+            <li key={li.key} data-kind={li.kind}>
+              <span>{li.label}</span>
+              <span>
+                {li.kind === "INCLUDED"
+                  ? t("portal.procurement.builder.included")
+                  : money(li.amountMinor, quote.currency)}
+              </span>
+            </li>
+          ))}
+        </ul>
+
+        <h4>3. End-User License Agreement</h4>
+        <p>
+          Subject to the terms of this Agreement, Stirling grants Customer a
+          non-exclusive, non-transferable right to use the Service for its
+          internal business purposes during the term. Customer is responsible
+          for its users' compliance and for the content it processes. The
+          Service, and all intellectual property in it, remains Stirling's.
+        </p>
+
+        <h4>4. Data Processing Agreement</h4>
+        <p>
+          Where Stirling processes personal data on Customer's behalf, it does
+          so only on Customer's documented instructions and applies appropriate
+          technical and organisational measures. Sub-processors, international
+          transfers, and security commitments are as described in Stirling's
+          Data Processing Agreement and Trust Center, incorporated here by
+          reference.
+        </p>
+
+        <h4>5. Acceptance</h4>
+        <p>
+          By agreeing below, Customer accepts this Agreement and the Order Form.
+          On acceptance, Stirling will issue the committed annual subscription
+          and its first invoice. This preview stands in for e-signature during
+          the pilot.
+        </p>
+      </div>
+
+      <label className="portal-qb__eula portal-agreement__accept">
+        <input
+          type="checkbox"
+          checked={checked}
+          onChange={(e) => setChecked(e.target.checked)}
+        />
+        <span>{t("portal.procurement.agreement.confirm")}</span>
+      </label>
+
+      <div className="portal-proc__payment-actions">
+        <Button
+          variant="gradient"
+          accent="purple"
+          loading={busy}
+          disabled={!checked}
+          onClick={onAgree}
+        >
+          {t("portal.procurement.agreement.agreeCta")}
+        </Button>
+      </div>
+    </Card>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
new file mode 100644
index 0000000000..ce6620da78
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
@@ -0,0 +1,299 @@
+import { useEffect } from "react";
+import { createPortal } from "react-dom";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import type { ProcurementSnapshot } from "@portal/api/procurement";
+import { useFocusTrap } from "@portal/components/procurement/ProcurementModal";
+import "@portal/views/Procurement.css";
+
+/**
+ * Small centred dialogs that hang off the deal-status hero's quick actions — Key documents, Schedule
+ * a call, and trial management. Content is mocked for the pilot (static demo data); the shells and
+ * wiring are real so the hero behaves like the marketing prototype.
+ */
+
+function SideModal({
+  open,
+  onClose,
+  title,
+  subtitle,
+  children,
+  footer,
+}: {
+  open: boolean;
+  onClose: () => void;
+  title: string;
+  subtitle?: string;
+  children: React.ReactNode;
+  footer?: React.ReactNode;
+}) {
+  const { t } = useTranslation();
+  const trapRef = useFocusTrap(open);
+
+  useEffect(() => {
+    if (!open) return;
+    const onKey = (e: KeyboardEvent) => e.key === "Escape" && onClose();
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [open, onClose]);
+
+  if (!open) return null;
+  return createPortal(
+    <div
+      className="portal-sidemodal"
+      onClick={(e) => e.target === e.currentTarget && onClose()}
+    >
+      <div
+        ref={trapRef}
+        className="portal-sidemodal__panel"
+        role="dialog"
+        aria-modal="true"
+        tabIndex={-1}
+      >
+        <button
+          type="button"
+          className="portal-procmodal__close"
+          onClick={onClose}
+          aria-label={t("portal.procurement.modal.close")}
+        >
+          ✕
+        </button>
+        <div className="portal-sidemodal__header">
+          <h3 className="portal-sidemodal__title">{title}</h3>
+          {subtitle && <p className="portal-sidemodal__sub">{subtitle}</p>}
+        </div>
+        <div className="portal-sidemodal__body">{children}</div>
+        {footer && <div className="portal-sidemodal__footer">{footer}</div>}
+      </div>
+    </div>,
+    document.body,
+  );
+}
+
+// ── Key documents ────────────────────────────────────────────────────────────
+type DocStatus = "available" | "action" | "request";
+interface DocRow {
+  name: string;
+  sub: string;
+  status: DocStatus;
+  fee?: number;
+}
+const STAGE_DOCS: { group: string; docs: DocRow[] }[] = [
+  {
+    group: "Your deal",
+    docs: [
+      {
+        name: "Formal quote",
+        sub: "Built to your volume, term, and service level",
+        status: "available",
+      },
+      {
+        name: "Master Services Agreement",
+        sub: "One signature — MSA, order form, EULA, and DPA combined",
+        status: "action",
+      },
+      {
+        name: "Bank transfer instructions",
+        sub: "Wire details for your AP team",
+        status: "available",
+      },
+      {
+        name: "Purchase order",
+        sub: "Issuing a PO? Upload it and we invoice against it",
+        status: "request",
+      },
+    ],
+  },
+  {
+    group: "Supporting your evaluation",
+    docs: [
+      {
+        name: "SOC 2 Type II report",
+        sub: "Audited · NDA-gated",
+        status: "available",
+      },
+      {
+        name: "Custom security review",
+        sub: "We complete your questionnaire and join your review call",
+        status: "request",
+        fee: 5000,
+      },
+      {
+        name: "Business Associate Agreement",
+        sub: "HIPAA · available on request",
+        status: "request",
+        fee: 2500,
+      },
+      { name: "IRS Form W-9", sub: "Stirling PDF Inc.", status: "available" },
+      {
+        name: "Certificate of Insurance",
+        sub: "Cyber + E&O · current policy",
+        status: "available",
+      },
+    ],
+  },
+];
+const STATUS_LABEL: Record<DocStatus, string> = {
+  available: "Download",
+  action: "Action needed",
+  request: "Request",
+};
+
+export function KeyDocumentsModal({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  return (
+    <SideModal
+      open={open}
+      onClose={onClose}
+      title="Key documents"
+      subtitle="Everything for each stage of your rollout, in one place."
+    >
+      {STAGE_DOCS.map((g) => (
+        <div key={g.group} className="portal-docs__group">
+          <div className="portal-docs__group-title">{g.group}</div>
+          <ul className="portal-docs__list">
+            {g.docs.map((d) => (
+              <li key={d.name} className="portal-docs__row">
+                <div className="portal-docs__row-text">
+                  <span className="portal-docs__row-name">{d.name}</span>
+                  <span className="portal-docs__row-sub">
+                    {d.sub}
+                    {d.fee ? ` · one-time $${d.fee.toLocaleString()}` : ""}
+                  </span>
+                </div>
+                <span
+                  className="portal-docs__row-action"
+                  data-status={d.status}
+                >
+                  {STATUS_LABEL[d.status]}
+                </span>
+              </li>
+            ))}
+          </ul>
+        </div>
+      ))}
+    </SideModal>
+  );
+}
+
+// ── Schedule a call ──────────────────────────────────────────────────────────
+const SLOTS = [
+  "Tomorrow · 10:00",
+  "Tomorrow · 15:30",
+  "Thursday · 11:00",
+  "Friday · 09:30",
+];
+
+export function ScheduleCallModal({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  return (
+    <SideModal
+      open={open}
+      onClose={onClose}
+      title="Schedule a call"
+      subtitle="Your solutions engineer will walk your team through the rollout."
+    >
+      <div className="portal-se">
+        <span className="portal-se__avatar" aria-hidden>
+          SE
+        </span>
+        <div>
+          <div className="portal-se__name">Your solutions engineer</div>
+          <div className="portal-se__role">
+            Dedicated to your evaluation and rollout
+          </div>
+        </div>
+      </div>
+      <div className="portal-slots">
+        {SLOTS.map((s) => (
+          <button
+            key={s}
+            type="button"
+            className="portal-slots__slot"
+            onClick={onClose}
+          >
+            {s}
+          </button>
+        ))}
+      </div>
+    </SideModal>
+  );
+}
+
+// ── Trial management ─────────────────────────────────────────────────────────
+export function TrialManageModal({
+  open,
+  onClose,
+  snapshot,
+  busy,
+  onExtend,
+  onCancel,
+}: {
+  open: boolean;
+  onClose: () => void;
+  snapshot: ProcurementSnapshot;
+  busy: boolean;
+  onExtend: () => void;
+  onCancel: () => void;
+}) {
+  const { t } = useTranslation();
+  const ends = snapshot.trialEndsAt
+    ? new Date(snapshot.trialEndsAt).toLocaleDateString(undefined, {
+        month: "long",
+        day: "numeric",
+        year: "numeric",
+      })
+    : "";
+  const maxed = snapshot.trialExtensionsUsed >= 2;
+  return (
+    <SideModal
+      open={open}
+      onClose={onClose}
+      title={t("portal.procurement.trial.title")}
+      subtitle={
+        ends
+          ? t("portal.procurement.trial.subtitle", { date: ends })
+          : undefined
+      }
+      footer={
+        <>
+          <button
+            type="button"
+            className="portal-sidemodal__ghost"
+            onClick={onCancel}
+            disabled={busy}
+          >
+            {t("portal.procurement.trial.cancel")}
+          </button>
+          <Button
+            variant="gradient"
+            accent="purple"
+            loading={busy}
+            disabled={maxed}
+            onClick={onExtend}
+          >
+            {maxed
+              ? t("portal.procurement.trial.maxed")
+              : t("portal.procurement.trial.extend")}
+          </Button>
+        </>
+      }
+    >
+      <p className="portal-sidemodal__text">
+        {maxed
+          ? t("portal.procurement.trial.bodyMaxed")
+          : t("portal.procurement.trial.body")}
+      </p>
+    </SideModal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementHome.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementHome.stories.tsx
new file mode 100644
index 0000000000..ae424922ad
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementHome.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ProcurementHome } from "@portal/components/procurement/ProcurementHome";
+
+/**
+ * The end-to-end procurement experience (Home hero + takeover modal), driven by the `procurementSaas`
+ * MSW handlers: start trial → build quote → generate (issue Stripe Quote) → milestone (download PDF /
+ * accept). `autoOpen` opens the modal so the flow is immediately clickable.
+ */
+const meta: Meta<typeof ProcurementHome> = {
+  title: "Portal/Procurement/ProcurementHome",
+  component: ProcurementHome,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+
+type Story = StoryObj<typeof ProcurementHome>;
+
+export const Default: Story = { args: { autoOpen: true } };
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
new file mode 100644
index 0000000000..a10057a3d8
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
@@ -0,0 +1,296 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner, Button, Card, EmptyState, Skeleton } from "@app/ui";
+import { useLink } from "@portal/contexts/LinkContext";
+import { useUI } from "@portal/contexts/UIContext";
+import { useView } from "@portal/contexts/ViewContext";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  acceptQuote,
+  extendTrial,
+  fetchQuotePdf,
+  fetchSnapshot,
+  goLive,
+  issueQuote,
+  JOURNEY,
+  resetProcurement,
+  startAgreement,
+  startTrial,
+  type ProcurementSnapshot,
+  type QuoteResult,
+} from "@portal/api/procurement";
+import { DealStatusHero } from "@portal/components/procurement/DealStatusHero";
+import { ProcurementAgreement } from "@portal/components/procurement/ProcurementAgreement";
+import {
+  KeyDocumentsModal,
+  ScheduleCallModal,
+  TrialManageModal,
+} from "@portal/components/procurement/ProcurementExtras";
+import { ProcurementModal } from "@portal/components/procurement/ProcurementModal";
+import {
+  LiveStageCard,
+  PaymentStageCard,
+  QuoteMilestoneCard,
+} from "@portal/components/procurement/ProcurementStages";
+import { QuoteBuilder } from "@portal/components/procurement/QuoteBuilder";
+import { StageStepper } from "@portal/components/procurement/StageStepper";
+import "@portal/views/Procurement.css";
+
+/**
+ * The procurement experience on Home: a compact deal-status hero once a trial is running (or the
+ * enterprise upsell on-ramp before it), both expanding into the full-screen takeover modal that
+ * holds the journey — build + issue a quote (a Stripe Quote with a real PDF, the milestone the buyer
+ * can share and return to), review + agree to the enterprise agreement, then accept into a committed
+ * subscription. Starting a trial is a single click (no "start a trial" prompt); the deadline + next
+ * steps then show on the hero. Rendered on Home and at /procurement (autoOpen). Gated on a link.
+ */
+export function ProcurementHome({ autoOpen = false }: { autoOpen?: boolean }) {
+  const { t } = useTranslation();
+  const { isLinked } = useLink();
+  const { openLinkModal } = useUI();
+  const { setActiveView } = useView();
+
+  const state = useAsync<ProcurementSnapshot | null>(
+    () => (isLinked ? fetchSnapshot() : Promise.resolve(null)),
+    [isLinked],
+  );
+  const [snap, setSnap] = useState<ProcurementSnapshot | null>(null);
+  const [open, setOpen] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [editing, setEditing] = useState(false);
+  const [downloading, setDownloading] = useState(false);
+  const [invoicePdf, setInvoicePdf] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [extra, setExtra] = useState<null | "docs" | "schedule" | "trial">(
+    null,
+  );
+
+  const data = snap ?? (state.loading ? null : state.data);
+  const started = data?.dealId != null;
+  const stage = data?.stage;
+  const latest = data?.latestQuote ?? null;
+  const isIssued = latest?.status === "sent" || latest?.status === "open";
+  // No live quote to act on (none yet, still a draft, or expired/canceled) → the buyer (re)builds.
+  const isDraft =
+    !latest ||
+    ["draft", "expired", "canceled", "cancelled"].includes(latest.status);
+
+  async function run(fn: () => Promise<unknown>) {
+    setBusy(true);
+    setError(null);
+    try {
+      await fn();
+      setSnap(await fetchSnapshot());
+    } catch (e) {
+      console.error("[procurement] action failed", e);
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const onStartTrial = () => run(startTrial);
+  const onExtendTrial = () => run(extendTrial);
+  const onReset = () =>
+    run(async () => {
+      await resetProcurement();
+      setEditing(false);
+      setInvoicePdf(null);
+    });
+  const onGenerate = (draft: QuoteResult) =>
+    run(async () => {
+      await issueQuote(draft.quoteId);
+      setEditing(false);
+    });
+  // Milestone → agreement (security) stage; then agreeing accepts into a subscription.
+  const onAcceptQuote = () => run(startAgreement);
+  const onAgree = () =>
+    run(async () => {
+      if (!latest) return;
+      const res = await acceptQuote(latest.quoteId);
+      setInvoicePdf(res.invoicePdf);
+    });
+
+  async function onDownloadPdf() {
+    if (!latest) return;
+    setDownloading(true);
+    try {
+      const blob = await fetchQuotePdf(latest.quoteId);
+      // A same-gesture <a download> click is reliable; window.open after an await is often
+      // popup-blocked (which is what made this take "a few goes").
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = `${latest.quoteNumber || "quote"}.pdf`;
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      setTimeout(() => URL.revokeObjectURL(url), 60_000);
+    } catch (e) {
+      console.error("[procurement] quote PDF download failed", e);
+      setError(t("portal.procurement.milestone.downloadError"));
+    } finally {
+      setDownloading(false);
+    }
+  }
+
+  // A deep link (/procurement) opens the flow when a deal is already underway; if there's no deal
+  // yet it must NOT silently start a trial — leave the modal closed so the Start-trial CTA shows.
+  useEffect(() => {
+    if (autoOpen && started) setOpen(true);
+  }, [autoOpen, started]);
+
+  const banner =
+    isLinked && started && data ? (
+      <DealStatusHero
+        snapshot={data}
+        busy={busy}
+        onExpand={() => setOpen(true)}
+        onKeyDocs={() => setExtra("docs")}
+        onInvite={() => setActiveView("users")}
+        onSchedule={() => setExtra("schedule")}
+        onManageTrial={() => setExtra("trial")}
+        onNavigate={setActiveView}
+      />
+    ) : (
+      <Card className="portal-proc__upsell">
+        <div className="portal-proc__upsell-text">
+          <span className="portal-proc__upsell-badge">
+            {t("portal.procurement.upsell.homeBadge")}
+          </span>
+          <p className="portal-proc__upsell-copy">
+            <strong>{t("portal.procurement.upsell.homeHeadline")} </strong>
+            {t("portal.procurement.upsell.homeBody")}
+          </p>
+        </div>
+        <Button
+          variant="outline"
+          accent="blue"
+          loading={busy}
+          disabled={!isLinked}
+          onClick={onStartTrial}
+        >
+          {t("portal.procurement.upsell.homeCta")}
+        </Button>
+      </Card>
+    );
+
+  return (
+    <>
+      {banner}
+      <ProcurementModal
+        open={open}
+        onClose={() => setOpen(false)}
+        title={t("portal.procurement.title")}
+        subtitle={t("portal.procurement.subtitle")}
+      >
+        {error && (
+          <Banner
+            tone="danger"
+            title={t("portal.procurement.error.title")}
+            onDismiss={() => setError(null)}
+          >
+            {error}
+          </Banner>
+        )}
+
+        {!isLinked && (
+          <EmptyState
+            eyebrow={t("portal.procurement.link.eyebrow")}
+            title={t("portal.procurement.link.title")}
+            description={t("portal.procurement.link.description")}
+            actions={
+              <Button
+                variant="gradient"
+                accent="purple"
+                onClick={() => openLinkModal()}
+              >
+                {t("portal.procurement.link.cta")}
+              </Button>
+            }
+          />
+        )}
+
+        {isLinked && (state.loading || !started) && <Skeleton height="10rem" />}
+
+        {isLinked && started && (
+          <>
+            <div className="portal-proc__modal-stepper">
+              <StageStepper journey={JOURNEY} currentStage={stage!} />
+            </div>
+
+            {(editing ||
+              (isDraft && (stage === "trial" || stage === "quote"))) && (
+              <QuoteBuilder
+                deployment="cloud"
+                initial={latest?.config}
+                onGenerate={onGenerate}
+              />
+            )}
+
+            {!editing && isIssued && stage === "quote" && latest && (
+              <QuoteMilestoneCard
+                quote={latest}
+                busy={busy}
+                downloading={downloading}
+                onAccept={onAcceptQuote}
+                onDownload={onDownloadPdf}
+                onEdit={() => setEditing(true)}
+              />
+            )}
+
+            {!editing && stage === "security" && latest && (
+              <ProcurementAgreement
+                quote={latest}
+                busy={busy}
+                onAgree={onAgree}
+              />
+            )}
+
+            {!editing && stage === "procurement" && latest && (
+              <PaymentStageCard
+                invoiceUrl={latest.invoiceUrl}
+                invoicePdf={invoicePdf}
+                busy={busy}
+                onSimulate={() => run(goLive)}
+              />
+            )}
+
+            {!editing && stage === "active" && <LiveStageCard />}
+
+            <div className="portal-proc__reset">
+              <button type="button" onClick={onReset} disabled={busy}>
+                {t("portal.procurement.reset")}
+              </button>
+            </div>
+          </>
+        )}
+      </ProcurementModal>
+
+      <KeyDocumentsModal
+        open={extra === "docs"}
+        onClose={() => setExtra(null)}
+      />
+      <ScheduleCallModal
+        open={extra === "schedule"}
+        onClose={() => setExtra(null)}
+      />
+      {data && (
+        <TrialManageModal
+          open={extra === "trial"}
+          onClose={() => setExtra(null)}
+          snapshot={data}
+          busy={busy}
+          onExtend={async () => {
+            await onExtendTrial();
+            setExtra(null);
+          }}
+          onCancel={async () => {
+            await onReset();
+            setExtra(null);
+          }}
+        />
+      )}
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
new file mode 100644
index 0000000000..7074e390e7
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
@@ -0,0 +1,42 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Button, Card } from "@app/ui";
+import { ProcurementModal } from "@portal/components/procurement/ProcurementModal";
+
+/**
+ * The full-screen takeover modal shell. Rendered always-open here to verify the panel has a solid
+ * (not see-through) surface over the dimmed, blurred backdrop.
+ */
+const meta: Meta<typeof ProcurementModal> = {
+  title: "Portal/Procurement/ProcurementModal",
+  component: ProcurementModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    open: true,
+    onClose: () => {},
+    title: "Enterprise procurement",
+    subtitle: "Get your team evaluated, contracted, and onboarded.",
+  },
+};
+export default meta;
+
+type Story = StoryObj<typeof ProcurementModal>;
+
+export const Open: Story = {
+  args: {
+    children: (
+      <Card padding="loose">
+        <h3 style={{ margin: 0 }}>Ready for payment</h3>
+        <p style={{ color: "var(--color-text-3)" }}>
+          Your quote is accepted. Continue to checkout to pay your committed
+          contract and go live.
+        </p>
+        <div style={{ display: "flex", gap: "0.6rem" }}>
+          <Button variant="gradient" accent="purple">
+            Continue to checkout
+          </Button>
+          <Button variant="outline">Edit quote</Button>
+        </div>
+      </Card>
+    ),
+  },
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementModal.tsx b/frontend/editor/src/portal/components/procurement/ProcurementModal.tsx
new file mode 100644
index 0000000000..bf3f463585
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementModal.tsx
@@ -0,0 +1,102 @@
+import { useEffect, useRef } from "react";
+import { createPortal } from "react-dom";
+import "@portal/views/Procurement.css";
+
+/** Keep keyboard focus inside an open dialog: focus it on open and wrap Tab at the edges. */
+export function useFocusTrap(open: boolean) {
+  const ref = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    if (!open) return;
+    const panel = ref.current;
+    if (!panel) return;
+    const prev = document.activeElement as HTMLElement | null;
+    const focusables = () =>
+      Array.from(
+        panel.querySelectorAll<HTMLElement>(
+          'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])',
+        ),
+      ).filter((el) => !el.hasAttribute("disabled"));
+    (focusables()[0] ?? panel).focus();
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key !== "Tab") return;
+      const items = focusables();
+      if (items.length === 0) return;
+      const first = items[0];
+      const last = items[items.length - 1];
+      if (e.shiftKey && document.activeElement === first) {
+        e.preventDefault();
+        last.focus();
+      } else if (!e.shiftKey && document.activeElement === last) {
+        e.preventDefault();
+        first.focus();
+      }
+    };
+    panel.addEventListener("keydown", onKey);
+    return () => {
+      panel.removeEventListener("keydown", onKey);
+      prev?.focus?.();
+    };
+  }, [open]);
+  return ref;
+}
+
+/**
+ * Full-screen takeover modal for the procurement flow, copying the prototype's modal design
+ * (portaled to body, dimmed + blurred backdrop, rounded panel, close button). The Home deal-status
+ * hero expands into this.
+ */
+export function ProcurementModal({
+  open,
+  onClose,
+  title,
+  subtitle,
+  children,
+}: {
+  open: boolean;
+  onClose: () => void;
+  title: string;
+  subtitle?: string;
+  children: React.ReactNode;
+}) {
+  const trapRef = useFocusTrap(open);
+
+  useEffect(() => {
+    if (!open) return;
+    const onKey = (e: KeyboardEvent) => e.key === "Escape" && onClose();
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [open, onClose]);
+
+  if (!open) return null;
+
+  return createPortal(
+    <div
+      className="portal-procmodal"
+      onClick={(e) => e.target === e.currentTarget && onClose()}
+    >
+      <div
+        ref={trapRef}
+        className="portal-procmodal__panel"
+        role="dialog"
+        aria-modal="true"
+        aria-label={title}
+        tabIndex={-1}
+      >
+        <button
+          type="button"
+          className="portal-procmodal__close"
+          onClick={onClose}
+          aria-label="Close"
+        >
+          ✕
+        </button>
+        <div className="portal-procmodal__header">
+          <h2 className="portal-procmodal__title">{title}</h2>
+          {subtitle && <p className="portal-procmodal__sub">{subtitle}</p>}
+        </div>
+        <div className="portal-procmodal__body">{children}</div>
+      </div>
+    </div>,
+    document.body,
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
new file mode 100644
index 0000000000..fdebad61f6
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
@@ -0,0 +1,160 @@
+import { useTranslation } from "react-i18next";
+import { Button, Card } from "@app/ui";
+import type { QuoteResult } from "@portal/api/procurement";
+import { money } from "@portal/components/procurement/format";
+import "@portal/views/Procurement.css";
+
+/**
+ * The stage-specific cards shown inside the procurement takeover modal once a quote exists: the
+ * issued-quote milestone, the subscription-created payment step, and the live confirmation. Each is
+ * a pure presentational view driven by props; ProcurementHome owns the state and the actions.
+ */
+
+/** The issued Stripe Quote as a shareable milestone: itemised, with accept / download / edit. */
+export function QuoteMilestoneCard({
+  quote,
+  busy,
+  downloading,
+  onAccept,
+  onDownload,
+  onEdit,
+}: {
+  quote: QuoteResult;
+  busy: boolean;
+  downloading: boolean;
+  onAccept: () => void;
+  onDownload: () => void;
+  onEdit: () => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <Card padding="loose">
+      <span className="portal-proc__eyebrow">
+        {t("portal.procurement.milestone.eyebrow", {
+          number: quote.quoteNumber,
+        })}
+      </span>
+      <h3 className="portal-proc__builder-title">
+        {t("portal.procurement.milestone.title")}
+      </h3>
+      {quote.config.businessName && (
+        <p className="portal-proc__milestone-for">
+          {t("portal.procurement.milestone.preparedFor", {
+            company: quote.config.businessName,
+          })}
+        </p>
+      )}
+      <p className="portal-proc__subtitle">
+        {t("portal.procurement.milestone.description")}
+      </p>
+      <ul className="portal-qb__lines portal-proc__milestone-lines">
+        {quote.lineItems.map((li) => (
+          <li key={li.key} data-kind={li.kind}>
+            <span>{li.label}</span>
+            <span>
+              {li.kind === "INCLUDED"
+                ? t("portal.procurement.builder.included")
+                : money(li.amountMinor, quote.currency)}
+            </span>
+          </li>
+        ))}
+      </ul>
+      <div className="portal-proc__milestone-totals">
+        <span className="portal-proc__milestone-annual">
+          {money(quote.annualNetMinor, quote.currency)}
+          <small>{t("portal.procurement.milestone.perYear")}</small>
+        </span>
+        <span className="portal-proc__milestone-tcv">
+          {t("portal.procurement.milestone.tcv", {
+            value: money(quote.tcvMinor, quote.currency),
+          })}
+        </span>
+      </div>
+      <div className="portal-proc__payment-actions">
+        <Button
+          variant="gradient"
+          accent="purple"
+          loading={busy}
+          onClick={onAccept}
+        >
+          {t("portal.procurement.milestone.accept")}
+        </Button>
+        <Button variant="outline" loading={downloading} onClick={onDownload}>
+          {t("portal.procurement.milestone.download")}
+        </Button>
+        <Button variant="ghost" onClick={onEdit}>
+          {t("portal.procurement.milestone.edit")}
+        </Button>
+      </div>
+    </Card>
+  );
+}
+
+/** The subscription-created step: pay/download the first invoice, or (demo) simulate payment. */
+export function PaymentStageCard({
+  invoiceUrl,
+  invoicePdf,
+  busy,
+  onSimulate,
+}: {
+  invoiceUrl?: string | null;
+  invoicePdf?: string | null;
+  busy: boolean;
+  onSimulate: () => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <Card padding="loose">
+      <h3 className="portal-proc__builder-title">
+        {t("portal.procurement.payment.title")}
+      </h3>
+      <p className="portal-proc__subtitle">
+        {t("portal.procurement.payment.description")}
+      </p>
+      {(invoiceUrl || invoicePdf) && (
+        <div className="portal-proc__payment-actions">
+          {invoiceUrl && (
+            <Button
+              variant="gradient"
+              accent="purple"
+              onClick={() => window.open(invoiceUrl, "_blank", "noopener")}
+            >
+              {t("portal.procurement.payment.viewInvoice")}
+            </Button>
+          )}
+          {invoicePdf && (
+            <Button
+              variant="outline"
+              onClick={() => window.open(invoicePdf, "_blank", "noopener")}
+            >
+              {t("portal.procurement.payment.downloadInvoice")}
+            </Button>
+          )}
+        </div>
+      )}
+      <div className="portal-proc__reset">
+        <button type="button" onClick={onSimulate} disabled={busy}>
+          {t("portal.procurement.payment.simulate")}
+        </button>
+      </div>
+    </Card>
+  );
+}
+
+/** The live confirmation once the deal is active. */
+export function LiveStageCard() {
+  const { t } = useTranslation();
+  return (
+    <Card padding="loose">
+      <span className="portal-proc__eyebrow">
+        {t("portal.procurement.live.eyebrow")}
+      </span>
+      <h3 className="portal-proc__builder-title">
+        {t("portal.procurement.live.title")}
+      </h3>
+      <p className="portal-proc__subtitle">
+        {t("portal.procurement.live.description")}
+      </p>
+    </Card>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/QuoteBuilder.stories.tsx b/frontend/editor/src/portal/components/procurement/QuoteBuilder.stories.tsx
new file mode 100644
index 0000000000..430bcf23cf
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/QuoteBuilder.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { QuoteBuilder } from "@portal/components/procurement/QuoteBuilder";
+import "@portal/views/Procurement.css";
+
+/**
+ * The enterprise quote builder. The "Review quote" step calls the SaaS backend, answered here by
+ * the `procurementSaas` MSW handler, so all four steps (incl. the itemised quote paper) work in
+ * Storybook. Click through Volume → Commitment & service → Details → Quote.
+ */
+const meta: Meta<typeof QuoteBuilder> = {
+  title: "Portal/Procurement/QuoteBuilder",
+  component: QuoteBuilder,
+  parameters: { layout: "padded" },
+  args: { deployment: "cloud", onGenerate: () => {} },
+};
+export default meta;
+
+type Story = StoryObj<typeof QuoteBuilder>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
new file mode 100644
index 0000000000..b180c986bf
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
@@ -0,0 +1,436 @@
+import { useEffect, useState, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import {
+  DocumentsIcon,
+  PoliciesIcon,
+  UsersIcon,
+} from "@portal/components/icons";
+import { money } from "@portal/components/procurement/format";
+import {
+  buildQuote,
+  type QuoteConfigInput,
+  type QuoteResult,
+} from "@portal/api/procurement";
+import "@portal/views/Procurement.css";
+
+const STEPS = ["volume", "plan", "details"] as const;
+const TERM_DISCOUNT = [0, 0.05, 0.1, 0.12, 0.15]; // 1..5 years
+const SLA_UPLIFT: Record<string, number> = {
+  standard: 0,
+  priority: 0.15,
+  dedicated: 0.3,
+};
+
+/**
+ * The enterprise quote builder — volume → commitment &amp; service → details. A client-side preview
+ * drives the live footer total; the backend is authoritative. Completing the form generates the
+ * quote directly (build + issue in one step) — the issued quote is then shown as the milestone, so
+ * there's no redundant in-builder preview.
+ */
+export function QuoteBuilder({
+  deployment,
+  initial,
+  onGenerate,
+}: {
+  deployment: string;
+  /** Seed the builder from an existing quote's config (re-editing a quote). */
+  initial?: QuoteConfigInput;
+  /** Called with the priced DRAFT quote; the parent issues it as a Stripe Quote. */
+  onGenerate: (quote: QuoteResult) => void;
+}) {
+  const { t } = useTranslation();
+  const [step, setStep] = useState(0);
+  const [cfg, setCfg] = useState<QuoteConfigInput>(
+    initial ?? {
+      volume: 1_000_000,
+      users: 0,
+      deployment,
+      termYears: 3,
+      serviceLevel: "priority",
+      indemnification: false,
+      training: false,
+      qbr: false,
+      currency: "USD",
+      businessName: "",
+    },
+  );
+  // A seeded quote carries a volume but no user count, so treat it as manually set.
+  const [manualVolume, setManualVolume] = useState(initial != null);
+  const [eula, setEula] = useState(initial != null);
+  const [busy, setBusy] = useState(false);
+
+  function set<K extends keyof QuoteConfigInput>(k: K, v: QuoteConfigInput[K]) {
+    setCfg((c) => ({ ...c, [k]: v }));
+  }
+
+  // Re-editing an existing quote: everything is seeded, so jump to the last step (details) with the
+  // agreement pre-accepted — one click re-generates, or Back to change a field. No walking from step 1.
+  // Mount-only: seed the step from `initial` once (deliberately no deps).
+  useEffect(() => {
+    if (initial) setStep(STEPS.length - 1);
+  }, []);
+
+  const preview = previewAnnualMinor(cfg);
+  const tcvPreview = preview * cfg.termYears + (cfg.training ? 750_000 : 0);
+
+  // Fully filled → price + hand the draft to the parent to issue as a Stripe Quote (which then shows
+  // as the milestone). No separate in-builder preview step.
+  async function generate() {
+    setBusy(true);
+    try {
+      onGenerate(await buildQuote(cfg));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="portal-qb">
+      <div className="portal-qb__head">
+        <h3 className="portal-qb__title">
+          {t("portal.procurement.builder.title")}
+        </h3>
+        <span className="portal-qb__stepchip">
+          {t("portal.procurement.builder.stepOf", {
+            n: step + 1,
+            total: STEPS.length,
+          })}
+        </span>
+      </div>
+      <div className="portal-qb__progress">
+        {STEPS.map((s, i) => (
+          <span key={s} data-on={i <= step || undefined} />
+        ))}
+      </div>
+
+      <div className="portal-qb__body">
+        {step === 0 && (
+          <Step
+            icon={<DocumentsIcon size={22} />}
+            title={t("portal.procurement.builder.s1Title")}
+            sub={t("portal.procurement.builder.s1Sub")}
+          >
+            <div className="portal-qb__row">
+              <Field label={t("portal.procurement.builder.users")}>
+                <input
+                  type="number"
+                  min={0}
+                  placeholder={t("portal.procurement.builder.usersPlaceholder")}
+                  value={cfg.users || ""}
+                  onChange={(e) => {
+                    const users = Number(e.target.value);
+                    set("users", users);
+                    if (!manualVolume) set("volume", estimateVolume(users));
+                  }}
+                />
+              </Field>
+              <Field label={t("portal.procurement.builder.volume")}>
+                <input
+                  type="number"
+                  min={0}
+                  placeholder={t(
+                    "portal.procurement.builder.volumePlaceholder",
+                  )}
+                  value={cfg.volume || ""}
+                  onChange={(e) => {
+                    setManualVolume(true);
+                    set("volume", Number(e.target.value));
+                  }}
+                />
+              </Field>
+            </div>
+            <p className="portal-qb__hint">
+              {cfg.users > 0 && !manualVolume
+                ? t("portal.procurement.builder.volEstimated", {
+                    count: cfg.users,
+                  })
+                : cfg.users > 0
+                  ? t("portal.procurement.builder.volManual")
+                  : t("portal.procurement.builder.volNoUsers")}
+            </p>
+          </Step>
+        )}
+
+        {step === 1 && (
+          <Step
+            icon={<PoliciesIcon size={22} />}
+            title={t("portal.procurement.builder.s2Title")}
+            sub={t("portal.procurement.builder.s2Sub")}
+          >
+            <Field label={t("portal.procurement.builder.term")}>
+              <div className="portal-qb__pills">
+                {[1, 2, 3, 4, 5].map((y) => (
+                  <button
+                    key={y}
+                    type="button"
+                    data-on={cfg.termYears === y || undefined}
+                    onClick={() => set("termYears", y)}
+                  >
+                    {t("portal.procurement.builder.years", { count: y })}
+                  </button>
+                ))}
+              </div>
+              {TERM_DISCOUNT[cfg.termYears - 1] > 0 && (
+                <p className="portal-qb__discount">
+                  {t("portal.procurement.builder.termDiscount", {
+                    pct: Math.round(TERM_DISCOUNT[cfg.termYears - 1] * 100),
+                  })}
+                </p>
+              )}
+            </Field>
+
+            <Field label={t("portal.procurement.builder.serviceLevel")}>
+              <div className="portal-qb__opts">
+                <OptCard
+                  on={cfg.serviceLevel === "standard"}
+                  title={t("portal.procurement.builder.slStandard")}
+                  sub={t("portal.procurement.builder.slStandardSub")}
+                  onClick={() => set("serviceLevel", "standard")}
+                />
+                <OptCard
+                  on={cfg.serviceLevel === "priority"}
+                  title={t("portal.procurement.builder.slPriority")}
+                  sub={t("portal.procurement.builder.slPrioritySub")}
+                  onClick={() => set("serviceLevel", "priority")}
+                />
+                <OptCard
+                  on={cfg.serviceLevel === "dedicated"}
+                  title={t("portal.procurement.builder.slDedicated")}
+                  sub={t("portal.procurement.builder.slDedicatedSub")}
+                  onClick={() => set("serviceLevel", "dedicated")}
+                />
+              </div>
+            </Field>
+
+            <Field label={t("portal.procurement.builder.addons")}>
+              <div className="portal-qb__addons">
+                <AddOn
+                  on={cfg.indemnification}
+                  title={t("portal.procurement.builder.indemnification")}
+                  sub={t("portal.procurement.builder.indemnificationSub")}
+                  onClick={() => set("indemnification", !cfg.indemnification)}
+                />
+                <AddOn
+                  on={cfg.training}
+                  title={t("portal.procurement.builder.training")}
+                  sub={t("portal.procurement.builder.trainingSub")}
+                  onClick={() => set("training", !cfg.training)}
+                />
+                <AddOn
+                  on={cfg.qbr}
+                  title={t("portal.procurement.builder.qbr")}
+                  sub={t("portal.procurement.builder.qbrSub")}
+                  onClick={() => set("qbr", !cfg.qbr)}
+                />
+              </div>
+            </Field>
+          </Step>
+        )}
+
+        {step === 2 && (
+          <Step
+            icon={<UsersIcon size={22} />}
+            title={t("portal.procurement.builder.s3Title")}
+            sub={t("portal.procurement.builder.s3Sub")}
+          >
+            <Field label={t("portal.procurement.builder.businessName")}>
+              <input
+                placeholder={t(
+                  "portal.procurement.builder.businessNamePlaceholder",
+                )}
+                value={cfg.businessName}
+                onChange={(e) => set("businessName", e.target.value)}
+              />
+            </Field>
+            <div className="portal-qb__row">
+              <Field label={t("portal.procurement.builder.country")}>
+                <select
+                  value={cfg.currency}
+                  onChange={(e) => set("currency", e.target.value)}
+                >
+                  <option value="USD">
+                    {t("portal.procurement.builder.countryUS")}
+                  </option>
+                  <option value="GBP">
+                    {t("portal.procurement.builder.countryUK")}
+                  </option>
+                  <option value="EUR">
+                    {t("portal.procurement.builder.countryEuro")}
+                  </option>
+                </select>
+              </Field>
+            </div>
+            <label className="portal-qb__eula">
+              <input
+                type="checkbox"
+                checked={eula}
+                onChange={(e) => setEula(e.target.checked)}
+              />
+              <span>{t("portal.procurement.builder.eula")}</span>
+            </label>
+          </Step>
+        )}
+      </div>
+
+      <div className="portal-qb__foot">
+        <span className="portal-qb__running">
+          {t("portal.procurement.builder.running", {
+            annual: money(preview, cfg.currency),
+            years: cfg.termYears,
+            tcv: money(tcvPreview, cfg.currency),
+          })}
+        </span>
+        <div className="portal-qb__foot-btns">
+          {step > 0 && (
+            <Button variant="outline" onClick={() => setStep(step - 1)}>
+              {t("portal.procurement.builder.back")}
+            </Button>
+          )}
+          {step === 0 && (
+            <Button
+              variant="gradient"
+              accent="purple"
+              disabled={cfg.volume <= 0}
+              onClick={() => setStep(1)}
+            >
+              {t("portal.procurement.builder.continue")}
+            </Button>
+          )}
+          {step === 1 && (
+            <Button
+              variant="gradient"
+              accent="purple"
+              onClick={() => setStep(2)}
+            >
+              {t("portal.procurement.builder.continue")}
+            </Button>
+          )}
+          {step === 2 && (
+            <Button
+              variant="gradient"
+              accent="purple"
+              loading={busy}
+              disabled={!eula}
+              onClick={generate}
+            >
+              {t("portal.procurement.builder.generate")}
+            </Button>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function Step({
+  icon,
+  title,
+  sub,
+  children,
+}: {
+  icon: ReactNode;
+  title: string;
+  sub: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <>
+      <div className="portal-qb__intro">
+        <span className="portal-qb__intro-icon" aria-hidden>
+          {icon}
+        </span>
+        <div>
+          <div className="portal-qb__intro-title">{title}</div>
+          <div className="portal-qb__intro-sub">{sub}</div>
+        </div>
+      </div>
+      {children}
+    </>
+  );
+}
+
+function Field({
+  label,
+  children,
+}: {
+  label: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <label className="portal-qb__field">
+      <span className="portal-qb__field-label">{label}</span>
+      {children}
+    </label>
+  );
+}
+
+function OptCard({
+  on,
+  title,
+  sub,
+  onClick,
+}: {
+  on: boolean;
+  title: string;
+  sub: string;
+  onClick: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      className="portal-qb__opt"
+      data-on={on || undefined}
+      onClick={onClick}
+    >
+      <span className="portal-qb__opt-title">{title}</span>
+      <span className="portal-qb__opt-sub">{sub}</span>
+    </button>
+  );
+}
+
+function AddOn({
+  on,
+  title,
+  sub,
+  onClick,
+}: {
+  on: boolean;
+  title: string;
+  sub: string;
+  onClick: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      className="portal-qb__addon"
+      data-on={on || undefined}
+      onClick={onClick}
+    >
+      <span className="portal-qb__addon-box" aria-hidden>
+        {on ? "✓" : ""}
+      </span>
+      <span>
+        <span className="portal-qb__addon-title">{title}</span>
+        <span className="portal-qb__addon-sub">{sub}</span>
+      </span>
+    </button>
+  );
+}
+
+function estimateVolume(users: number): number {
+  const raw = Math.max(0, users) * 5 * 230 * 1.75;
+  const stepSize = raw >= 1_000_000 ? 50_000 : raw >= 100_000 ? 25_000 : 5_000;
+  return Math.round(raw / stepSize) * stepSize;
+}
+
+function previewAnnualMinor(cfg: QuoteConfigInput): number {
+  const perPdf = cfg.volume >= 5_000_000 ? 3 : cfg.volume >= 1_000_000 ? 4 : 5;
+  const usage = Math.round(cfg.volume * perPdf);
+  const withSla = Math.round(usage * (1 + (SLA_UPLIFT[cfg.serviceLevel] ?? 0)));
+  const withInd = cfg.indemnification ? Math.round(withSla * 1.05) : withSla;
+  const disc = Math.round(
+    withInd * TERM_DISCOUNT[Math.min(Math.max(cfg.termYears, 1), 5) - 1],
+  );
+  return withInd - disc + (cfg.qbr ? 800_000 : 0);
+}
diff --git a/frontend/editor/src/portal/components/procurement/format.ts b/frontend/editor/src/portal/components/procurement/format.ts
index bba7e63393..75f5b2fb16 100644
--- a/frontend/editor/src/portal/components/procurement/format.ts
+++ b/frontend/editor/src/portal/components/procurement/format.ts
@@ -9,6 +9,15 @@ export const USD = new Intl.NumberFormat(undefined, {
   maximumFractionDigits: 0,
 });
 
+/** Format a minor-unit (cents) amount in the given currency, whole units (no decimals). */
+export function money(minor: number, currency: string): string {
+  return new Intl.NumberFormat(undefined, {
+    style: "currency",
+    currency: currency || "USD",
+    maximumFractionDigits: 0,
+  }).format(minor / 100);
+}
+
 /** Document status → badge tone. Action items lean amber to pull the eye. */
 export const STATUS_TONE: Record<DocStatus, StatusTone> = {
   available: "success",
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index bd1d471988..9341ce6304 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -8,6 +8,7 @@ import { pipelinesHandlers } from "@portal/mocks/handlers/pipelines";
 import { sourcesHandlers } from "@portal/mocks/handlers/sources";
 import { infrastructureHandlers } from "@portal/mocks/handlers/infrastructure";
 import { procurementHandlers } from "@portal/mocks/handlers/procurement";
+import { procurementSaasHandlers } from "@portal/mocks/handlers/procurementSaas";
 import { docsHandlers } from "@portal/mocks/handlers/docs";
 import { settingsHandlers } from "@portal/mocks/handlers/settings";
 import { usersHandlers } from "@portal/mocks/handlers/users";
@@ -30,6 +31,7 @@ export const handlers = [
   ...infrastructureHandlers,
   ...docsHandlers,
   ...procurementHandlers,
+  ...procurementSaasHandlers,
   ...settingsHandlers,
   ...usersHandlers,
   ...agentsHandlers,
diff --git a/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts b/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts
new file mode 100644
index 0000000000..4a4cc4bcb8
--- /dev/null
+++ b/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts
@@ -0,0 +1,241 @@
+import { http, HttpResponse } from "msw";
+
+/**
+ * MSW mock for the real SaaS procurement endpoints (`apiClient.saas` → VITE_SAAS_API_URL, which is
+ * `http://saas.mock` in dev/Storybook). Lets the trial → quote → accept flow run without the Java
+ * backend (Storybook + mocks-on dev). Pricing mirrors ProcurementPricingService.
+ */
+const SAAS = "http://saas.mock";
+
+const EMPTY = {
+  dealId: null,
+  stage: null,
+  trialStartedAt: null,
+  trialEndsAt: null,
+  trialExtensionsUsed: 0,
+  licensed: false,
+  latestQuote: null,
+};
+
+interface Cfg {
+  volume: number;
+  serviceLevel: string;
+  termYears: number;
+  indemnification: boolean;
+  training: boolean;
+  qbr: boolean;
+  currency: string;
+  businessName?: string;
+}
+
+let deal: typeof EMPTY | (Record<string, unknown> & { latestQuote: unknown }) =
+  EMPTY;
+let seq = 0;
+
+const SLA: Record<string, number> = {
+  standard: 0,
+  priority: 0.15,
+  dedicated: 0.3,
+};
+const TERM = [0, 0.05, 0.1, 0.12, 0.15];
+
+function priceQuote(cfg: Cfg) {
+  const perPdf = cfg.volume >= 5_000_000 ? 3 : cfg.volume >= 1_000_000 ? 4 : 5;
+  const usage = Math.round(cfg.volume * perPdf);
+  const withSla = Math.round(usage * (1 + (SLA[cfg.serviceLevel] ?? 0)));
+  const withInd = cfg.indemnification ? Math.round(withSla * 1.05) : withSla;
+  const disc = Math.round(
+    withInd * TERM[Math.min(Math.max(cfg.termYears, 1), 5) - 1],
+  );
+  const qbr = cfg.qbr ? 800_000 : 0;
+  const training = cfg.training ? 750_000 : 0;
+  const annualNetMinor = withInd - disc + qbr;
+  const tcvMinor = annualNetMinor * cfg.termYears + training;
+
+  type Kind = "RECURRING" | "ONE_TIME" | "DISCOUNT" | "INCLUDED";
+  const lines: {
+    key: string;
+    label: string;
+    kind: Kind;
+    amountMinor: number;
+  }[] = [
+    {
+      key: "usage",
+      label: "PDF processing",
+      kind: "RECURRING",
+      amountMinor: usage,
+    },
+    {
+      key: "seats",
+      label: "Unlimited users + SSO / SCIM / RBAC",
+      kind: "INCLUDED",
+      amountMinor: 0,
+    },
+  ];
+  if (withSla !== usage)
+    lines.push({
+      key: "service-level",
+      label:
+        cfg.serviceLevel === "dedicated"
+          ? "Dedicated service level"
+          : "Priority service level",
+      kind: "RECURRING",
+      amountMinor: withSla - usage,
+    });
+  if (withInd !== withSla)
+    lines.push({
+      key: "indemnification",
+      label: "IP indemnification",
+      kind: "RECURRING",
+      amountMinor: withInd - withSla,
+    });
+  if (qbr > 0)
+    lines.push({
+      key: "qbr",
+      label: "Quarterly business reviews",
+      kind: "RECURRING",
+      amountMinor: qbr,
+    });
+  if (disc > 0)
+    lines.push({
+      key: "multi-year",
+      label: `${cfg.termYears}-year commitment`,
+      kind: "DISCOUNT",
+      amountMinor: -disc,
+    });
+  if (training > 0)
+    lines.push({
+      key: "training",
+      label: "Onboarding & training",
+      kind: "ONE_TIME",
+      amountMinor: training,
+    });
+
+  seq += 1;
+  return {
+    quoteId: seq,
+    quoteNumber: `QT-DEMO-${String(seq).padStart(4, "0")}`,
+    status: "draft",
+    currency: cfg.currency || "USD",
+    annualNetMinor,
+    tcvMinor,
+    lineItems: lines,
+    validUntil: "2026-07-31",
+    stripeQuoteId: null,
+    invoiceUrl: null,
+    config: {
+      volume: cfg.volume,
+      users: 0,
+      deployment: "cloud",
+      termYears: cfg.termYears,
+      serviceLevel: cfg.serviceLevel,
+      indemnification: cfg.indemnification,
+      training: cfg.training,
+      qbr: cfg.qbr,
+      currency: cfg.currency || "USD",
+      businessName: cfg.businessName ?? "",
+    },
+  };
+}
+
+export function resetProcurementSaasStore() {
+  deal = EMPTY;
+  seq = 0;
+}
+
+export const procurementSaasHandlers = [
+  http.get(`${SAAS}/api/v1/procurement`, () => HttpResponse.json(deal)),
+  http.post(`${SAAS}/api/v1/procurement/trial/start`, () => {
+    const now = Date.now();
+    deal = {
+      dealId: 1,
+      stage: "trial",
+      trialStartedAt: new Date(now).toISOString(),
+      trialEndsAt: new Date(now + 14 * 86_400_000).toISOString(),
+      trialExtensionsUsed: 0,
+      licensed: true,
+      latestQuote: null,
+    };
+    return HttpResponse.json(deal);
+  }),
+  http.post(`${SAAS}/api/v1/procurement/quote`, async ({ request }) => {
+    const cfg = (await request.json()) as Cfg;
+    const quote = priceQuote(cfg);
+    const d = (
+      deal.dealId ? deal : { dealId: 1, trialExtensionsUsed: 0 }
+    ) as Record<string, unknown>;
+    deal = {
+      ...d,
+      stage: "quote",
+      licensed: true,
+      latestQuote: quote,
+    } as never;
+    return HttpResponse.json(quote);
+  }),
+  http.post(`${SAAS}/api/v1/procurement/trial/extend`, () => {
+    const d = deal as Record<string, unknown>;
+    if (d.dealId) {
+      const base = d.trialEndsAt
+        ? Date.parse(d.trialEndsAt as string)
+        : Date.now();
+      d.trialEndsAt = new Date(base + 7 * 86_400_000).toISOString();
+      d.trialExtensionsUsed = ((d.trialExtensionsUsed as number) ?? 0) + 1;
+    }
+    return HttpResponse.json(deal);
+  }),
+  http.post(`${SAAS}/api/v1/procurement/agreement`, () => {
+    (deal as Record<string, unknown>).stage = "security";
+    return HttpResponse.json(deal);
+  }),
+  http.post(`${SAAS}/api/v1/procurement/go-live`, () => {
+    const d = deal as Record<string, unknown>;
+    if (d.dealId) {
+      d.stage = "active";
+      d.licensed = true;
+    }
+    return HttpResponse.json(deal);
+  }),
+  http.post(`${SAAS}/api/v1/procurement/reset`, () => {
+    resetProcurementSaasStore();
+    return HttpResponse.json(EMPTY);
+  }),
+
+  // Stripe Quote edge functions (supabase.functions.invoke → ${url}/functions/v1/{name}).
+  http.post(`${SAAS}/functions/v1/issue-procurement-quote`, () => {
+    const q = (deal as { latestQuote: Record<string, unknown> | null })
+      .latestQuote;
+    if (q) {
+      q.status = "sent";
+      q.stripeQuoteId = `qt_mock_${q.quoteId}`;
+    }
+    return HttpResponse.json(q);
+  }),
+  http.post(`${SAAS}/functions/v1/accept-procurement-quote`, () => {
+    const q = (deal as { latestQuote: Record<string, unknown> | null })
+      .latestQuote;
+    const invoiceUrl = "https://invoice.stripe.com/i/mock_procurement";
+    if (q) {
+      q.status = "accepted";
+      q.invoiceUrl = invoiceUrl;
+      (deal as Record<string, unknown>).stage = "procurement";
+    }
+    return HttpResponse.json({
+      status: "accepted",
+      subscriptionId: "sub_mock_procurement",
+      invoiceUrl,
+      invoicePdf: "https://invoice.stripe.com/i/mock_procurement/pdf",
+    });
+  }),
+  http.post(`${SAAS}/functions/v1/get-procurement-quote-pdf`, () => {
+    // A minimal valid PDF so the download opens something in Storybook / mock dev.
+    const pdf = `%PDF-1.1
+1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj
+2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj
+3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 300 200]>>endobj
+trailer<</Root 1 0 R>>
+%%EOF`;
+    return new HttpResponse(pdf, {
+      headers: { "Content-Type": "application/pdf" },
+    });
+  }),
+];
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index b9478ead32..92d7f69318 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -28,6 +28,7 @@ import { UsageAreaChart } from "@portal/components/UsageAreaChart";
 import { RecentActivity } from "@portal/components/RecentActivity";
 import { SingleOpRunner } from "@portal/components/SingleOpRunner";
 import { ProcessingStatusStrip } from "@portal/components/ProcessingStatusStrip";
+import { ProcurementHome } from "@portal/components/procurement/ProcurementHome";
 import { PolicySummary } from "@portal/components/PolicySummary";
 import { PipelineForkWizard } from "@portal/components/PipelineForkWizard";
 import "@portal/views/Home.css";
@@ -538,6 +539,8 @@ export function Home() {
       <WelcomeCarousel onTryOp={() => setRunnerOpen(true)} />
       <ProcessingStatusStrip />
 
+      <ProcurementHome />
+
       {tier === "free" && (
         <>
           <TierKpiStrip />
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index 90da816a53..8294709e5d 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -451,3 +451,1010 @@
     overflow-x: auto;
   }
 }
+
+/* ── Enterprise upsell CTA (Home / Usage on-ramp) ─────────────────────────── */
+.portal-proc__upsell {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+.portal-proc__upsell-badge {
+  display: inline-block;
+  font-size: 0.625rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--color-primary, #2383e2);
+  background: var(--color-primary-light, #eaf2fb);
+  padding: 0.15rem 0.5rem;
+  border-radius: 0.375rem;
+  margin-bottom: 0.4rem;
+}
+.portal-proc__upsell-copy {
+  margin: 0;
+  font-size: 0.8125rem;
+  line-height: 1.45;
+  color: var(--color-text-3);
+  max-width: 44rem;
+}
+.portal-proc__upsell-copy strong {
+  color: var(--color-text-1);
+}
+
+/* ── Quote builder ────────────────────────────────────────────────────────── */
+.portal-proc__builder-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  margin-bottom: 1rem;
+}
+.portal-proc__builder-title {
+  margin: 0;
+  font-size: 1rem;
+  font-weight: 650;
+  color: var(--color-text-1);
+}
+.portal-proc__builder-step {
+  font-size: 0.75rem;
+  color: var(--color-text-5);
+}
+.portal-proc__builder-body {
+  display: flex;
+  flex-direction: column;
+  gap: 0.85rem;
+}
+.portal-proc__field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+}
+.portal-proc__field input,
+.portal-proc__field select {
+  padding: 0.45rem 0.6rem;
+  border: 1px solid var(--color-border, #eae8e3);
+  border-radius: 0.5rem;
+  font-size: 0.875rem;
+  background: var(--color-bg-elevated, #fff);
+  color: var(--color-text-1);
+}
+.portal-proc__builder-addons {
+  display: flex;
+  flex-direction: column;
+  gap: 0.4rem;
+  font-size: 0.8125rem;
+  color: var(--color-text-2);
+}
+.portal-proc__builder-addons label {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+.portal-proc__builder-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.6rem;
+  margin-top: 0.5rem;
+}
+.portal-proc__quote-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  border-bottom: 1px solid var(--color-border, #eae8e3);
+  padding-bottom: 0.5rem;
+}
+.portal-proc__quote-number {
+  font-weight: 650;
+  color: var(--color-text-1);
+}
+.portal-proc__quote-valid {
+  font-size: 0.75rem;
+  color: var(--color-text-5);
+}
+.portal-proc__quote-lines {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.portal-proc__quote-lines li {
+  display: flex;
+  justify-content: space-between;
+  padding: 0.4rem 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-2);
+  border-bottom: 1px solid var(--color-border-light, #f0eee9);
+}
+.portal-proc__quote-lines li[data-kind="DISCOUNT"] {
+  color: var(--color-success, #0f7b6c);
+}
+.portal-proc__quote-total {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  padding: 0.6rem 0 0.2rem;
+  font-size: 0.9375rem;
+}
+.portal-proc__quote-total strong {
+  font-size: 1.25rem;
+  color: var(--color-text-1);
+}
+.portal-proc__quote-tcv {
+  font-size: 0.75rem;
+  color: var(--color-text-5);
+}
+
+/* ══ Quote builder — copied from the marketing prototype (tight density) ═════ */
+.portal-qb {
+  background: #ffffff;
+  border: 1px solid #e3e1dc;
+  border-radius: 14px;
+  box-shadow: inset 0 0 0 1px #eae8e3;
+  overflow: hidden;
+}
+.portal-qb__head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 18px 24px 14px;
+  border-bottom: 1px solid #f0eee9;
+  background: linear-gradient(
+    180deg,
+    rgba(35, 131, 226, 0.055) 0%,
+    transparent 100%
+  );
+}
+.portal-qb__title {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__stepchip {
+  font-size: 11px;
+  font-weight: 700;
+  color: #9b9a97;
+  background: #f5f4f1;
+  padding: 3px 10px;
+  border-radius: 999px;
+}
+.portal-qb__progress {
+  display: flex;
+  gap: 6px;
+  padding: 12px 24px 0;
+}
+.portal-qb__progress span {
+  flex: 1;
+  height: 6px;
+  border-radius: 999px;
+  background: #f0eee9;
+  transition: background 0.3s;
+}
+.portal-qb__progress span[data-on] {
+  background: #2383e2;
+}
+.portal-qb__body {
+  padding: 20px 24px;
+  max-height: 56vh;
+  overflow-y: auto;
+}
+.portal-qb__intro {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 18px;
+}
+.portal-qb__intro-icon {
+  width: 38px;
+  height: 38px;
+  border-radius: 10px;
+  background: #eaf2fb;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 18px;
+  flex-shrink: 0;
+}
+.portal-qb__intro-title {
+  font-size: 15px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__intro-sub {
+  font-size: 12.5px;
+  color: #9b9a97;
+  margin-top: 1px;
+}
+.portal-qb__field {
+  display: block;
+  margin-bottom: 18px;
+}
+.portal-qb__field-label {
+  display: block;
+  font-size: 12px;
+  font-weight: 600;
+  color: #787774;
+  margin-bottom: 6px;
+}
+.portal-qb__field input,
+.portal-qb__field select {
+  width: 100%;
+  box-sizing: border-box;
+  padding: 9px 11px;
+  font-size: 13.5px;
+  border-radius: 8px;
+  border: 1px solid #e3e1dc;
+  font-family: inherit;
+  outline: none;
+  background: #fff;
+  color: #37352f;
+}
+.portal-qb__row {
+  display: flex;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+.portal-qb__row .portal-qb__field {
+  flex: 1;
+  min-width: 190px;
+}
+.portal-qb__hint {
+  margin: 7px 0 0;
+  font-size: 11.5px;
+  color: #9b9a97;
+  line-height: 1.4;
+}
+.portal-qb__pills {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.portal-qb__pills button {
+  padding: 8px 16px;
+  font-size: 13px;
+  font-weight: 600;
+  border-radius: 8px;
+  border: 1px solid #e3e1dc;
+  background: #fff;
+  color: #37352f;
+  cursor: pointer;
+}
+.portal-qb__pills button[data-on] {
+  background: #2383e2;
+  border-color: #2383e2;
+  color: #fff;
+}
+.portal-qb__discount {
+  margin: 6px 0 0;
+  font-size: 11.5px;
+  color: #0f7b6c;
+}
+.portal-qb__opts {
+  display: flex;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+.portal-qb__opt {
+  text-align: left;
+  flex: 1;
+  min-width: 150px;
+  padding: 12px 14px;
+  border-radius: 9px;
+  border: 1px solid #e3e1dc;
+  background: #fff;
+  cursor: pointer;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+.portal-qb__opt[data-on] {
+  border-color: #2383e2;
+  background: #eaf2fb;
+}
+.portal-qb__opt-title {
+  font-size: 13px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__opt[data-on] .portal-qb__opt-title {
+  color: #1b6ec2;
+}
+.portal-qb__opt-sub {
+  font-size: 11.5px;
+  color: #9b9a97;
+  line-height: 1.4;
+}
+.portal-qb__addons {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.portal-qb__addon {
+  display: flex;
+  align-items: flex-start;
+  gap: 11px;
+  padding: 11px 13px;
+  border-radius: 9px;
+  border: 1px solid #e3e1dc;
+  background: #fff;
+  cursor: pointer;
+  text-align: left;
+}
+.portal-qb__addon[data-on] {
+  border-color: #2383e2;
+  background: #eaf2fb;
+}
+.portal-qb__addon-box {
+  width: 18px;
+  height: 18px;
+  flex-shrink: 0;
+  border-radius: 5px;
+  border: 1px solid #d3d1cb;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 12px;
+  color: transparent;
+  background: #fff;
+}
+.portal-qb__addon[data-on] .portal-qb__addon-box {
+  background: #2383e2;
+  border-color: #2383e2;
+  color: #fff;
+}
+.portal-qb__addon-title {
+  display: block;
+  font-size: 13px;
+  font-weight: 600;
+  color: #37352f;
+}
+.portal-qb__addon-sub {
+  display: block;
+  font-size: 11.5px;
+  color: #9b9a97;
+  margin-top: 1px;
+}
+.portal-qb__eula {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 12px;
+  border-radius: 9px;
+  border: 1px solid #f0eee9;
+  background: #f5f4f1;
+  font-size: 12.5px;
+  color: #37352f;
+  line-height: 1.5;
+  cursor: pointer;
+}
+.portal-qb__foot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 14px 24px;
+  border-top: 1px solid #f0eee9;
+  flex-wrap: wrap;
+}
+.portal-qb__running {
+  font-size: 11.5px;
+  color: #9b9a97;
+}
+.portal-qb__foot-btns {
+  display: flex;
+  gap: 10px;
+}
+/* Step 4 — the itemised quote paper */
+.portal-qb__papertray {
+  background: #f5f4f1;
+  padding: 18px;
+  max-height: 56vh;
+  overflow-y: auto;
+  margin: -20px -24px;
+}
+.portal-qb__paper {
+  background: #fff;
+  border: 1px solid #f0eee9;
+  border-radius: 12px;
+  overflow: hidden;
+  box-shadow: 0 1px 3px rgba(15, 23, 42, 0.06);
+}
+.portal-qb__paper-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  padding: 20px 24px;
+  border-bottom: 1px solid #f0eee9;
+}
+.portal-qb__paper-brand {
+  font-size: 13.5px;
+  font-weight: 800;
+  color: #37352f;
+}
+.portal-qb__paper-eyebrow {
+  font-size: 11px;
+  color: #9b9a97;
+}
+.portal-qb__paper-meta {
+  text-align: right;
+}
+.portal-qb__quote-number {
+  font-size: 12.5px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__paper-meta div:not(.portal-qb__quote-number) {
+  font-size: 11px;
+  color: #9b9a97;
+}
+.portal-qb__paper-for {
+  padding: 18px 24px 0;
+}
+.portal-qb__paper-company {
+  font-size: 14px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__lines {
+  list-style: none;
+  margin: 0;
+  padding: 12px 24px 0;
+}
+.portal-qb__lines li {
+  display: flex;
+  justify-content: space-between;
+  gap: 14px;
+  padding: 10px 0;
+  border-bottom: 1px solid #f0eee9;
+  font-size: 13px;
+  font-weight: 600;
+  color: #37352f;
+}
+.portal-qb__lines li[data-kind="DISCOUNT"] {
+  color: #0f7b6c;
+}
+.portal-qb__lines li[data-kind="INCLUDED"] span:last-child {
+  color: #9b9a97;
+  font-weight: 500;
+}
+.portal-qb__total {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin: 16px 24px 24px;
+  padding: 16px 18px;
+  border-radius: 10px;
+  background: #eaf2fb;
+  border: 1px solid #b8d5f2;
+}
+.portal-qb__total-label {
+  font-size: 13px;
+  font-weight: 700;
+  color: #37352f;
+}
+.portal-qb__total-tcv {
+  font-size: 11.5px;
+  color: #787774;
+  margin-top: 2px;
+}
+.portal-qb__total-num {
+  text-align: right;
+}
+.portal-qb__total-num strong {
+  display: block;
+  font-size: 23px;
+  font-weight: 800;
+  color: #37352f;
+  line-height: 1;
+}
+.portal-qb__total-num span {
+  font-size: 11px;
+  color: #9b9a97;
+  margin-top: 3px;
+}
+
+/* ── Enterprise upsell text wrapper (Home on-ramp) ────────────────────────── */
+.portal-proc__upsell-text {
+  flex: 1 1 20rem;
+}
+
+/* ── Deal-status hero (Home, active deal) ─────────────────────────────────── */
+.portal-hero {
+  border: 1px solid var(--color-border);
+  border-radius: 12px;
+  padding: 1.1rem 1.25rem;
+  background:
+    radial-gradient(
+      120% 140% at 100% 0%,
+      rgba(124, 58, 237, 0.08),
+      transparent 55%
+    ),
+    var(--color-surface);
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+.portal-hero__top {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+.portal-hero__eyebrow {
+  display: block;
+  font-size: 0.6875rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--color-primary, #2383e2);
+}
+.portal-hero__company {
+  display: block;
+  font-size: 1.0625rem;
+  font-weight: 650;
+  color: var(--color-text-1);
+  margin-top: 0.2rem;
+}
+.portal-hero__chips {
+  display: flex;
+  gap: 0.4rem;
+  flex-wrap: wrap;
+}
+.portal-hero__chip {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--color-text-3);
+  background: var(--color-border-light);
+  border-radius: 999px;
+  padding: 0.2rem 0.6rem;
+}
+.portal-hero__stepper {
+  overflow-x: auto;
+}
+.portal-hero__next {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  padding-top: 0.85rem;
+  border-top: 1px solid var(--color-border-light);
+}
+.portal-hero__next-label {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.45rem;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-2);
+}
+.portal-hero__next-dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--color-primary, #2383e2);
+  box-shadow: 0 0 0 3px rgba(35, 131, 226, 0.18);
+}
+
+/* ── Full-screen takeover modal (procurement flow) ────────────────────────── */
+.portal-procmodal {
+  position: fixed;
+  inset: 0;
+  z-index: 1000;
+  display: flex;
+  align-items: flex-start;
+  justify-content: center;
+  padding: clamp(0.5rem, 4vh, 3rem) 1rem;
+  overflow-y: auto;
+  background: rgba(15, 23, 42, 0.55);
+  backdrop-filter: blur(6px) saturate(160%);
+  -webkit-backdrop-filter: blur(6px) saturate(160%);
+  animation: portal-procmodal-fade 0.15s ease-out;
+}
+@keyframes portal-procmodal-fade {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+.portal-procmodal__panel {
+  position: relative;
+  width: 100%;
+  max-width: 62rem;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: 14px;
+  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);
+  padding: 1.5rem 1.5rem 1.75rem;
+}
+.portal-procmodal__close {
+  position: absolute;
+  top: 0.85rem;
+  right: 0.85rem;
+  border: none;
+  background: var(--color-border-light);
+  color: var(--color-text-3);
+  width: 1.9rem;
+  height: 1.9rem;
+  border-radius: 8px;
+  font-size: 0.85rem;
+  cursor: pointer;
+}
+.portal-procmodal__close:hover {
+  background: var(--color-border);
+  color: var(--color-text-1);
+}
+.portal-procmodal__header {
+  margin-bottom: 1.25rem;
+  padding-right: 2.5rem;
+}
+.portal-procmodal__title {
+  margin: 0;
+  font-size: 1.35rem;
+  font-weight: 700;
+  color: var(--color-text-1);
+}
+.portal-procmodal__sub {
+  margin: 0.3rem 0 0;
+  font-size: 0.875rem;
+  color: var(--color-text-3);
+}
+.portal-procmodal__body {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+}
+
+.portal-proc__modal-stepper {
+  overflow-x: auto;
+}
+.portal-proc__payment-actions {
+  display: flex;
+  gap: 0.6rem;
+  flex-wrap: wrap;
+  margin-top: 1rem;
+}
+.portal-proc__milestone-for {
+  margin: 0.15rem 0 0;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-2);
+}
+.portal-proc__milestone-lines {
+  margin: 0.85rem 0 0.5rem;
+}
+.portal-proc__milestone-totals {
+  display: flex;
+  align-items: baseline;
+  gap: 1rem;
+  flex-wrap: wrap;
+  margin: 0.75rem 0 0.25rem;
+}
+.portal-proc__milestone-annual {
+  font-size: 1.75rem;
+  font-weight: 700;
+  color: var(--color-text-1);
+}
+.portal-proc__milestone-annual small {
+  font-size: 0.8125rem;
+  font-weight: 500;
+  color: var(--color-text-4);
+}
+.portal-proc__milestone-tcv {
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+}
+
+/* Hero next-step action row (primary CTA + optional extend-trial). */
+.portal-hero__next-actions {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+/* Hero quick-action chips (clickable pills next to the company name). */
+.portal-hero__chip--action {
+  border: 1px solid var(--color-border);
+  cursor: pointer;
+  transition:
+    background 0.12s,
+    box-shadow 0.12s,
+    transform 0.12s;
+}
+.portal-hero__chip--action:hover {
+  background: var(--color-surface);
+  box-shadow: 0 2px 5px rgba(15, 23, 42, 0.1);
+  transform: translateY(-1px);
+}
+
+/* Hero rollout checklist (trial): the "do this now" setup steps. */
+.portal-hero__checklist {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  border-top: 1px solid var(--color-border-light);
+}
+.portal-hero__checklist li {
+  border-bottom: 1px solid var(--color-border-light);
+}
+.portal-hero__checklist button {
+  display: flex;
+  align-items: center;
+  gap: 0.85rem;
+  width: 100%;
+  padding: 0.7rem 0.25rem;
+  background: none;
+  border: none;
+  cursor: pointer;
+  text-align: left;
+}
+.portal-hero__checklist button:hover {
+  background: var(--color-bg-hover, var(--color-border-light));
+}
+.portal-hero__check-dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--color-border);
+  flex-shrink: 0;
+}
+.portal-hero__check-text {
+  flex: 1;
+  min-width: 0;
+}
+.portal-hero__check-title {
+  display: block;
+  font-size: 0.85rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+}
+.portal-hero__check-sub {
+  display: block;
+  font-size: 0.75rem;
+  color: var(--color-text-4);
+  margin-top: 0.05rem;
+}
+.portal-hero__check-pill {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--color-text-5);
+  background: var(--color-border-light);
+  border-radius: 999px;
+  padding: 0.15rem 0.55rem;
+  flex-shrink: 0;
+}
+
+/* ── Side dialogs (Key documents / Schedule a call / Trial) ───────────────── */
+.portal-sidemodal {
+  position: fixed;
+  inset: 0;
+  z-index: 1100;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 1rem;
+  overflow-y: auto;
+  background: rgba(15, 23, 42, 0.55);
+  backdrop-filter: blur(4px);
+  -webkit-backdrop-filter: blur(4px);
+  animation: portal-procmodal-fade 0.15s ease-out;
+}
+.portal-sidemodal__panel {
+  position: relative;
+  width: 100%;
+  max-width: 30rem;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: 14px;
+  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);
+  padding: 1.35rem 1.4rem 1.4rem;
+  max-height: 86vh;
+  overflow-y: auto;
+}
+.portal-sidemodal__header {
+  margin-bottom: 1rem;
+  padding-right: 2rem;
+}
+.portal-sidemodal__title {
+  margin: 0;
+  font-size: 1.05rem;
+  font-weight: 700;
+  color: var(--color-text-1);
+}
+.portal-sidemodal__sub {
+  margin: 0.25rem 0 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  line-height: 1.5;
+}
+.portal-sidemodal__text {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+  line-height: 1.55;
+}
+.portal-sidemodal__footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-top: 1.1rem;
+  padding-top: 0.9rem;
+  border-top: 1px solid var(--color-border-light);
+}
+.portal-sidemodal__ghost {
+  border: none;
+  background: none;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  cursor: pointer;
+}
+.portal-sidemodal__ghost:hover:not(:disabled) {
+  color: var(--color-text-2);
+}
+
+/* Key documents ledger. */
+.portal-docs__group + .portal-docs__group {
+  margin-top: 1rem;
+}
+.portal-docs__group-title {
+  font-size: 0.6875rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--color-text-5);
+  margin-bottom: 0.4rem;
+}
+.portal-docs__list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.portal-docs__row {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.55rem 0;
+  border-top: 1px solid var(--color-border-light);
+}
+.portal-docs__row-text {
+  flex: 1;
+  min-width: 0;
+}
+.portal-docs__row-name {
+  display: block;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+}
+.portal-docs__row-sub {
+  display: block;
+  font-size: 0.72rem;
+  color: var(--color-text-4);
+  margin-top: 0.05rem;
+}
+.portal-docs__row-action {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  border-radius: 999px;
+  padding: 0.2rem 0.6rem;
+  flex-shrink: 0;
+  color: var(--color-text-3);
+  background: var(--color-border-light);
+}
+.portal-docs__row-action[data-status="action"] {
+  color: var(--color-primary, #2383e2);
+  background: var(--color-primary-light, #eaf2fb);
+}
+.portal-docs__row-action[data-status="request"] {
+  color: var(--color-text-5);
+}
+
+/* Solutions-engineer + time slots (Schedule a call). */
+.portal-se {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin-bottom: 1rem;
+}
+.portal-se__avatar {
+  width: 2.4rem;
+  height: 2.4rem;
+  border-radius: 999px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 0.75rem;
+  font-weight: 700;
+  color: var(--color-primary, #2383e2);
+  background: var(--color-primary-light, #eaf2fb);
+  flex-shrink: 0;
+}
+.portal-se__name {
+  font-size: 0.875rem;
+  font-weight: 650;
+  color: var(--color-text-1);
+}
+.portal-se__role {
+  font-size: 0.75rem;
+  color: var(--color-text-4);
+}
+.portal-slots {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 0.5rem;
+}
+.portal-slots__slot {
+  padding: 0.6rem 0.75rem;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-2);
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: 9px;
+  cursor: pointer;
+}
+.portal-slots__slot:hover {
+  border-color: var(--color-primary, #2383e2);
+  color: var(--color-primary, #2383e2);
+}
+
+/* ── Agreement (security) step ────────────────────────────────────────────── */
+.portal-agreement__doc {
+  margin: 1rem 0;
+  max-height: 22rem;
+  overflow-y: auto;
+  padding: 1rem 1.1rem;
+  border: 1px solid var(--color-border);
+  border-radius: 10px;
+  background: var(--color-bg-subtle, var(--color-bg));
+  font-size: 0.8125rem;
+  line-height: 1.55;
+  color: var(--color-text-3);
+}
+.portal-agreement__doc h4 {
+  margin: 1rem 0 0.35rem;
+  font-size: 0.8125rem;
+  font-weight: 650;
+  color: var(--color-text-1);
+}
+.portal-agreement__doc h4:first-child {
+  margin-top: 0;
+}
+.portal-agreement__doc p {
+  margin: 0 0 0.5rem;
+}
+.portal-agreement__doc strong {
+  color: var(--color-text-1);
+}
+.portal-agreement__accept {
+  margin-top: 0.25rem;
+}
+.portal-agreement__lines {
+  margin: 0.4rem 0 0.6rem;
+}
+.portal-proc__reset {
+  display: flex;
+  justify-content: center;
+  padding-top: 0.5rem;
+}
+.portal-proc__reset button {
+  border: none;
+  background: none;
+  font-size: 0.75rem;
+  color: var(--color-text-5);
+  cursor: pointer;
+  text-decoration: underline;
+}
+.portal-proc__reset button:hover:not(:disabled) {
+  color: var(--color-text-3);
+}
+.portal-proc__reset button:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
diff --git a/frontend/editor/src/portal/views/Procurement.tsx b/frontend/editor/src/portal/views/Procurement.tsx
index f4fa25178a..1f6e2329a9 100644
--- a/frontend/editor/src/portal/views/Procurement.tsx
+++ b/frontend/editor/src/portal/views/Procurement.tsx
@@ -1,111 +1,15 @@
-import { useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Card, Skeleton, StatusBadge } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  advanceStage,
-  fetchProcurement,
-  type DealStage,
-  type LedgerDoc,
-  type ProcurementResponse,
-} from "@portal/api/procurement";
-import { DealJourney } from "@portal/components/procurement/DealJourney";
-import { DocumentLedger } from "@portal/components/procurement/DocumentLedger";
-import { ActionModal } from "@portal/components/procurement/ActionModal";
-import { LockedState } from "@portal/components/procurement/LockedState";
+import { ProcurementHome } from "@portal/components/procurement/ProcurementHome";
 import "@portal/views/Procurement.css";
 
 /**
- * Procurement: the enterprise commercial journey (trial to live) plus the
- * document ledger. Enterprise-only: free/pro buyers see a locked upgrade state.
+ * /procurement — procurement is no longer a nav tab; it lives on Home as the deal-status hero.
+ * This route is kept for deep links (and the Usage "Build your quote" CTA): it renders the same
+ * surface, opening the takeover modal once a deal is underway.
  */
 export function Procurement() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const [activeDoc, setActiveDoc] = useState<LedgerDoc | null>(null);
-  const [advancing, setAdvancing] = useState(false);
-
-  const state = useAsync<ProcurementResponse>(
-    () => fetchProcurement(tier),
-    [tier],
-  );
-
-  // Write actions return the new canonical state; we hold it here so the
-  // journey reflects every action immediately. Cleared when the tier (and so
-  // the deal) changes, falling back to whatever the GET loaded.
-  const [applied, setApplied] = useState<ProcurementResponse | null>(null);
-  useEffect(() => setApplied(null), [tier]);
-  const data = applied ?? (state.loading ? null : state.data);
-
-  async function onAdvance(stage: DealStage) {
-    setAdvancing(true);
-    try {
-      setApplied(await advanceStage(stage));
-    } finally {
-      setAdvancing(false);
-    }
-  }
-
   return (
     <div className="portal-proc">
-      <header className="portal-proc__header">
-        <div>
-          <h1 className="portal-proc__title">
-            {t("portal.procurement.title")}
-          </h1>
-          <p className="portal-proc__subtitle">
-            {t("portal.procurement.subtitle")}
-          </p>
-        </div>
-        <StatusBadge tone="purple" size="md">
-          {t("portal.procurement.enterpriseBadge")}
-        </StatusBadge>
-      </header>
-
-      {state.loading && (
-        <Card padding="loose">
-          <Skeleton width="12rem" height="1.25rem" />
-          <Skeleton height="8rem" />
-        </Card>
-      )}
-
-      {data && !data.unlocked && (
-        <LockedState
-          journey={data.journey}
-          onTalkToSales={() => {
-            // TODO(backend): POST /v1/procurement/sales-contact, for now this
-            // is the sidebar's upgrade path; hand off to the account team.
-          }}
-        />
-      )}
-
-      {data && data.unlocked && data.deal && (
-        <>
-          <DealJourney
-            deal={data.deal}
-            journey={data.journey}
-            onAdvance={onAdvance}
-            advancing={advancing}
-          />
-          <DocumentLedger
-            groups={data.ledger}
-            supporting={data.supporting}
-            journey={data.journey}
-            currentStage={data.deal.currentStage}
-            onAction={setActiveDoc}
-          />
-        </>
-      )}
-
-      <ActionModal
-        doc={activeDoc}
-        onClose={() => setActiveDoc(null)}
-        onDone={(next) => {
-          setApplied(next);
-          setActiveDoc(null);
-        }}
-      />
+      <ProcurementHome autoOpen />
     </div>
   );
 }

From be97268a7ccb24691cdf8e042a7589d8c68d5d25 Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:29:55 +0100
Subject: [PATCH 15/35] SUI - setting up mantine backed SUI components (#6890)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Converts SUI's existing Select and Slider to Mantine-backed
implementations, and adds three new Mantine-backed SUI components:
MultiSelect, NumberInput, ColorInput.

All five components follow the same contract as the rest of the SUI
catalogue:
- Imported from `@app/ui` — Mantine is an implementation detail
- Explicit prop allowlists: appearance props (color, variant, radius,
classNames, styles) are locked internally to SUI tokens; only
behavioural props are exposed
- Labels and error messages stripped from the interface — callers use
`<FormField>` for both. The components take an `invalid` flag that
applies error styling only; Mantine never renders its own message
element, so the text can't appear twice
- `aria-label` / `aria-invalid` / `aria-describedby` and `FormField`'s
injected `required` are forwarded, so the injected accessibility wiring
reaches the underlying input. Mantine drops some of this wiring
internally (`aria-describedby` on inputs, all aria props on Slider's
thumb, `required` on MultiSelect's field), so `ariaForwarding.ts`
re-applies it to the DOM node and `ariaForwarding.test.tsx` locks the
contract in
- Typed escape hatches (`comboboxProps`, `popoverProps`, `rightSection`)
documented for the z-index-in-modal use case

**Select** — rebuilt from native `<select>` to Mantine combobox. Gains
searchable/clearable. `onChange` now receives the value string directly,
not a DOM event — callers updated.

**Slider** — rebuilt from native `<input type="range">` to Mantine
Slider. Gains accessible keyboard navigation and `marks` support.

**MultiSelect, NumberInput, ColorInput** — new components. The behaviour
(multi-select combobox, number stepper, colour picker) is too complex to
hand-build correctly; Mantine provides it for free behind a locked SUI
interface.

Also wires `suiCssVariablesResolver` into the Storybook
`MantineProvider` so Mantine combobox/popover dropdowns follow the SUI
palette in dark mode, and adds `"neutral"` accent variant to
`IconBadge`.

## Usage

```tsx
import { Select, Slider, MultiSelect, NumberInput, ColorInput } from "@app/ui";
import { FormField } from "@app/ui/FormField";

// Select — onChange receives string | null, not a DOM event
<FormField label="Retention">
  <Select options={options} value={value} onChange={setValue} searchable clearable />
</FormField>

// Slider — same external API as before, now with marks support
<FormField label="Confidence">
  <Slider value={v} onChange={setV} min={0} max={1} marks={[{ value: 0.5, label: "0.5" }]} />
</FormField>

// New components
<FormField label="PII types">
  <MultiSelect data={options} value={value} onChange={setValue} searchable clearable />
</FormField>

<FormField label="Opacity">
  <NumberInput value={opacity} onChange={setOpacity} min={0} max={100} suffix="%" />
</FormField>

<FormField label="Watermark colour">
  <ColorInput value={color} onChange={setColor} />
</FormField>
```

## Notes

- **Select `onChange` is a breaking change** — receives `string | null`
instead of a DOM event. All existing callers in this repo are updated.
- The policy PR (`main` WIP) depends on this merging first.
- Stories for all five components are under **Primitives / Forms** in
Storybook.
---
 frontend/.storybook/preview.tsx               |   7 +-
 frontend/editor/src/portal/PortalApp.tsx      |  19 +-
 frontend/editor/src/portal/UI_CONVENTIONS.md  |  96 +--
 .../src/portal/components/SettingsModal.tsx   |   6 +-
 .../components/infrastructure/StorageTab.tsx  |   4 +-
 .../components/pipelines/PipelineComposer.tsx |   4 +-
 .../components/policies/PolicyFieldRow.tsx    |   2 +-
 .../components/policies/PolicySetupWizard.tsx |  17 +-
 .../components/sources/ConnectWizard.test.tsx |  15 +-
 .../components/sources/ConnectWizard.tsx      |   4 +-
 .../components/users/InviteMemberModal.tsx    |   2 +-
 .../editor/src/portal/theme/SuiProvider.tsx   |  34 ++
 .../editor/src/portal/theme/mantineTheme.ts   |  39 +-
 .../components/policies/PolicyFieldRow.tsx    |   2 +-
 .../components/policies/PolicySetupWizard.tsx |  15 +-
 .../editor/src/proprietary/ui/ColorInput.tsx  | 146 +++++
 .../src/proprietary/ui/Forms.stories.tsx      |  19 +-
 .../editor/src/proprietary/ui/IconBadge.css   |   4 +
 .../editor/src/proprietary/ui/IconBadge.tsx   |   8 +-
 .../src/proprietary/ui/MantineForms.css       | 114 ++++
 .../proprietary/ui/MantineForms.stories.tsx   | 568 ++++++++++++++++++
 .../editor/src/proprietary/ui/MultiSelect.tsx | 184 ++++++
 .../editor/src/proprietary/ui/NumberInput.tsx | 190 ++++++
 frontend/editor/src/proprietary/ui/Select.tsx | 195 ++++--
 frontend/editor/src/proprietary/ui/Slider.tsx | 150 +++--
 .../proprietary/ui/ariaForwarding.test.tsx    | 106 ++++
 .../src/proprietary/ui/ariaForwarding.ts      |  57 ++
 frontend/editor/src/proprietary/ui/index.ts   |   5 +
 28 files changed, 1811 insertions(+), 201 deletions(-)
 create mode 100644 frontend/editor/src/portal/theme/SuiProvider.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/ColorInput.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/MantineForms.css
 create mode 100644 frontend/editor/src/proprietary/ui/MantineForms.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/MultiSelect.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/NumberInput.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx
 create mode 100644 frontend/editor/src/proprietary/ui/ariaForwarding.ts

diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index dd8e379a8a..cd601cf525 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -7,7 +7,6 @@ import type { Decorator, Preview } from "@storybook/react-vite";
 import { initialize, mswLoader } from "msw-storybook-addon";
 import { MemoryRouter } from "react-router-dom";
 import { withThemeByDataAttribute } from "@storybook/addon-themes";
-import { MantineProvider } from "@mantine/core";
 
 // Reference React so the import isn't dropped as unused by the bundler — the
 // classic runtime needs it present even though it's not named in the JSX.
@@ -17,7 +16,7 @@ import { TierProvider, type Tier } from "@portal/contexts/TierContext";
 import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
 import { ThemeProvider } from "@portal/contexts/ThemeContext";
 import { UIProvider } from "@portal/contexts/UIContext";
-import { mantineTheme } from "@portal/theme/mantineTheme";
+import { SuiProvider } from "@portal/theme/SuiProvider";
 import { handlers } from "@portal/mocks/handlers";
 import { configureSupabase } from "@proprietary/auth/supabase/supabaseClient";
 
@@ -102,7 +101,7 @@ const withProviders: Decorator = (Story, context) => {
   return (
     <MemoryRouter initialEntries={["/"]}>
       <ThemeProvider>
-        <MantineProvider theme={mantineTheme} forceColorScheme={colorScheme}>
+        <SuiProvider colorScheme={colorScheme}>
           {/* LinkProvider must wrap TierProvider: TierContext derives its tier
               from useLink() (matches App.tsx's nesting). */}
           <LinkProvider key={linkState} initialState={linkState}>
@@ -115,7 +114,7 @@ const withProviders: Decorator = (Story, context) => {
               </UIProvider>
             </TierKey>
           </LinkProvider>
-        </MantineProvider>
+        </SuiProvider>
       </ThemeProvider>
     </MemoryRouter>
   );
diff --git a/frontend/editor/src/portal/PortalApp.tsx b/frontend/editor/src/portal/PortalApp.tsx
index 1494e23cdf..629a8ac57a 100644
--- a/frontend/editor/src/portal/PortalApp.tsx
+++ b/frontend/editor/src/portal/PortalApp.tsx
@@ -1,6 +1,5 @@
 import { useEffect, type ReactNode } from "react";
 import { useLocation } from "react-router-dom";
-import { MantineProvider } from "@mantine/core";
 import { AuthProvider } from "@app/auth";
 import { ErrorBoundary } from "@portal/components/ErrorBoundary";
 import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
@@ -8,7 +7,7 @@ import { TierProvider } from "@portal/contexts/TierContext";
 import { LinkProvider, useLink } from "@portal/contexts/LinkContext";
 import type { SupabaseLoginSession } from "@app/auth/ui/useSupabaseLogin";
 import { UIProvider, useUI } from "@portal/contexts/UIContext";
-import { mantineTheme } from "@portal/theme/mantineTheme";
+import { SuiProvider } from "@portal/theme/SuiProvider";
 import { AppShell } from "@portal/components/AppShell";
 import { AuthGate } from "@portal/components/AuthGate";
 import { AssistantButton } from "@portal/components/AssistantButton";
@@ -25,17 +24,13 @@ import { ViewRouter } from "@portal/ViewRouter";
 import "@portal/theme/base.css";
 
 /**
- * Binds Mantine's colour scheme to the portal's own ThemeProvider so Mantine
- * components follow the same light/dark switch as the SUI primitives. Must sit
+ * Binds the SUI design system to the portal's own ThemeProvider so the SUI
+ * components follow the same light/dark switch as the CSS tokens. Must sit
  * inside <ThemeProvider> to read useTheme().
  */
-function PortalMantineProvider({ children }: { children: ReactNode }) {
+function ThemedSuiProvider({ children }: { children: ReactNode }) {
   const { theme } = useTheme();
-  return (
-    <MantineProvider theme={mantineTheme} forceColorScheme={theme}>
-      {children}
-    </MantineProvider>
-  );
+  return <SuiProvider colorScheme={theme}>{children}</SuiProvider>;
 }
 
 /**
@@ -129,7 +124,7 @@ function RoutedContent() {
 export function PortalApp() {
   return (
     <ThemeProvider>
-      <PortalMantineProvider>
+      <ThemedSuiProvider>
         {/* Scopes base.css to the portal so it doesn't restyle the host editor. */}
         <div className="portal-scope">
           <AuthProvider mode="spring">
@@ -156,7 +151,7 @@ export function PortalApp() {
             </LinkProvider>
           </AuthProvider>
         </div>
-      </PortalMantineProvider>
+      </ThemedSuiProvider>
     </ThemeProvider>
   );
 }
diff --git a/frontend/editor/src/portal/UI_CONVENTIONS.md b/frontend/editor/src/portal/UI_CONVENTIONS.md
index 40879e2199..5487672b7b 100644
--- a/frontend/editor/src/portal/UI_CONVENTIONS.md
+++ b/frontend/editor/src/portal/UI_CONVENTIONS.md
@@ -1,19 +1,23 @@
 # Portal UI conventions — SUI vs Mantine
 
-The portal has two component sources. The rule:
+The portal has one component source from the caller's point of view: **SUI
+(`@app/ui`)**. Under the hood there are two kinds of SUI component. The rule:
 
-> **Simple, presentational, brand-defining UI → our SUI design system
-> (`@app/ui`). Complex, stateful, or accessibility-hard widgets →
-> Mantine.** Don't reinvent what Mantine already does well; do own the look of
-> the simple, high-frequency pieces.
+> **Simple, presentational, brand-defining UI → hand-rolled SUI components.
+> Complex, stateful, or accessibility-hard widgets → Mantine, wrapped behind a
+> locked SUI interface.** Either way, callers import from `@app/ui`. Mantine is
+> an implementation detail of the design system — feature code never imports
+> `@mantine/core` directly.
 
-Both are theme-bound: `MantineProvider` in `App.tsx` is wired to the portal's
-`ThemeProvider` (`mantineTheme.ts` maps the brand palette), so Mantine widgets
-follow the same light/dark switch and brand colours as SUI. **The provider is
-intentional** — it exists precisely so we can drop Mantine widgets in where they
-earn their keep.
+Theme wiring lives in one place: `SuiProvider` (`@portal/theme/SuiProvider`)
+applies the SUI-token Mantine theme, remaps Mantine's neutral palette
+(dropdown/popover surfaces, borders, text) onto SUI tokens via
+`suiCssVariablesResolver`, and takes the resolved light/dark scheme so Mantine
+chrome and the SUI CSS variables switch together. The app and Storybook both
+render through it.
+
+## Hand-rolled SUI — our own style
 
-## Use SUI (`@app/ui`) — our own style
 Layout and presentational primitives we want full brand control over and that
 are cheap to own:
 
@@ -23,40 +27,64 @@ are cheap to own:
 `Stack` / `Inline` · `Table` (static/presentational) · `CodeBlock` ·
 `FormField` (label/help/error layout) · simple `Tabs`.
 
-## Use Mantine — don't reinvent
-Anything that needs portals, focus traps, ARIA keyboard patterns, or is just a
-solved hard problem:
+## Mantine-backed SUI — don't reinvent, but do own the interface
 
-- **Overlays**: `Modal`, `Drawer`, `Popover` (focus trap, scroll lock, escape, focus restore)
-- **Menus**: `Menu` (roving arrow-key navigation)
-- **Selects**: `Select` / `MultiSelect` / `Combobox` / `Autocomplete` (keyboard + filtering)
-- **Dates**: `@mantine/dates` `DatePicker` / `DatePickerInput` (e.g. billing period range)
-- **Files**: `@mantine/dropzone` `Dropzone` (connect-source upload, op-runner sample drop)
-- **Progress UX**: `Stepper` (multi-step wizards), `Notifications`, `Tooltip`
-- Hooks: prefer `@mantine/hooks` (`useDisclosure`, `useClickOutside`, `useHotkeys`, …) over hand-rolling.
+Anything that needs portals, focus traps, ARIA keyboard patterns, or is just a
+solved hard problem gets a Mantine implementation behind a SUI wrapper.
+Shipped today: `Select` · `MultiSelect` · `NumberInput` · `ColorInput` ·
+`Slider`.
+
+Every wrapper follows the same contract (use the existing ones as the
+template):
+
+- **Explicit prop allowlist.** Only behavioural props are exposed; appearance
+  props (`color`, `variant`, `radius`, `classNames`, `styles`) are locked
+  internally to SUI tokens.
+- **No labels or error text.** Callers use `<FormField>` for both. Wrappers
+  take an `invalid` flag that applies error styling only; Mantine never
+  renders its own message element.
+- **Accessibility props forwarded.** `id`, `aria-label`, `aria-invalid`, and
+  `aria-describedby` pass through so `FormField`'s injected wiring reaches the
+  underlying input.
+- **Typed escape hatches** (`comboboxProps`, `popoverProps`, `rightSection`)
+  for the z-index-in-modal case, documented on the component.
+
+When a feature needs a Mantine widget that has no wrapper yet (`Modal`,
+`Drawer`, `Menu`, `Stepper`, `Tooltip`, `@mantine/dates`,
+`@mantine/dropzone`, …), add the wrapper to `@app/ui` following this contract
+rather than importing Mantine in feature code. Hooks are the exception:
+prefer `@mantine/hooks` (`useDisclosure`, `useClickOutside`, `useHotkeys`, …)
+over hand-rolling, imported directly.
 
 ## Why
+
 Mantine is mature and battle-tested for accessibility. A review of the
 hand-rolled SUI overlays found real gaps — `Dropdown` has no arrow-key
 navigation, `Modal`/`Drawer` mishandle focus when there are no focusable
 children, `Toast` uses `role="alert"` for every tone — exactly the things
 Mantine gets right. Owning those is wasted effort and an a11y liability.
 
-## Known migrations (hand-rolled today → should be Mantine)
-These shipped as SUI primitives during the initial build and should move to
-Mantine equivalents (fixes the a11y findings above):
+The wrapper (rather than direct Mantine use) is what keeps the door open to
+swapping the implementation later: callers depend on the SUI contract, not on
+Mantine's API surface.
 
-| Today (SUI) | → Mantine |
-|---|---|
-| `Dropdown` (menus: tier switcher, app switcher, notifications) | `Menu` |
-| `Modal` (composer, wizards, settings, create-key) | `Modal` |
-| `Drawer` (pipeline detail) | `Drawer` |
-| `Toast` | `notifications` |
-| _new need:_ billing date range | `@mantine/dates` |
-| _new need:_ file upload | `@mantine/dropzone` |
+## Known migrations (hand-rolled today → Mantine-backed SUI)
 
-Keep `Tabs` SUI for the simple in-page switchers; only reach for more if a true
-tabpanel/roving-focus contract is needed.
+These shipped as hand-rolled primitives during the initial build and should
+move to Mantine-backed wrappers (fixes the a11y findings above). `Select` and
+`Slider` have already made this move.
+
+| Today (hand-rolled)                                            | → Mantine-backed SUI wrapper |
+| -------------------------------------------------------------- | ---------------------------- |
+| `Dropdown` (menus: tier switcher, app switcher, notifications)  | wraps `Menu`                 |
+| `Modal` (composer, wizards, settings, create-key)               | wraps `Modal`                |
+| `Drawer` (pipeline detail)                                      | wraps `Drawer`               |
+| `Toast`                                                         | wraps `notifications`        |
+| _new need:_ billing date range                                  | wraps `@mantine/dates`       |
+| _new need:_ file upload                                         | wraps `@mantine/dropzone`    |
+
+Keep `Tabs` hand-rolled for the simple in-page switchers; only reach for more
+if a true tabpanel/roving-focus contract is needed.
 
 > Migrating overlays touches visible chrome and behaviour, so do it deliberately
 > (with eyes on the result), not as a blind sweep.
diff --git a/frontend/editor/src/portal/components/SettingsModal.tsx b/frontend/editor/src/portal/components/SettingsModal.tsx
index aa01c2ba0e..c6a40f3389 100644
--- a/frontend/editor/src/portal/components/SettingsModal.tsx
+++ b/frontend/editor/src/portal/components/SettingsModal.tsx
@@ -612,7 +612,7 @@ function WorkspacePanel({
       >
         <Select
           value={region}
-          onChange={(e) => onRegion(e.target.value)}
+          onChange={(value) => onRegion(value ?? "")}
           options={regionOptions}
         />
       </FormField>
@@ -750,8 +750,8 @@ function AuthenticationPanel({
         >
           <Select
             value={String(security.sessionTimeoutMins)}
-            onChange={(e) =>
-              onSecurity({ sessionTimeoutMins: Number(e.target.value) })
+            onChange={(value) =>
+              onSecurity({ sessionTimeoutMins: Number(value ?? "0") })
             }
             options={SESSION_TIMEOUT_VALUES.map((value) => ({
               value,
diff --git a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
index 5f944465d8..7b2ecaa441 100644
--- a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
@@ -186,7 +186,9 @@ export function StorageTab() {
             <Select
               options={RETENTION_OPTS}
               value={retentionValue}
-              onChange={(e) => setRetention(e.target.value as RetentionWindow)}
+              onChange={(value) =>
+                setRetention((value ?? "") as RetentionWindow)
+              }
             />
           </FormField>
 
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx b/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
index 1d35e8d0f7..5040a97ac0 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
@@ -362,8 +362,8 @@ export function PipelineComposer({
               <Select
                 inputSize="sm"
                 value={scheduleUnit}
-                onChange={(e) =>
-                  setScheduleUnit(e.target.value as ScheduleUnit)
+                onChange={(value) =>
+                  setScheduleUnit((value ?? "") as ScheduleUnit)
                 }
                 options={SCHEDULE_UNITS.map((unit) => ({
                   value: unit,
diff --git a/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx b/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
index cb1893cc66..4024cce5e3 100644
--- a/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
@@ -64,7 +64,7 @@ export function PolicyFieldRow({
           inputSize="sm"
           value={typeof value === "string" ? value : ""}
           options={(field.options ?? []).map((o) => ({ value: o, label: o }))}
-          onChange={(e) => onChange(e.target.value)}
+          onChange={(value) => onChange(value ?? "")}
         />
       </FormField>
     );
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 30b1d05403..96a9d377f2 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -453,8 +453,8 @@ function PolicySetupWizardBody({
                   <Select
                     inputSize="sm"
                     value={runOn}
-                    onChange={(e) =>
-                      setRunOn(e.target.value as "upload" | "export")
+                    onChange={(value) =>
+                      setRunOn((value ?? "upload") as "upload" | "export")
                     }
                     options={[
                       {
@@ -474,8 +474,10 @@ function PolicySetupWizardBody({
                   <Select
                     inputSize="sm"
                     value={outputMode}
-                    onChange={(e) => {
-                      const mode = e.target.value as "new_file" | "new_version";
+                    onChange={(value) => {
+                      const mode = (value ?? "new_file") as
+                        | "new_file"
+                        | "new_version";
                       setOutputMode(mode);
                       // Auto-number only applies to separate new files.
                       if (
@@ -508,9 +510,12 @@ function PolicySetupWizardBody({
                     <Select
                       inputSize="sm"
                       value={outputNamePosition}
-                      onChange={(e) =>
+                      onChange={(value) =>
                         setOutputNamePosition(
-                          e.target.value as "prefix" | "suffix" | "auto-number",
+                          (value ?? "suffix") as
+                            | "prefix"
+                            | "suffix"
+                            | "auto-number",
                         )
                       }
                       options={[
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
index c6874effcd..d354da1d40 100644
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
@@ -1,8 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
 import { HttpError } from "@portal/api/http";
 import { ConnectWizard } from "@portal/components/sources/ConnectWizard";
 
+function renderWithMantine(ui: React.ReactElement) {
+  return render(<MantineProvider>{ui}</MantineProvider>);
+}
+
 // Deterministic i18n: keys come back verbatim so the test never waits on the
 // async TOML backend.
 vi.mock("react-i18next", () => ({
@@ -41,7 +46,9 @@ describe("ConnectWizard", () => {
     const onCreated = vi.fn();
     const onClose = vi.fn();
 
-    render(<ConnectWizard open onClose={onClose} onCreated={onCreated} />);
+    renderWithMantine(
+      <ConnectWizard open onClose={onClose} onCreated={onCreated} />,
+    );
 
     stepToReview();
 
@@ -66,7 +73,7 @@ describe("ConnectWizard", () => {
     createSource.mockResolvedValue({ id: "s1" });
     const onCreated = vi.fn();
 
-    render(
+    renderWithMantine(
       <ConnectWizard
         open
         source={{
@@ -113,7 +120,9 @@ describe("ConnectWizard", () => {
       }),
     );
 
-    render(<ConnectWizard open onClose={vi.fn()} onCreated={vi.fn()} />);
+    renderWithMantine(
+      <ConnectWizard open onClose={vi.fn()} onCreated={vi.fn()} />,
+    );
 
     stepToReview();
     fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
index 8683873316..2c6e9263b7 100644
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
@@ -245,8 +245,8 @@ export function ConnectWizard({
                     value: o.value,
                     label: t(o.labelKey),
                   }))}
-                  onChange={(e) =>
-                    setOptions((o) => ({ ...o, [field.key]: e.target.value }))
+                  onChange={(value) =>
+                    setOptions((o) => ({ ...o, [field.key]: value ?? "" }))
                   }
                 />
               ) : (
diff --git a/frontend/editor/src/portal/components/users/InviteMemberModal.tsx b/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
index 5031b6427c..ad98077ba4 100644
--- a/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
+++ b/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
@@ -91,7 +91,7 @@ export function InviteMemberModal({ open, onClose }: InviteMemberModalProps) {
           <Select
             options={ROLE_SELECT_OPTIONS}
             value={role}
-            onChange={(e) => setRole(e.target.value as RoleId)}
+            onChange={(value) => setRole((value ?? "") as RoleId)}
           />
         </FormField>
       </div>
diff --git a/frontend/editor/src/portal/theme/SuiProvider.tsx b/frontend/editor/src/portal/theme/SuiProvider.tsx
new file mode 100644
index 0000000000..3af449d0e1
--- /dev/null
+++ b/frontend/editor/src/portal/theme/SuiProvider.tsx
@@ -0,0 +1,34 @@
+import type { ReactNode } from "react";
+import { MantineProvider } from "@mantine/core";
+import {
+  mantineTheme,
+  suiCssVariablesResolver,
+} from "@portal/theme/mantineTheme";
+
+export interface SuiProviderProps {
+  /**
+   * Resolved colour scheme. Must match whatever drives [data-theme] so the
+   * Mantine chrome and the SUI CSS tokens switch together.
+   */
+  colorScheme: "light" | "dark";
+  children: ReactNode;
+}
+
+/**
+ * Sets up the SUI design system for a subtree. Mantine is an implementation
+ * detail of the SUI components (@app/ui); this provider applies the SUI-token
+ * theme and remaps Mantine's neutral palette (dropdown/popover surfaces,
+ * borders, text) onto SUI tokens so floating elements follow the SUI palette
+ * in both colour schemes.
+ */
+export function SuiProvider({ colorScheme, children }: SuiProviderProps) {
+  return (
+    <MantineProvider
+      theme={mantineTheme}
+      cssVariablesResolver={suiCssVariablesResolver}
+      forceColorScheme={colorScheme}
+    >
+      {children}
+    </MantineProvider>
+  );
+}
diff --git a/frontend/editor/src/portal/theme/mantineTheme.ts b/frontend/editor/src/portal/theme/mantineTheme.ts
index fa8e6d5297..01953245f9 100644
--- a/frontend/editor/src/portal/theme/mantineTheme.ts
+++ b/frontend/editor/src/portal/theme/mantineTheme.ts
@@ -1,4 +1,8 @@
-import { createTheme, type MantineColorsTuple } from "@mantine/core";
+import {
+  createTheme,
+  type CSSVariablesResolver,
+  type MantineColorsTuple,
+} from "@mantine/core";
 
 /**
  * Mantine theme for the portal, bound to the SUI design tokens in
@@ -69,6 +73,39 @@ const purple = tuple(
   "--color-purple-dark",
 );
 
+/**
+ * Maps Mantine's neutral CSS variables to SUI tokens so dropdowns, popovers,
+ * and other floating elements follow the SUI surface/border/text palette rather
+ * than Mantine's default white/gray-* / dark-* scale.
+ *
+ * SuiProvider syncs Mantine's color scheme to SUI's light/dark toggle
+ * (forceColorScheme), so the light/dark buckets here align with
+ * [data-theme="light/dark"] and the SUI token values are correct.
+ */
+export const suiCssVariablesResolver: CSSVariablesResolver = () => ({
+  variables: {
+    "--mantine-color-text": "var(--color-text-1)",
+    "--mantine-color-placeholder": "var(--color-text-placeholder)",
+    "--mantine-color-body": "var(--color-bg)",
+  },
+  light: {
+    // Popover/dropdown background + combobox search input
+    "--mantine-color-white": "var(--color-surface)",
+    // Option hover background
+    "--mantine-color-gray-0": "var(--color-bg-hover)",
+    // Dropdown border
+    "--mantine-color-gray-2": "var(--color-border)",
+  },
+  dark: {
+    // Popover/dropdown background (dark-6 is the floating surface in dark mode)
+    "--mantine-color-dark-6": "var(--color-surface)",
+    // Deeper background used for option hover + combobox search input
+    "--mantine-color-dark-7": "var(--color-bg)",
+    // Border in dark mode
+    "--mantine-color-dark-4": "var(--color-border)",
+  },
+});
+
 export const mantineTheme = createTheme({
   primaryColor: "blue",
   // Mantine uses index 6 of the tuple for filled components by default, which
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx b/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
index 2559a0e522..4049533290 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
@@ -81,7 +81,7 @@ export function PolicyFieldRow({
           label: t(`policies.fieldOption.${field.key}.${o}`, o),
         }))}
         value={typeof value === "string" ? value : ""}
-        onChange={(e) => onChange(e.target.value)}
+        onChange={(value) => onChange(value ?? "")}
         aria-label={fieldLabel}
       />
     ) : (
diff --git a/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
index e63ee4e61f..abd1f6d8df 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
@@ -409,8 +409,8 @@ export function PolicySetupWizard({
                     <Select
                       inputSize="sm"
                       value={runOn}
-                      onChange={(e) =>
-                        setRunOn(e.target.value as "upload" | "export")
+                      onChange={(value) =>
+                        setRunOn((value ?? "upload") as "upload" | "export")
                       }
                       aria-label={t("policies.wizard.runOnLabel", "Run on")}
                       options={[
@@ -437,8 +437,8 @@ export function PolicySetupWizard({
                     <Select
                       inputSize="sm"
                       value={outputMode}
-                      onChange={(e) => {
-                        const mode = e.target.value as
+                      onChange={(value) => {
+                        const mode = (value ?? "new_file") as
                           | "new_file"
                           | "new_version";
                         setOutputMode(mode);
@@ -481,9 +481,12 @@ export function PolicySetupWizard({
                   <Select
                     inputSize="sm"
                     value={outputNamePosition}
-                    onChange={(e) =>
+                    onChange={(value) =>
                       setOutputNamePosition(
-                        e.target.value as "prefix" | "suffix" | "auto-number",
+                        (value ?? "suffix") as
+                          | "prefix"
+                          | "suffix"
+                          | "auto-number",
                       )
                     }
                     aria-label={t(
diff --git a/frontend/editor/src/proprietary/ui/ColorInput.tsx b/frontend/editor/src/proprietary/ui/ColorInput.tsx
new file mode 100644
index 0000000000..6063ecf688
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/ColorInput.tsx
@@ -0,0 +1,146 @@
+import type React from "react";
+import {
+  ColorInput as MantineColorInput,
+  type ColorInputProps as MantineColorInputProps,
+} from "@mantine/core";
+import { useInputAria } from "@app/ui/ariaForwarding";
+import "@app/ui/MantineForms.css";
+
+const SUI_INPUT_VARS = {
+  "--input-bg": "var(--color-surface)",
+  "--input-bd": "var(--color-border-input)",
+  "--input-bd-focus": "var(--color-blue)",
+  "--input-radius": "var(--radius-md)",
+  "--input-color": "var(--color-text-1)",
+  "--input-placeholder-color": "var(--color-text-placeholder)",
+  "--input-height-sm": "1.75rem",
+  "--input-height-md": "2.25rem",
+} as React.CSSProperties;
+
+export type ColorInputSize = "sm" | "md";
+
+export interface ColorInputProps {
+  // Value
+  value?: string;
+  onChange?: (value: string) => void;
+  defaultValue?: string;
+
+  // Behaviour
+  format?: "hex" | "hexa" | "rgb" | "rgba" | "hsl" | "hsla";
+  swatches?: string[];
+  swatchesPerRow?: number;
+  withPicker?: boolean;
+
+  // Popover escape hatch — only for zIndex / offset overrides in modals
+  popoverProps?: MantineColorInputProps["popoverProps"];
+
+  // Form
+  placeholder?: string;
+  id?: string;
+  name?: string;
+  "aria-label"?: string;
+  "aria-invalid"?: boolean;
+  "aria-describedby"?: string;
+  required?: boolean;
+  disabled?: boolean;
+  readOnly?: boolean;
+  onFocus?: React.FocusEventHandler<HTMLInputElement>;
+  onBlur?: React.FocusEventHandler<HTMLInputElement>;
+
+  // SUI — invalid applies error styling; FormField renders the message itself.
+  inputSize?: ColorInputSize;
+  invalid?: boolean;
+}
+
+type PassthroughProps = Omit<
+  Pick<
+    MantineColorInputProps,
+    | "value"
+    | "onChange"
+    | "defaultValue"
+    | "format"
+    | "swatches"
+    | "swatchesPerRow"
+    | "withPicker"
+    | "popoverProps"
+    | "placeholder"
+    | "id"
+    | "name"
+    | "aria-label"
+    | "aria-describedby"
+    | "required"
+    | "disabled"
+    | "readOnly"
+    | "onFocus"
+    | "onBlur"
+  >,
+  never
+>;
+
+/**
+ * SUI colour picker input with swatch preview and popover picker. Use with
+ * <FormField> for labels and error display. Appearance is locked to SUI tokens.
+ *
+ * Defaults to hex format. Pass `popoverProps={{ withinPortal: true, zIndex: Z }}` when
+ * rendering inside a modal.
+ */
+export function ColorInput({
+  inputSize = "md",
+  invalid,
+  format = "hex",
+  value,
+  onChange,
+  defaultValue,
+  swatches,
+  swatchesPerRow,
+  withPicker,
+  popoverProps,
+  placeholder,
+  id,
+  name,
+  "aria-label": ariaLabel,
+  "aria-invalid": ariaInvalid,
+  "aria-describedby": ariaDescribedBy,
+  required,
+  disabled,
+  readOnly,
+  onFocus,
+  onBlur,
+}: ColorInputProps) {
+  const inputRef = useInputAria({ describedBy: ariaDescribedBy });
+  const passthroughProps: PassthroughProps = {
+    value,
+    onChange,
+    defaultValue,
+    format,
+    swatches,
+    swatchesPerRow,
+    withPicker,
+    popoverProps,
+    placeholder,
+    id,
+    name,
+    "aria-label": ariaLabel,
+    "aria-describedby": ariaDescribedBy,
+    required,
+    disabled,
+    readOnly,
+    onFocus,
+    onBlur,
+  };
+
+  return (
+    <MantineColorInput
+      size={inputSize}
+      // Boolean error applies invalid styling without rendering Mantine's own
+      // message element — FormField owns the visible error text.
+      error={invalid || ariaInvalid || undefined}
+      // required sets the input attribute only; FormField renders the asterisk.
+      withAsterisk={false}
+      ref={inputRef}
+      classNames={{ wrapper: "sui-mantine-wrapper" }}
+      styles={{ wrapper: SUI_INPUT_VARS }}
+      {...passthroughProps}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/Forms.stories.tsx b/frontend/editor/src/proprietary/ui/Forms.stories.tsx
index 10f4e0b1c3..0d14cf3392 100644
--- a/frontend/editor/src/proprietary/ui/Forms.stories.tsx
+++ b/frontend/editor/src/proprietary/ui/Forms.stories.tsx
@@ -73,23 +73,6 @@ export const Input_Error: Story = {
   ),
 };
 
-export const Select_Default: Story = {
-  render: () => (
-    <FormField label="Retention period">
-      <Select
-        defaultValue="90"
-        options={[
-          { value: "30", label: "30 days" },
-          { value: "60", label: "60 days" },
-          { value: "90", label: "90 days (default)" },
-          { value: "180", label: "180 days" },
-          { value: "never", label: "Never expire" },
-        ]}
-      />
-    </FormField>
-  ),
-};
-
 export const Checkbox_Single: Story = {
   render: () => (
     <Stack gap="2">
@@ -251,7 +234,7 @@ export const FullForm: Story = {
           <FormField label="Retention">
             <Select
               value={retention}
-              onChange={(e) => setRetention(e.target.value)}
+              onChange={(value) => setRetention(value ?? "90")}
               options={[
                 { value: "30", label: "30 days" },
                 { value: "90", label: "90 days" },
diff --git a/frontend/editor/src/proprietary/ui/IconBadge.css b/frontend/editor/src/proprietary/ui/IconBadge.css
index 10e2d28915..43d4eb0af9 100644
--- a/frontend/editor/src/proprietary/ui/IconBadge.css
+++ b/frontend/editor/src/proprietary/ui/IconBadge.css
@@ -34,3 +34,7 @@
 .sui-iconbadge--red {
   --ib-base: var(--color-red);
 }
+.sui-iconbadge--neutral {
+  --ib-base: var(--color-text-1);
+  background: none;
+}
diff --git a/frontend/editor/src/proprietary/ui/IconBadge.tsx b/frontend/editor/src/proprietary/ui/IconBadge.tsx
index 9b421d47c5..ae6c5536d1 100644
--- a/frontend/editor/src/proprietary/ui/IconBadge.tsx
+++ b/frontend/editor/src/proprietary/ui/IconBadge.tsx
@@ -1,7 +1,13 @@
 import type { ReactNode } from "react";
 import "@app/ui/IconBadge.css";
 
-export type IconBadgeAccent = "blue" | "purple" | "green" | "amber" | "red";
+export type IconBadgeAccent =
+  | "blue"
+  | "purple"
+  | "green"
+  | "amber"
+  | "red"
+  | "neutral";
 
 export interface IconBadgeProps {
   children: ReactNode;
diff --git a/frontend/editor/src/proprietary/ui/MantineForms.css b/frontend/editor/src/proprietary/ui/MantineForms.css
new file mode 100644
index 0000000000..66551aedf5
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/MantineForms.css
@@ -0,0 +1,114 @@
+/* ===================================================================
+ * MantineForms.css — SUI design tokens injected into Mantine inputs
+ *
+ * Applied via classNames.wrapper="sui-mantine-wrapper" on each
+ * Mantine-backed SUI component (MultiSelect, NumberInput, ColorInput).
+ * The inline `styles.wrapper` in each component sets the base CSS
+ * variables; this file adds focus ring + pill styling that require
+ * CSS pseudo-selectors or attribute selectors.
+ * =================================================================== */
+
+/* CSS custom properties for Mantine's input system, mapped to SUI tokens.
+ * These are also set as inline styles (higher specificity); the declarations
+ * here act as a typed reference and as a fallback for any slot Mantine reads
+ * before the inline vars are applied. */
+.sui-mantine-wrapper {
+  --input-bg: var(--color-surface);
+  --input-bd: var(--color-border-input);
+  --input-bd-focus: var(--color-blue);
+  --input-radius: var(--radius-md);
+  --input-color: var(--color-text-1);
+  --input-placeholder-color: var(--color-text-placeholder);
+  --input-height-sm: 1.75rem;
+  --input-height-md: 2.25rem;
+  font-size: 0.875rem;
+}
+
+/* SUI focus ring — matches .sui-input:focus-within */
+.sui-mantine-wrapper[data-focused],
+.sui-mantine-wrapper:focus-within {
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+}
+
+/* Error state */
+.sui-mantine-wrapper[data-invalid] {
+  --input-bd: var(--color-red);
+  --input-bd-focus: var(--color-red);
+}
+
+.sui-mantine-wrapper[data-invalid][data-focused],
+.sui-mantine-wrapper[data-invalid]:focus-within {
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-red) 16%, transparent);
+}
+
+/* Disabled state */
+.sui-mantine-wrapper[data-disabled] {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+/* ---- MultiSelect pills ---- */
+/* Pills match SUI's Chip component: small rounded tags. */
+.sui-mantine-pill {
+  background: var(--color-blue-light) !important;
+  color: var(--color-blue-dark) !important;
+  border: 1px solid var(--color-blue-border) !important;
+  border-radius: var(--radius-sm) !important;
+  font-size: 0.75rem !important;
+  font-weight: 500 !important;
+}
+
+/* Pills list needs a min-height to not collapse when empty */
+.sui-mantine-pills-list {
+  min-height: var(--input-height-sm, 1.75rem);
+}
+
+/* ---- NumberInput controls (increment/decrement buttons) ---- */
+.sui-mantine-control {
+  border-color: var(--color-border-input) !important;
+  color: var(--color-text-3) !important;
+}
+
+.sui-mantine-control:hover {
+  background: var(--color-bg-hover) !important;
+  color: var(--color-text-1) !important;
+}
+
+/* ---- Select: hide Mantine's right-section clear button border ---- */
+.sui-mantine-wrapper .mantine-Select-section {
+  color: var(--color-text-3);
+}
+
+/* ---- Slider ---- */
+.sui-mantine-slider {
+  --slider-color: var(--color-blue);
+  --slider-track-bg: var(--color-border);
+  --slider-thumb-color: var(--color-surface);
+  --slider-thumb-bd: var(--color-blue);
+}
+
+.sui-mantine-slider:focus-within {
+  outline: none;
+}
+
+/* Thumb focus ring matches SUI */
+.sui-mantine-slider .mantine-Slider-thumb:focus-visible {
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+  outline: none;
+}
+
+/* Mark labels use SUI text tokens */
+.sui-mantine-slider .mantine-Slider-markLabel {
+  color: var(--color-text-3);
+  font-size: 0.75rem;
+}
+
+/* ---- Dark mode: Mantine's own dark-mode vars beat ours when Mantine's
+ * color-scheme is "dark". Reassert SUI tokens so the two systems stay in sync.
+ * SuiProvider syncs forceColorScheme to SUI theme, so
+ * [data-mantine-color-scheme="dark"] === [data-theme="dark"] in practice. ---- */
+[data-mantine-color-scheme="dark"] .sui-mantine-wrapper {
+  --input-bg: var(--color-surface);
+  --input-bd: var(--color-border-input);
+  --input-color: var(--color-text-1);
+}
diff --git a/frontend/editor/src/proprietary/ui/MantineForms.stories.tsx b/frontend/editor/src/proprietary/ui/MantineForms.stories.tsx
new file mode 100644
index 0000000000..dfa40644dd
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/MantineForms.stories.tsx
@@ -0,0 +1,568 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FormField } from "@app/ui/FormField";
+import { Stack } from "@app/ui/Stack";
+import { MultiSelect } from "@app/ui/MultiSelect";
+import { NumberInput } from "@app/ui/NumberInput";
+import { ColorInput } from "@app/ui/ColorInput";
+import { Select } from "@app/ui/Select";
+import { Slider } from "@app/ui/Slider";
+
+const PII_OPTIONS = [
+  { value: "ssn", label: "Social Security Number" },
+  { value: "dob", label: "Date of Birth" },
+  { value: "account", label: "Account Number" },
+  { value: "email", label: "Email Address" },
+  { value: "phone", label: "Phone Number" },
+  { value: "address", label: "Postal Address" },
+  { value: "passport", label: "Passport Number" },
+  { value: "license", label: "Driver's License" },
+];
+
+const meta: Meta = {
+  title: "Primitives/Forms",
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ width: "28rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj;
+
+// ─── MultiSelect ─────────────────────────────────────────────────────────────
+
+export const MultiSelect_Default: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<string[]>([]);
+      return (
+        <FormField
+          label="PII field types"
+          helperText="Select all entity types to detect."
+        >
+          <MultiSelect
+            data={PII_OPTIONS}
+            value={value}
+            onChange={setValue}
+            placeholder="Choose types…"
+            clearable
+            searchable
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const MultiSelect_WithValues: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState(["ssn", "dob", "email"]);
+      return (
+        <FormField label="PII field types">
+          <MultiSelect
+            data={PII_OPTIONS}
+            value={value}
+            onChange={setValue}
+            clearable
+            searchable
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const MultiSelect_SmSize: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState(["ssn", "email"]);
+      return (
+        <FormField label="Fields">
+          <MultiSelect
+            data={PII_OPTIONS}
+            value={value}
+            onChange={setValue}
+            inputSize="sm"
+            clearable
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const MultiSelect_Error: Story = {
+  render: () => (
+    <FormField
+      label="PII field types"
+      error="At least one field type is required."
+      required
+    >
+      <MultiSelect
+        data={PII_OPTIONS}
+        value={[]}
+        onChange={() => {}}
+        placeholder="Choose types…"
+        invalid
+      />
+    </FormField>
+  ),
+};
+
+export const MultiSelect_Disabled: Story = {
+  render: () => (
+    <FormField label="PII field types">
+      <MultiSelect
+        data={PII_OPTIONS}
+        value={["ssn", "dob"]}
+        onChange={() => {}}
+        disabled
+      />
+    </FormField>
+  ),
+};
+
+// ─── NumberInput ─────────────────────────────────────────────────────────────
+
+export const NumberInput_Default: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<number | string>(100);
+      return (
+        <FormField label="Max pages" helperText="Maximum pages per run.">
+          <NumberInput
+            value={value}
+            onChange={setValue}
+            min={1}
+            max={10000}
+            step={1}
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const NumberInput_Decimal: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<number | string>(0.85);
+      return (
+        <FormField
+          label="Confidence threshold"
+          helperText="Documents below this score route to the review queue."
+        >
+          <NumberInput
+            value={value}
+            onChange={setValue}
+            min={0}
+            max={1}
+            step={0.01}
+            decimalScale={2}
+            fixedDecimalScale
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const NumberInput_WithUnit: Story = {
+  render: () => {
+    function Bound() {
+      const [opacity, setOpacity] = useState<number | string>(80);
+      const [fontSize, setFontSize] = useState<number | string>(24);
+      return (
+        <Stack gap="4">
+          <FormField label="Watermark opacity">
+            <NumberInput
+              value={opacity}
+              onChange={setOpacity}
+              min={0}
+              max={100}
+              step={5}
+              suffix="%"
+            />
+          </FormField>
+          <FormField label="Font size">
+            <NumberInput
+              value={fontSize}
+              onChange={setFontSize}
+              min={6}
+              max={200}
+              step={1}
+              suffix=" pt"
+            />
+          </FormField>
+        </Stack>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const NumberInput_SmSize: Story = {
+  render: () => {
+    function Bound() {
+      const [v, setV] = useState<number | string>(12);
+      return (
+        <FormField label="Rotation">
+          <NumberInput
+            value={v}
+            onChange={setV}
+            min={-360}
+            max={360}
+            step={1}
+            suffix="°"
+            inputSize="sm"
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const NumberInput_Error: Story = {
+  render: () => (
+    <FormField label="Max pages" error="Must be between 1 and 10 000." required>
+      <NumberInput value={-5} onChange={() => {}} invalid />
+    </FormField>
+  ),
+};
+
+export const NumberInput_Disabled: Story = {
+  render: () => (
+    <FormField label="Max pages">
+      <NumberInput value={100} onChange={() => {}} disabled />
+    </FormField>
+  ),
+};
+
+// ─── ColorInput ──────────────────────────────────────────────────────────────
+
+export const ColorInput_Default: Story = {
+  render: () => {
+    function Bound() {
+      const [color, setColor] = useState("");
+      return (
+        <FormField
+          label="Watermark color"
+          helperText="Pick a hex colour for the overlay text."
+        >
+          <ColorInput value={color} onChange={setColor} placeholder="#000000" />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const ColorInput_Preselected: Story = {
+  render: () => {
+    function Bound() {
+      const [color, setColor] = useState("#3B82F6");
+      return (
+        <FormField label="Accent color">
+          <ColorInput value={color} onChange={setColor} />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const ColorInput_SmSize: Story = {
+  render: () => {
+    function Bound() {
+      const [color, setColor] = useState("#EF4444");
+      return (
+        <FormField label="Badge color">
+          <ColorInput value={color} onChange={setColor} inputSize="sm" />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const ColorInput_Error: Story = {
+  render: () => (
+    <FormField
+      label="Watermark color"
+      error="Enter a valid hex colour."
+      required
+    >
+      <ColorInput value="not-a-color" onChange={() => {}} invalid />
+    </FormField>
+  ),
+};
+
+export const ColorInput_Disabled: Story = {
+  render: () => (
+    <FormField label="Watermark color">
+      <ColorInput value="#3B82F6" onChange={() => {}} disabled />
+    </FormField>
+  ),
+};
+
+// ─── Select ──────────────────────────────────────────────────────────────────
+
+const RETENTION_OPTIONS = [
+  { value: "30", label: "30 days" },
+  { value: "60", label: "60 days" },
+  { value: "90", label: "90 days (default)" },
+  { value: "180", label: "180 days" },
+  { value: "never", label: "Never expire" },
+];
+
+export const Select_Default: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<string | null>("90");
+      return (
+        <FormField label="Retention period">
+          <Select
+            options={RETENTION_OPTIONS}
+            value={value}
+            onChange={setValue}
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Select_Searchable: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<string | null>(null);
+      return (
+        <FormField label="Output format" helperText="Start typing to filter.">
+          <Select
+            options={[
+              { value: "pdf", label: "PDF" },
+              { value: "pdfa", label: "PDF/A (archival)" },
+              { value: "pdfa2", label: "PDF/A-2 (archival)" },
+              { value: "pdfua", label: "PDF/UA (accessible)" },
+              { value: "docx", label: "Word document (.docx)" },
+              { value: "xlsx", label: "Spreadsheet (.xlsx)" },
+              { value: "txt", label: "Plain text (.txt)" },
+            ]}
+            value={value}
+            onChange={setValue}
+            placeholder="Choose format…"
+            searchable
+            clearable
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Select_SmSize: Story = {
+  render: () => {
+    function Bound() {
+      const [value, setValue] = useState<string | null>("upload");
+      return (
+        <FormField label="Run on">
+          <Select
+            options={[
+              { value: "upload", label: "Upload" },
+              { value: "export", label: "Export" },
+            ]}
+            value={value}
+            onChange={setValue}
+            inputSize="sm"
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Select_Error: Story = {
+  render: () => (
+    <FormField
+      label="Retention period"
+      error="A retention period is required."
+      required
+    >
+      <Select
+        options={RETENTION_OPTIONS}
+        value={null}
+        onChange={() => {}}
+        placeholder="Choose…"
+        invalid
+      />
+    </FormField>
+  ),
+};
+
+export const Select_Disabled: Story = {
+  render: () => (
+    <FormField label="Retention period">
+      <Select
+        options={RETENTION_OPTIONS}
+        value="90"
+        onChange={() => {}}
+        disabled
+      />
+    </FormField>
+  ),
+};
+
+// ─── Slider ───────────────────────────────────────────────────────────────────
+
+export const Slider_Default: Story = {
+  render: () => {
+    function Bound() {
+      const [v, setV] = useState(0.85);
+      return (
+        <FormField
+          label="Confidence threshold"
+          helperText="Documents below this route to the review queue."
+        >
+          <Slider
+            value={v}
+            onChange={setV}
+            min={0}
+            max={1}
+            step={0.01}
+            formatValue={(x) => x.toFixed(2)}
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Slider_WithMarks: Story = {
+  render: () => {
+    function Bound() {
+      const [days, setDays] = useState(90);
+      return (
+        <FormField label="Retain artifacts for">
+          <Slider
+            value={days}
+            onChange={setDays}
+            min={7}
+            max={365}
+            step={1}
+            formatValue={(d) => `${d}d`}
+            marks={[
+              { value: 30, label: "30d" },
+              { value: 90, label: "90d" },
+              { value: 180, label: "180d" },
+              { value: 365, label: "1y" },
+            ]}
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Slider_NoLabel: Story = {
+  render: () => {
+    function Bound() {
+      const [v, setV] = useState(50);
+      return (
+        <FormField label="Opacity" helperText={`${v}%`}>
+          <Slider
+            value={v}
+            onChange={setV}
+            min={0}
+            max={100}
+            step={1}
+            showValue={false}
+          />
+        </FormField>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+export const Slider_Disabled: Story = {
+  render: () => (
+    <FormField label="Confidence threshold">
+      <Slider
+        value={0.85}
+        min={0}
+        max={1}
+        step={0.01}
+        formatValue={(x) => x.toFixed(2)}
+        disabled
+      />
+    </FormField>
+  ),
+};
+
+// ─── Combined ────────────────────────────────────────────────────────────────
+
+export const WatermarkForm: Story = {
+  render: () => {
+    function Form() {
+      const [color, setColor] = useState("#000000");
+      const [opacity, setOpacity] = useState<number | string>(50);
+      const [fontSize, setFontSize] = useState<number | string>(24);
+      const [piiFields, setPiiFields] = useState<string[]>([]);
+      return (
+        <Stack gap="4">
+          <FormField label="Watermark color">
+            <ColorInput value={color} onChange={setColor} />
+          </FormField>
+          <FormField label="Opacity">
+            <NumberInput
+              value={opacity}
+              onChange={setOpacity}
+              min={0}
+              max={100}
+              suffix="%"
+            />
+          </FormField>
+          <FormField label="Font size">
+            <NumberInput
+              value={fontSize}
+              onChange={setFontSize}
+              min={6}
+              max={200}
+              suffix=" pt"
+            />
+          </FormField>
+          <FormField
+            label="Redact PII types"
+            helperText="Fields to strip before watermarking."
+          >
+            <MultiSelect
+              data={PII_OPTIONS}
+              value={piiFields}
+              onChange={setPiiFields}
+              placeholder="None"
+              clearable
+              searchable
+            />
+          </FormField>
+        </Stack>
+      );
+    }
+    return <Form />;
+  },
+};
diff --git a/frontend/editor/src/proprietary/ui/MultiSelect.tsx b/frontend/editor/src/proprietary/ui/MultiSelect.tsx
new file mode 100644
index 0000000000..31ac9544f8
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/MultiSelect.tsx
@@ -0,0 +1,184 @@
+import type React from "react";
+import {
+  MultiSelect as MantineMultiSelect,
+  type MultiSelectProps as MantineMultiSelectProps,
+  type ComboboxData,
+} from "@mantine/core";
+import { useInputAria } from "@app/ui/ariaForwarding";
+import "@app/ui/MantineForms.css";
+
+const SUI_INPUT_VARS = {
+  "--input-bg": "var(--color-surface)",
+  "--input-bd": "var(--color-border-input)",
+  "--input-bd-focus": "var(--color-blue)",
+  "--input-radius": "var(--radius-md)",
+  "--input-color": "var(--color-text-1)",
+  "--input-placeholder-color": "var(--color-text-placeholder)",
+  "--input-height-sm": "1.75rem",
+  "--input-height-md": "2.25rem",
+} as React.CSSProperties;
+
+export type MultiSelectSize = "sm" | "md";
+
+export interface MultiSelectProps {
+  // Data
+  data: ComboboxData;
+  value?: string[];
+  onChange?: (value: string[]) => void;
+  defaultValue?: string[];
+
+  // Behaviour
+  searchable?: boolean;
+  clearable?: boolean;
+  limit?: number;
+  maxValues?: number;
+  searchValue?: string;
+  onSearchChange?: (value: string) => void;
+  nothingFoundMessage?: React.ReactNode;
+  maxDropdownHeight?: number | string;
+  filter?: MantineMultiSelectProps["filter"];
+
+  // Dropdown escape hatch — only for zIndex / offset overrides in modals
+  comboboxProps?: MantineMultiSelectProps["comboboxProps"];
+
+  // Form
+  placeholder?: string;
+  id?: string;
+  name?: string;
+  "aria-label"?: string;
+  "aria-invalid"?: boolean;
+  "aria-describedby"?: string;
+  required?: boolean;
+  disabled?: boolean;
+  readOnly?: boolean;
+  onFocus?: React.FocusEventHandler<HTMLInputElement>;
+  onBlur?: React.FocusEventHandler<HTMLInputElement>;
+  onDropdownOpen?: () => void;
+  onDropdownClose?: () => void;
+
+  // SUI — invalid applies error styling; FormField renders the message itself.
+  inputSize?: MultiSelectSize;
+  invalid?: boolean;
+}
+
+type PassthroughProps = Omit<
+  Pick<
+    MantineMultiSelectProps,
+    | "data"
+    | "value"
+    | "onChange"
+    | "defaultValue"
+    | "searchable"
+    | "clearable"
+    | "limit"
+    | "maxValues"
+    | "searchValue"
+    | "onSearchChange"
+    | "nothingFoundMessage"
+    | "maxDropdownHeight"
+    | "filter"
+    | "comboboxProps"
+    | "placeholder"
+    | "id"
+    | "name"
+    | "aria-label"
+    | "aria-describedby"
+    | "required"
+    | "disabled"
+    | "readOnly"
+    | "onFocus"
+    | "onBlur"
+    | "onDropdownOpen"
+    | "onDropdownClose"
+  >,
+  never
+>;
+
+/**
+ * SUI multi-select with pill display and optional search. Use with <FormField>
+ * for labels and error display. Appearance is locked to SUI tokens.
+ *
+ * Pass `comboboxProps={{ zIndex: Z_INDEX_MODAL }}` when rendering inside a modal.
+ */
+export function MultiSelect({
+  inputSize = "md",
+  invalid,
+  data,
+  value,
+  onChange,
+  defaultValue,
+  searchable,
+  clearable,
+  limit,
+  maxValues,
+  searchValue,
+  onSearchChange,
+  nothingFoundMessage,
+  maxDropdownHeight,
+  filter,
+  comboboxProps,
+  placeholder,
+  id,
+  name,
+  "aria-label": ariaLabel,
+  "aria-invalid": ariaInvalid,
+  "aria-describedby": ariaDescribedBy,
+  required,
+  disabled,
+  readOnly,
+  onFocus,
+  onBlur,
+  onDropdownOpen,
+  onDropdownClose,
+}: MultiSelectProps) {
+  const inputRef = useInputAria({ describedBy: ariaDescribedBy, required });
+  const passthroughProps: PassthroughProps = {
+    data,
+    value,
+    onChange,
+    defaultValue,
+    searchable,
+    clearable,
+    limit,
+    maxValues,
+    searchValue,
+    onSearchChange,
+    nothingFoundMessage,
+    maxDropdownHeight,
+    filter,
+    comboboxProps,
+    placeholder,
+    id,
+    name,
+    "aria-label": ariaLabel,
+    "aria-describedby": ariaDescribedBy,
+    required,
+    disabled,
+    readOnly,
+    onFocus,
+    onBlur,
+    onDropdownOpen,
+    onDropdownClose,
+  };
+
+  return (
+    <MantineMultiSelect
+      size={inputSize}
+      // Boolean error applies invalid styling without rendering Mantine's own
+      // message element — FormField owns the visible error text.
+      error={invalid || ariaInvalid || undefined}
+      // FormField renders the asterisk; the field is announced as required
+      // via aria-required from useInputAria (Mantine keeps `required` on the
+      // pills wrapper, not the focusable field).
+      withAsterisk={false}
+      ref={inputRef}
+      classNames={{
+        wrapper: "sui-mantine-wrapper",
+        pill: "sui-mantine-pill",
+        pillsList: "sui-mantine-pills-list",
+      }}
+      styles={{ wrapper: SUI_INPUT_VARS }}
+      {...passthroughProps}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/NumberInput.tsx b/frontend/editor/src/proprietary/ui/NumberInput.tsx
new file mode 100644
index 0000000000..751c902636
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/NumberInput.tsx
@@ -0,0 +1,190 @@
+import type React from "react";
+import {
+  NumberInput as MantineNumberInput,
+  type NumberInputProps as MantineNumberInputProps,
+} from "@mantine/core";
+import { useInputAria } from "@app/ui/ariaForwarding";
+import "@app/ui/MantineForms.css";
+
+const SUI_INPUT_VARS = {
+  "--input-bg": "var(--color-surface)",
+  "--input-bd": "var(--color-border-input)",
+  "--input-bd-focus": "var(--color-blue)",
+  "--input-radius": "var(--radius-md)",
+  "--input-color": "var(--color-text-1)",
+  "--input-placeholder-color": "var(--color-text-placeholder)",
+  "--input-height-sm": "1.75rem",
+  "--input-height-md": "2.25rem",
+} as React.CSSProperties;
+
+export type NumberInputSize = "sm" | "md";
+
+export interface NumberInputProps {
+  // Value
+  value?: number | string;
+  onChange?: (value: number | string) => void;
+  defaultValue?: number | string;
+
+  // Constraints
+  min?: number;
+  max?: number;
+  step?: number;
+  decimalScale?: number;
+  fixedDecimalScale?: boolean;
+  allowNegative?: boolean;
+  allowDecimal?: boolean;
+  clampBehavior?: "strict" | "blur" | "none";
+
+  // Display
+  placeholder?: string;
+  suffix?: string;
+  prefix?: string;
+  hideControls?: boolean;
+
+  // Right section — escape hatch for inline unit labels
+  rightSection?: React.ReactNode;
+  rightSectionWidth?: React.CSSProperties["width"];
+
+  // Form
+  id?: string;
+  name?: string;
+  "aria-label"?: string;
+  "aria-invalid"?: boolean;
+  "aria-describedby"?: string;
+  required?: boolean;
+  disabled?: boolean;
+  readOnly?: boolean;
+  autoFocus?: boolean;
+  onFocus?: React.FocusEventHandler<HTMLInputElement>;
+  onBlur?: React.FocusEventHandler<HTMLInputElement>;
+  onKeyDown?: React.KeyboardEventHandler<HTMLInputElement>;
+
+  // SUI — invalid applies error styling; FormField renders the message itself.
+  inputSize?: NumberInputSize;
+  invalid?: boolean;
+}
+
+// Narrows MantineNumberInputProps to only what our interface exposes so the
+// spread below stays type-safe without manually listing every prop.
+type PassthroughProps = Omit<
+  Pick<
+    MantineNumberInputProps,
+    | "value"
+    | "onChange"
+    | "defaultValue"
+    | "min"
+    | "max"
+    | "step"
+    | "decimalScale"
+    | "fixedDecimalScale"
+    | "allowNegative"
+    | "allowDecimal"
+    | "clampBehavior"
+    | "placeholder"
+    | "suffix"
+    | "prefix"
+    | "hideControls"
+    | "rightSection"
+    | "rightSectionWidth"
+    | "id"
+    | "name"
+    | "aria-label"
+    | "aria-describedby"
+    | "required"
+    | "disabled"
+    | "readOnly"
+    | "autoFocus"
+    | "onFocus"
+    | "onBlur"
+    | "onKeyDown"
+  >,
+  never
+>;
+
+/**
+ * SUI number input with increment/decrement controls. Use with <FormField>
+ * for labels and error display. Appearance is locked to SUI tokens.
+ */
+export function NumberInput({
+  inputSize = "md",
+  invalid,
+  value,
+  onChange,
+  defaultValue,
+  min,
+  max,
+  step,
+  decimalScale,
+  fixedDecimalScale,
+  allowNegative,
+  allowDecimal,
+  clampBehavior,
+  placeholder,
+  suffix,
+  prefix,
+  hideControls,
+  rightSection,
+  rightSectionWidth,
+  id,
+  name,
+  "aria-label": ariaLabel,
+  "aria-invalid": ariaInvalid,
+  "aria-describedby": ariaDescribedBy,
+  required,
+  disabled,
+  readOnly,
+  autoFocus,
+  onFocus,
+  onBlur,
+  onKeyDown,
+}: NumberInputProps) {
+  const inputRef = useInputAria({ describedBy: ariaDescribedBy });
+  const passthroughProps: PassthroughProps = {
+    value,
+    onChange,
+    defaultValue,
+    min,
+    max,
+    step,
+    decimalScale,
+    fixedDecimalScale,
+    allowNegative,
+    allowDecimal,
+    clampBehavior,
+    placeholder,
+    suffix,
+    prefix,
+    hideControls,
+    rightSection,
+    rightSectionWidth,
+    id,
+    name,
+    "aria-label": ariaLabel,
+    "aria-describedby": ariaDescribedBy,
+    required,
+    disabled,
+    readOnly,
+    autoFocus,
+    onFocus,
+    onBlur,
+    onKeyDown,
+  };
+
+  return (
+    <MantineNumberInput
+      size={inputSize}
+      // Boolean error applies invalid styling without rendering Mantine's own
+      // message element — FormField owns the visible error text.
+      error={invalid || ariaInvalid || undefined}
+      // required sets the input attribute only; FormField renders the asterisk.
+      withAsterisk={false}
+      ref={inputRef}
+      classNames={{
+        wrapper: "sui-mantine-wrapper",
+        control: "sui-mantine-control",
+      }}
+      styles={{ wrapper: SUI_INPUT_VARS }}
+      {...passthroughProps}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/Select.tsx b/frontend/editor/src/proprietary/ui/Select.tsx
index b970cc1815..fa2d5346b7 100644
--- a/frontend/editor/src/proprietary/ui/Select.tsx
+++ b/frontend/editor/src/proprietary/ui/Select.tsx
@@ -1,5 +1,21 @@
-import { forwardRef, type SelectHTMLAttributes } from "react";
-import "@app/ui/Select.css";
+import type React from "react";
+import {
+  Select as MantineSelect,
+  type SelectProps as MantineSelectProps,
+} from "@mantine/core";
+import { useInputAria } from "@app/ui/ariaForwarding";
+import "@app/ui/MantineForms.css";
+
+const SUI_INPUT_VARS = {
+  "--input-bg": "var(--color-surface)",
+  "--input-bd": "var(--color-border-input)",
+  "--input-bd-focus": "var(--color-blue)",
+  "--input-radius": "var(--radius-md)",
+  "--input-color": "var(--color-text-1)",
+  "--input-placeholder-color": "var(--color-text-placeholder)",
+  "--input-height-sm": "1.75rem",
+  "--input-height-md": "2.25rem",
+} as React.CSSProperties;
 
 export interface SelectOption {
   value: string;
@@ -9,61 +25,130 @@ export interface SelectOption {
 
 export type SelectSize = "sm" | "md";
 
-export interface SelectProps extends Omit<
-  SelectHTMLAttributes<HTMLSelectElement>,
-  "size"
-> {
-  inputSize?: SelectSize;
+export interface SelectProps {
+  // Data
   options: SelectOption[];
-  /** Optional placeholder rendered as a disabled first option. */
+  value?: string | null;
+  onChange?: (value: string | null) => void;
+  defaultValue?: string;
+
+  // Behaviour
+  searchable?: boolean;
+  clearable?: boolean;
   placeholder?: string;
+  nothingFoundMessage?: React.ReactNode;
+  maxDropdownHeight?: number | string;
+
+  // Dropdown escape hatch — for zIndex / offset overrides in modals
+  comboboxProps?: MantineSelectProps["comboboxProps"];
+
+  // Form
+  id?: string;
+  name?: string;
+  "aria-label"?: string;
+  "aria-invalid"?: boolean;
+  "aria-describedby"?: string;
+  required?: boolean;
+  disabled?: boolean;
+  readOnly?: boolean;
+  onFocus?: React.FocusEventHandler<HTMLInputElement>;
+  onBlur?: React.FocusEventHandler<HTMLInputElement>;
+
+  // SUI — invalid applies error styling; FormField renders the message itself.
+  inputSize?: SelectSize;
   invalid?: boolean;
 }
 
-export const Select = forwardRef<HTMLSelectElement, SelectProps>(
-  function Select(
-    { inputSize = "md", options, placeholder, invalid, className, ...rest },
-    ref,
-  ) {
-    return (
-      <span
-        className={[
-          "sui-select",
-          `sui-select--${inputSize}`,
-          invalid ? "sui-select--invalid" : "",
-          rest.disabled ? "sui-select--disabled" : "",
-          className ?? "",
-        ]
-          .filter(Boolean)
-          .join(" ")}
-      >
-        <select ref={ref} className="sui-select__el" {...rest}>
-          {placeholder && (
-            <option value="" disabled hidden>
-              {placeholder}
-            </option>
-          )}
-          {options.map((opt) => (
-            <option key={opt.value} value={opt.value} disabled={opt.disabled}>
-              {opt.label}
-            </option>
-          ))}
-        </select>
-        <span className="sui-select__caret" aria-hidden>
-          <svg
-            viewBox="0 0 24 24"
-            width="12"
-            height="12"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth={2}
-            strokeLinecap="round"
-            strokeLinejoin="round"
-          >
-            <polyline points="6 9 12 15 18 9" />
-          </svg>
-        </span>
-      </span>
-    );
-  },
-);
+type PassthroughProps = Omit<
+  Pick<
+    MantineSelectProps,
+    | "value"
+    | "onChange"
+    | "defaultValue"
+    | "searchable"
+    | "clearable"
+    | "placeholder"
+    | "nothingFoundMessage"
+    | "maxDropdownHeight"
+    | "comboboxProps"
+    | "id"
+    | "name"
+    | "aria-label"
+    | "aria-describedby"
+    | "required"
+    | "disabled"
+    | "readOnly"
+    | "onFocus"
+    | "onBlur"
+  >,
+  never
+>;
+
+/**
+ * SUI select / combobox backed by Mantine. Supports optional search and clear.
+ * Use with <FormField> for labels and error display. Appearance is locked to SUI tokens.
+ *
+ * onChange receives the selected string value (or null when cleared), not a DOM event.
+ */
+export function Select({
+  inputSize = "md",
+  invalid,
+  options,
+  value,
+  onChange,
+  defaultValue,
+  searchable,
+  clearable,
+  placeholder,
+  nothingFoundMessage,
+  maxDropdownHeight,
+  comboboxProps,
+  id,
+  name,
+  "aria-label": ariaLabel,
+  "aria-invalid": ariaInvalid,
+  "aria-describedby": ariaDescribedBy,
+  required,
+  disabled,
+  readOnly,
+  onFocus,
+  onBlur,
+}: SelectProps) {
+  const inputRef = useInputAria({ describedBy: ariaDescribedBy });
+  const passthroughProps: PassthroughProps = {
+    value,
+    onChange,
+    defaultValue,
+    searchable,
+    clearable,
+    placeholder,
+    nothingFoundMessage,
+    maxDropdownHeight,
+    comboboxProps,
+    id,
+    name,
+    "aria-label": ariaLabel,
+    "aria-describedby": ariaDescribedBy,
+    required,
+    disabled,
+    readOnly,
+    onFocus,
+    onBlur,
+  };
+
+  return (
+    <MantineSelect
+      data={options}
+      size={inputSize}
+      // Boolean error applies invalid styling without rendering Mantine's own
+      // message element — FormField owns the visible error text.
+      error={invalid || ariaInvalid || undefined}
+      // required sets the input attribute only; FormField renders the asterisk.
+      withAsterisk={false}
+      ref={inputRef}
+      classNames={{ wrapper: "sui-mantine-wrapper" }}
+      styles={{ wrapper: SUI_INPUT_VARS }}
+      {...passthroughProps}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/Slider.tsx b/frontend/editor/src/proprietary/ui/Slider.tsx
index 3b540def06..ebeb782f9e 100644
--- a/frontend/editor/src/proprietary/ui/Slider.tsx
+++ b/frontend/editor/src/proprietary/ui/Slider.tsx
@@ -1,63 +1,113 @@
-import { forwardRef, type InputHTMLAttributes } from "react";
-import "@app/ui/Slider.css";
+import {
+  Slider as MantineSlider,
+  type SliderProps as MantineSliderProps,
+} from "@mantine/core";
+import { useThumbAria } from "@app/ui/ariaForwarding";
+import "@app/ui/MantineForms.css";
 
-export interface SliderProps extends Omit<
-  InputHTMLAttributes<HTMLInputElement>,
-  "type" | "value" | "onChange"
-> {
+export interface SliderMark {
   value: number;
+  label?: React.ReactNode;
+}
+
+export interface SliderProps {
+  value: number;
+  onChange?: (value: number) => void;
   min?: number;
   max?: number;
   step?: number;
-  onChange: (value: number) => void;
-  /** Optional formatter for the value pill (e.g. "0.85", "30 days"). */
+
+  /** Tick marks along the track. */
+  marks?: SliderMark[];
+
+  /** Format the tooltip shown while dragging. Defaults to the raw number. */
   formatValue?: (value: number) => string;
-  /** Show the right-aligned value badge. Defaults to true. */
+
+  /**
+   * Show the value tooltip on hover/drag. Defaults to true.
+   * Pass false to hide the label entirely (useful when the value is shown elsewhere).
+   */
   showValue?: boolean;
+
+  // Form
+  id?: string;
+  /** Accessible name for the slider thumb — the visible FormField label can't
+   * associate with Mantine's non-input thumb element, so set this too. */
+  "aria-label"?: string;
+  "aria-invalid"?: boolean;
+  "aria-describedby"?: string;
+  disabled?: boolean;
+
+  // SUI
+  inputSize?: "sm" | "md";
 }
 
-export const Slider = forwardRef<HTMLInputElement, SliderProps>(function Slider(
-  {
+type PassthroughProps = Omit<
+  Pick<
+    MantineSliderProps,
+    | "value"
+    | "onChange"
+    | "min"
+    | "max"
+    | "step"
+    | "marks"
+    | "label"
+    | "thumbLabel"
+    | "id"
+    | "disabled"
+    | "size"
+  >,
+  never
+>;
+
+/**
+ * SUI range slider backed by Mantine. Provides accessible keyboard navigation,
+ * optional tick marks, and a drag tooltip. Use with <FormField> for labels.
+ * Appearance is locked to SUI tokens.
+ */
+export function Slider({
+  value,
+  onChange,
+  min = 0,
+  max = 1,
+  step = 0.01,
+  marks,
+  formatValue,
+  showValue = true,
+  id,
+  "aria-label": ariaLabel,
+  "aria-invalid": ariaInvalid,
+  "aria-describedby": ariaDescribedBy,
+  disabled,
+  inputSize = "md",
+}: SliderProps) {
+  const label = showValue
+    ? (v: number) => (formatValue ? formatValue(v) : String(v))
+    : null;
+
+  // The role="slider" element is the thumb, not an input, so FormField's
+  // injected aria wiring has to land there for AT to announce it.
+  const rootRef = useThumbAria(ariaDescribedBy, ariaInvalid);
+
+  const passthroughProps: PassthroughProps = {
     value,
-    min = 0,
-    max = 1,
-    step = 0.01,
     onChange,
-    formatValue,
-    showValue = true,
-    className,
-    ...rest
-  },
-  ref,
-) {
-  const pct = ((value - min) / (max - min)) * 100;
+    min,
+    max,
+    step,
+    marks,
+    label,
+    thumbLabel: ariaLabel,
+    id,
+    disabled,
+    size: inputSize,
+  };
+
   return (
-    <span
-      className={[
-        "sui-slider",
-        rest.disabled ? "sui-slider--disabled" : "",
-        className ?? "",
-      ]
-        .filter(Boolean)
-        .join(" ")}
-      style={{ "--slider-pct": `${pct}%` } as React.CSSProperties}
-    >
-      <input
-        ref={ref}
-        type="range"
-        min={min}
-        max={max}
-        step={step}
-        value={value}
-        onChange={(e) => onChange(Number(e.target.value))}
-        className="sui-slider__input"
-        {...rest}
-      />
-      {showValue && (
-        <span className="sui-slider__value" aria-hidden>
-          {formatValue ? formatValue(value) : value.toString()}
-        </span>
-      )}
-    </span>
+    <MantineSlider
+      ref={rootRef}
+      classNames={{ root: "sui-mantine-slider" }}
+      {...passthroughProps}
+    />
   );
-});
+}
diff --git a/frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx b/frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx
new file mode 100644
index 0000000000..608baff21d
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx
@@ -0,0 +1,106 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { Select } from "@app/ui/Select";
+import { MultiSelect } from "@app/ui/MultiSelect";
+import { NumberInput } from "@app/ui/NumberInput";
+import { ColorInput } from "@app/ui/ColorInput";
+import { Slider } from "@app/ui/Slider";
+
+// Guards the FormField contract on the Mantine-backed components: the
+// injected required / aria-describedby / aria-invalid wiring must reach the
+// focusable element. Mantine internals clobber some of these (see
+// ariaForwarding.ts), so this exercises the real DOM output.
+
+function renderInProvider(ui: React.ReactElement) {
+  return render(<MantineProvider>{ui}</MantineProvider>);
+}
+
+const OPTIONS = [{ value: "a", label: "A" }];
+
+describe("Mantine-backed SUI aria forwarding", () => {
+  it("Select forwards required and aria-describedby to the input", () => {
+    const { container } = renderInProvider(
+      <Select
+        options={OPTIONS}
+        value="a"
+        onChange={() => {}}
+        required
+        aria-describedby="help-1"
+      />,
+    );
+    const input = container.querySelector("input");
+    expect(input?.hasAttribute("required")).toBe(true);
+    expect(input?.getAttribute("aria-describedby")).toBe("help-1");
+  });
+
+  it("Select sets aria-invalid from the invalid flag", () => {
+    const { container } = renderInProvider(
+      <Select options={OPTIONS} value="a" onChange={() => {}} invalid />,
+    );
+    expect(container.querySelector("input")?.getAttribute("aria-invalid")).toBe(
+      "true",
+    );
+  });
+
+  it("MultiSelect forwards aria-required and aria-describedby to the field", () => {
+    const { container } = renderInProvider(
+      <MultiSelect
+        data={OPTIONS}
+        value={["a"]}
+        onChange={() => {}}
+        required
+        aria-describedby="help-2"
+      />,
+    );
+    // The focusable pills field; a native `required` would misfire form
+    // validation there, so the requirement is announced via aria-required.
+    const input = container.querySelector("input");
+    expect(input?.getAttribute("aria-required")).toBe("true");
+    expect(input?.getAttribute("aria-describedby")).toBe("help-2");
+  });
+
+  it("NumberInput forwards required and aria-describedby to the input", () => {
+    const { container } = renderInProvider(
+      <NumberInput
+        value={1}
+        onChange={() => {}}
+        required
+        aria-describedby="help-3"
+      />,
+    );
+    const input = container.querySelector("input");
+    expect(input?.hasAttribute("required")).toBe(true);
+    expect(input?.getAttribute("aria-describedby")).toBe("help-3");
+  });
+
+  it("ColorInput forwards required and aria-describedby to the input", () => {
+    const { container } = renderInProvider(
+      <ColorInput
+        value="#000000"
+        onChange={() => {}}
+        required
+        aria-describedby="help-4"
+      />,
+    );
+    const input = container.querySelector("input");
+    expect(input?.hasAttribute("required")).toBe(true);
+    expect(input?.getAttribute("aria-describedby")).toBe("help-4");
+  });
+
+  it("Slider forwards aria wiring to the role=slider thumb", () => {
+    const { container } = renderInProvider(
+      <Slider
+        value={0.5}
+        onChange={() => {}}
+        aria-label="Confidence"
+        aria-invalid
+        aria-describedby="help-5"
+      />,
+    );
+    const thumb = container.querySelector('[role="slider"]');
+    expect(thumb?.getAttribute("aria-label")).toBe("Confidence");
+    expect(thumb?.getAttribute("aria-invalid")).toBe("true");
+    expect(thumb?.getAttribute("aria-describedby")).toBe("help-5");
+  });
+});
diff --git a/frontend/editor/src/proprietary/ui/ariaForwarding.ts b/frontend/editor/src/proprietary/ui/ariaForwarding.ts
new file mode 100644
index 0000000000..344016a50c
--- /dev/null
+++ b/frontend/editor/src/proprietary/ui/ariaForwarding.ts
@@ -0,0 +1,57 @@
+import { useEffect, useRef } from "react";
+
+/**
+ * Mantine drops caller-supplied accessibility wiring in a few places:
+ * Input-based components overwrite `aria-describedby` with their own
+ * Input.Wrapper context (unset here — FormField owns the help text),
+ * MultiSelect consumes `required` for its label asterisk without marking the
+ * focusable field, and Slider's thumb ignores unknown `thumbProps` keys
+ * entirely. These hooks re-apply the attributes to the rendered DOM node
+ * after every render so FormField's injected wiring survives.
+ */
+
+/**
+ * Ref for a Mantine input component; keeps `aria-describedby` applied.
+ * Pass `required` only when Mantine doesn't put the attribute on the field
+ * itself (MultiSelect) — it is announced as `aria-required`, since a native
+ * `required` on a combobox search field would misfire form validation.
+ */
+export function useInputAria(options: {
+  describedBy?: string;
+  required?: boolean;
+}) {
+  const { describedBy, required } = options;
+  const ref = useRef<HTMLInputElement>(null);
+  useEffect(() => {
+    applyAria(ref.current, "aria-describedby", describedBy);
+    applyAria(ref.current, "aria-required", required ? "true" : undefined);
+  });
+  return ref;
+}
+
+/** Ref for Mantine Slider's root; keeps aria wiring applied to the thumb. */
+export function useThumbAria(
+  describedBy: string | undefined,
+  invalid: boolean | undefined,
+) {
+  const rootRef = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    const thumb = rootRef.current?.querySelector('[role="slider"]');
+    applyAria(thumb, "aria-describedby", describedBy);
+    applyAria(thumb, "aria-invalid", invalid ? "true" : undefined);
+  });
+  return rootRef;
+}
+
+function applyAria(
+  el: Element | null | undefined,
+  attribute: string,
+  value: string | undefined,
+) {
+  if (!el) return;
+  if (value !== undefined) {
+    el.setAttribute(attribute, value);
+  } else {
+    el.removeAttribute(attribute);
+  }
+}
diff --git a/frontend/editor/src/proprietary/ui/index.ts b/frontend/editor/src/proprietary/ui/index.ts
index 6c2132f894..e6c4864c52 100644
--- a/frontend/editor/src/proprietary/ui/index.ts
+++ b/frontend/editor/src/proprietary/ui/index.ts
@@ -41,3 +41,8 @@ export * from "@app/ui/Select";
 export * from "@app/ui/Checkbox";
 export * from "@app/ui/Radio";
 export * from "@app/ui/Slider";
+
+// Mantine-backed form elements (SUI-styled)
+export * from "@app/ui/MultiSelect";
+export * from "@app/ui/NumberInput";
+export * from "@app/ui/ColorInput";

From 8ba8f69252aed0c89480998af84cf56f3ab03c0c Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Tue, 7 Jul 2026 17:06:56 +0100
Subject: [PATCH 16/35] Consolidate buttons and related components (#6787)

SegmentedControl, Chip, ChipFlow. Bring in the portal dark mode theme
and other small fixes to issues I found during testing
---
 frontend/.storybook/declarations.d.ts         |   1 +
 frontend/.storybook/preview.tsx               |  51 +--
 frontend/.storybook/tsconfig.json             |  24 ++
 .../public/locales/en-US/translation.toml     |  40 ++-
 .../components/onboarding/renderButtons.tsx   |  40 +--
 .../onboarding/slides/TeamSlide.tsx           |   3 +-
 .../shared/FreeLimitReachedModal.tsx          |   5 +-
 .../shared/SpendCapReachedModal.tsx           |   5 +-
 .../shared/TeamInvitationBanner.tsx           |  18 +-
 .../shared/config/configSections/Payg.css     |  21 +-
 .../shared/config/configSections/Payg.tsx     |  21 +-
 .../shared/config/configSections/PaygFree.css |  19 --
 .../shared/config/configSections/PaygFree.tsx |   9 +-
 .../config/configSections/SpendCapControl.css |   8 +-
 .../configSections/StripeCheckoutPanel.tsx    |  10 +-
 .../config/configSections/TeamSection.tsx     |  31 +-
 .../config/configSections/UpgradeModal.css    |  85 +----
 .../config/configSections/UpgradeModal.tsx    |  48 ++-
 .../editor/src/core/assets/login/github.svg   |   2 +-
 .../src/core/components/StorageStatsCard.tsx  |  16 +-
 .../annotation/shared/ColorControl.tsx        |  29 +-
 .../annotation/shared/ColorPicker.tsx         |   3 +-
 .../annotation/shared/DrawingCanvas.tsx       |   5 +-
 .../annotation/shared/DrawingControls.tsx     |  14 +-
 .../annotation/shared/OpacityControl.tsx      |  28 +-
 .../annotation/shared/PropertiesPopover.tsx   |  44 +--
 .../annotation/shared/TextInputWithFont.tsx   |  12 +-
 .../annotation/shared/WidthControl.tsx        |  28 +-
 .../components/fileEditor/AddFileCard.tsx     |   5 +-
 .../fileEditor/FileEditor.module.css          |   6 +-
 .../fileEditor/FileEditorThumbnail.tsx        |  39 +--
 .../fileManager/CompactFileDetails.tsx        |  18 +-
 .../fileManager/EmptyFilesState.tsx           |   4 +-
 .../components/fileManager/FileActions.tsx    |  44 ++-
 .../components/fileManager/FileDetails.tsx    |  11 +-
 .../components/fileManager/FileInfoCard.tsx   |   6 +-
 .../components/fileManager/FileListItem.tsx   |   7 +-
 .../fileManager/FileSourceButtons.tsx         |  95 ++----
 .../filesPage/DeleteFilesDialog.tsx           |   8 +-
 .../filesPage/DeleteFolderDialog.tsx          |  15 +-
 .../components/filesPage/FileDetailsPanel.tsx |  65 ++--
 .../core/components/filesPage/FileGrid.tsx    |  18 +-
 .../components/filesPage/FileManagerView.tsx  |  80 +++--
 .../filesPage/FolderAppearancePicker.tsx      |  11 +-
 .../components/filesPage/FolderNameDialog.tsx |   6 +-
 .../filesPage/FolderTreeSidebar.tsx           |   7 +-
 .../filesPage/MoveToFolderDialog.tsx          |  44 ++-
 .../components/filesPage/VersionTimeline.tsx  |  58 ++--
 .../InitialOnboardingModal/renderButtons.tsx  |  41 +--
 .../onboarding/OnboardingModalSlide.tsx       |  24 +-
 .../components/onboarding/OnboardingTour.tsx  |  12 +-
 .../onboarding/onboardingFlowConfig.ts        |   4 +
 .../slides/AnalyticsChoiceSlide.tsx           |   4 +-
 .../onboarding/slides/DesktopInstallTitle.tsx |   9 +-
 .../onboarding/slides/FirstLoginSlide.tsx     |   7 +-
 .../onboarding/slides/MFASetupSlide.tsx       |   6 +-
 .../components/pageEditor/FileThumbnail.tsx   |  52 ++--
 .../pageEditor/PageEditorControls.tsx         |  87 ++----
 .../pageEditor/PageSelectByNumberButton.tsx   |   6 +-
 .../bulkSelectionPanel/OperatorsSection.tsx   |  13 +-
 .../bulkSelectionPanel/PageSelectionInput.tsx |  22 +-
 .../bulkSelectionPanel/SelectPages.tsx        |   3 +-
 .../core/components/shared/AppConfigModal.tsx |   5 +-
 .../core/components/shared/BulkShareModal.tsx |   8 +-
 .../shared/BulkUploadToServerModal.tsx        |   5 +-
 .../components/shared/ButtonSelector.test.tsx |  73 +++--
 .../core/components/shared/ButtonSelector.tsx | 109 +++----
 .../core/components/shared/ButtonToggle.tsx   |  86 ++---
 .../shared/DismissAllErrorsButton.tsx         |   9 +-
 .../shared/DropdownListWithFooter.tsx         |   6 +-
 .../components/shared/EditableSecretField.tsx |  11 +-
 .../shared/EncryptedPdfUnlockModal.tsx        |  16 +-
 .../core/components/shared/ErrorBoundary.tsx  |   9 +-
 .../src/core/components/shared/FileCard.tsx   |  34 +-
 .../components/shared/FileDropdownMenu.tsx    |  15 +-
 .../src/core/components/shared/FileGrid.tsx   |  15 +-
 .../components/shared/FilePickerModal.tsx     |   8 +-
 .../components/shared/FileSelectorPicker.tsx  |  12 +-
 .../core/components/shared/FileSidebar.tsx    |  47 +--
 .../components/shared/FileSidebarFileItem.css |   2 +-
 .../components/shared/FileSidebarFileItem.tsx |  16 +-
 .../components/shared/FileUploadButton.tsx    |  44 ++-
 .../components/shared/FirstLoginModal.tsx     |  14 +-
 .../src/core/components/shared/Footer.tsx     |  10 +-
 .../components/shared/HoverActionMenu.tsx     |   6 +-
 .../src/core/components/shared/InfoBanner.tsx |  59 +++-
 .../core/components/shared/LandingActions.tsx |  15 +-
 .../core/components/shared/LandingPage.css    |  11 +-
 .../core/components/shared/LandingPage.tsx    |   8 +-
 .../components/shared/LanguageSelector.tsx    |  88 ++----
 .../components/shared/LoginAgreementModal.tsx |   6 +-
 .../components/shared/MultiSelectControls.tsx |  16 +-
 .../shared/NavigationWarningModal.tsx         |  43 +--
 .../components/shared/ObscuredOverlay.tsx     |   7 +-
 .../core/components/shared/ShareFileModal.tsx |   8 +-
 .../shared/ShareManagementModal.tsx           |  42 ++-
 .../src/core/components/shared/TextInput.tsx  |   7 +-
 .../components/shared/ToolPanelHeader.tsx     |  10 +-
 .../src/core/components/shared/Tooltip.tsx    |   6 +-
 .../core/components/shared/TopControls.tsx    |  37 +--
 .../core/components/shared/UpdateModal.tsx    |  66 ++--
 .../components/shared/UploadToServerModal.tsx |   5 +-
 .../core/components/shared/UserSelector.tsx   |   7 +-
 .../shared/ViewerInlineControls.tsx           |   9 +-
 .../core/components/shared/WorkbenchBar.css   |  21 +-
 .../core/components/shared/WorkbenchBar.tsx   |  78 ++---
 .../components/shared/ZipWarningModal.tsx     |  31 +-
 .../config/RestartConfirmationModal.tsx       |   6 +-
 .../shared/config/SettingsStickyFooter.tsx    |   5 +-
 .../config/configSections/GeneralSection.tsx  |  23 +-
 .../config/configSections/HelpSection.tsx     |   7 +-
 .../config/configSections/HotkeysSection.tsx  |  11 +-
 .../config/configSections/LegalSection.tsx    |   5 +-
 .../config/configSections/ProviderCard.tsx    |  10 +-
 .../shared/filePreview/NavigationArrows.tsx   |  13 +-
 .../quickAccessBar/QuickAccessButton.tsx      |   6 +-
 .../shared/signing/SharedSigningLauncher.tsx  |   5 +-
 .../steps/ConfigureSignatureDefaultsStep.tsx  |   5 +-
 .../signing/steps/ReviewSessionStep.tsx       |  16 +-
 .../signing/steps/SelectDocumentStep.tsx      |   3 +-
 .../signing/steps/SelectParticipantsStep.tsx  |   5 +-
 .../wetSignature/DrawSignatureCanvas.tsx      |   7 +-
 .../wetSignature/SignatureTypeSelector.tsx    |   8 +-
 .../wetSignature/UploadSignatureImage.tsx     |   9 +-
 .../core/components/toast/ToastRenderer.tsx   |  18 +-
 .../core/components/tools/RightSidebar.tsx    |  35 +--
 .../src/core/components/tools/ToolPanel.css   |   1 +
 .../components/tools/ToolPanelModePrompt.tsx  |  13 +-
 .../components/tools/ToolPanelViewerBar.tsx   |   8 +-
 .../src/core/components/tools/ToolPicker.tsx  |   7 +-
 .../addAttachments/AddAttachmentsSettings.tsx |  39 +--
 .../addPageNumbers/PageNumberPreview.tsx      |   7 +-
 .../StampPositionFormattingSettings.tsx       |  38 ++-
 .../tools/addStamp/StampPreview.tsx           |   7 +-
 .../tools/addStamp/StampSetupSettings.tsx     |   7 +-
 .../AdjustPageScaleSettings.tsx               |  14 +-
 .../tools/automate/AutomationCreation.tsx     |  10 +-
 .../tools/automate/AutomationEntry.tsx        |  43 ++-
 .../tools/automate/AutomationImportModal.tsx  |   4 +-
 .../tools/automate/AutomationRun.tsx          |  13 +-
 .../tools/automate/IconSelector.tsx           |  20 +-
 .../tools/automate/ToolConfigurationModal.tsx |  14 +-
 .../components/tools/automate/ToolList.tsx    |  27 +-
 .../BookletImpositionSettings.tsx             |   4 +-
 .../certSign/CertificateFormatSettings.tsx    |  17 +-
 .../tools/certSign/CertificateSelector.tsx    |  15 +-
 .../certSign/CertificateTypeSettings.tsx      |  45 +--
 .../certSign/HardwareCertificateSettings.tsx  |  34 +-
 .../certSign/SignatureAppearanceSettings.tsx  |  19 +-
 .../tools/certSign/SignatureSettingsInput.tsx |  18 +-
 .../tools/certSign/WetSignatureInput.tsx      |  11 +-
 .../certSign/modals/AddParticipantsFlow.tsx   |   7 +-
 .../modals/CertificateConfigModal.tsx         |   8 +-
 .../certSign/modals/SelectSignatureModal.tsx  |  29 +-
 .../certSign/panels/ParticipantListPanel.tsx  |  11 +-
 .../certSign/panels/SessionActionsPanel.tsx   |   8 +-
 .../certSign/panels/SessionDetailPanel.tsx    |  27 +-
 .../certSign/panels/SignControlsPanel.tsx     |  37 +--
 .../certSign/panels/SignRequestPanel.tsx      |  14 +-
 .../certSign/steps/AddSignaturesStep.tsx      |   7 +-
 .../steps/CertificateSelectionStep.tsx        |   5 +-
 .../certSign/steps/ReviewSignatureStep.tsx    |  11 +-
 .../certSign/steps/SignatureCreationStep.tsx  |   3 +-
 .../certSign/steps/SignaturePlacementStep.tsx |   5 +-
 .../steps/CustomMetadataStep.tsx              |  13 +-
 .../compare/ComparePixelWorkbenchView.tsx     |   7 +-
 .../components/tools/compare/compareView.css  |  73 +----
 .../tools/compress/CompressSettings.tsx       |  18 +-
 .../tools/convert/ConvertSettings.tsx         |  20 +-
 .../tools/convert/GroupedFormatDropdown.tsx   |  34 +-
 .../components/tools/crop/CropSettings.tsx    |   4 +-
 .../editTableOfContents/BookmarkEditor.tsx    |  36 ++-
 .../EditTableOfContentsSettings.tsx           |  66 ++--
 .../EditTableOfContentsWorkbenchView.tsx      |   6 +-
 .../tools/fullscreen/CompactToolItem.tsx      |  35 ++-
 .../tools/fullscreen/DetailedToolItem.tsx     |   7 +-
 .../tools/getPdfInfo/GetPdfInfoResults.tsx    |   4 +-
 .../tools/merge/MergeFileSorter.tsx           |  15 +-
 .../tools/overlayPdfs/OverlayPdfsSettings.tsx |  19 +-
 .../pdfTextEditor/PdfTextEditorSidebar.tsx    |  39 ++-
 .../tools/pdfTextEditor/PdfTextEditorView.tsx |  23 +-
 .../tools/redact/ManualRedactionControls.tsx  |   8 +-
 .../redact/RedactSingleStepSettings.test.tsx  |  20 +-
 .../tools/redact/WordsToRedactInput.tsx       |  18 +-
 .../tools/rotate/RotateSettings.tsx           |  11 +-
 .../tools/shared/NavigationControls.tsx       |  11 +-
 .../tools/shared/OperationButton.tsx          |  53 +++-
 .../tools/shared/ReviewToolStep.tsx           |  10 +-
 .../tools/shared/ScopedOperationButton.tsx    |  14 +-
 .../components/tools/showJS/ShowJSView.tsx    |  30 +-
 .../tools/sign/SavedSignaturesSection.tsx     |  35 +--
 .../components/tools/sign/SignSettings.tsx    |  59 ++--
 .../tools/toolPicker/FavoriteStar.tsx         |  25 +-
 .../tools/toolPicker/ToolButton.tsx           | 201 ++++++------
 .../tools/toolPicker/ToolPicker.css           |   7 +-
 .../tools/toolPicker/ToolSearch.tsx           |   7 +-
 .../ValidateSignatureResults.tsx              |  17 +-
 .../ValidateSignatureSettings.tsx             |   6 +-
 .../viewer/AnnotationMenuButtons.tsx          |  94 ++----
 .../components/viewer/AttachmentSidebar.tsx   |  48 ++-
 .../components/viewer/BookmarkSidebar.tsx     | 127 ++++++--
 .../components/viewer/CommentsSidebar.tsx     | 136 ++++----
 .../core/components/viewer/EmbedPdfViewer.tsx |  10 +-
 .../core/components/viewer/LayerSidebar.tsx   |  19 +-
 .../src/core/components/viewer/LinkLayer.tsx  |  16 +-
 .../core/components/viewer/NonPdfViewer.tsx   |   7 +-
 .../components/viewer/PdfViewerToolbar.tsx    |  84 ++---
 .../viewer/RedactionSelectionMenu.tsx         |  31 +-
 .../components/viewer/SearchInterface.tsx     |  11 +-
 .../viewer/SignaturePreviewLayer.tsx          |   9 +-
 .../components/viewer/TextSelectionMenu.tsx   |   9 +-
 .../components/viewer/ThumbnailSidebar.tsx    |  14 +-
 .../viewer/ViewerAnnotationControls.tsx       |  19 +-
 .../components/viewer/ViewerShareButton.tsx   |  17 +-
 .../viewer/nonpdf/MarkdownRenderer.tsx        |   6 +-
 .../components/viewer/nonpdf/NonPdfBanner.tsx |   8 +-
 .../viewer/useViewerWorkbenchBarButtons.tsx   |  48 ++-
 .../src/core/contexts/FileManagerContext.tsx  |  13 +-
 .../core/contexts/UnsavedChangesContext.tsx   |   7 +-
 frontend/editor/src/core/pages/HomePage.tsx   |  21 +-
 .../src/core/pages/MobileScannerPage.tsx      |  66 ++--
 .../editor/src/core/styles/cookieconsent.css  |  39 +--
 frontend/editor/src/core/styles/theme.css     | 271 ++++++++--------
 .../live/viewer-sidebar-add-buttons.spec.ts   |   4 +-
 .../tests/stubbed/cert-sign-wizard.spec.ts    |  17 +-
 .../stubbed/page-editor-rotation.spec.ts      |   6 +-
 .../core/tests/stubbed/watermark-tool.spec.ts |   8 +-
 .../editor/src/core/theme/mantineTheme.ts     |  18 ++
 frontend/editor/src/core/tokens/tokens.css    |  13 +
 frontend/editor/src/core/tools/AddStamp.tsx   |   1 -
 frontend/editor/src/core/tools/Compare.tsx    |  45 ++-
 frontend/editor/src/core/tools/GetPdfInfo.tsx |  28 +-
 frontend/editor/src/core/tools/Merge.tsx      |   7 +-
 frontend/editor/src/core/tools/SharedSign.tsx |  40 ++-
 .../core/tools/annotate/AnnotationPanel.tsx   |  71 ++---
 .../core/tools/formFill/FormFieldSidebar.tsx  |  12 +-
 .../src/core/tools/formFill/FormFill.tsx      |  23 +-
 .../src/core/tools/formFill/FormSaveBar.tsx   |  31 +-
 frontend/editor/src/core/ui/ActionIcon.css    |  21 ++
 .../editor/src/core/ui/ActionIcon.stories.tsx | 132 ++++++++
 frontend/editor/src/core/ui/ActionIcon.tsx    | 140 +++++++++
 .../src/{proprietary => core}/ui/Avatar.css   |   0
 .../ui/Avatar.stories.tsx                     |   0
 .../src/{proprietary => core}/ui/Avatar.tsx   |   0
 .../src/{proprietary => core}/ui/Banner.css   |  15 +-
 .../ui/Banner.stories.tsx                     |   2 +-
 .../src/{proprietary => core}/ui/Banner.tsx   |  22 +-
 frontend/editor/src/core/ui/Button.css        |  41 +++
 .../editor/src/core/ui/Button.stories.tsx     | 293 ++++++++++++++++++
 frontend/editor/src/core/ui/Button.tsx        | 205 ++++++++++++
 .../src/{proprietary => core}/ui/Card.css     |  20 +-
 .../{proprietary => core}/ui/Card.stories.tsx |  42 ++-
 .../src/{proprietary => core}/ui/Card.tsx     |  10 +-
 .../ui/ChatFABButton.css                      |   0
 .../ui/ChatFABButton.stories.tsx              |   6 +-
 .../ui/ChatFABButton.tsx                      |  12 +-
 .../ui/ChatFABWindow.css                      |   4 +-
 .../ui/ChatFABWindow.stories.tsx              |   0
 .../ui/ChatFABWindow.tsx                      |   0
 .../src/{proprietary => core}/ui/Checkbox.css |   0
 .../src/{proprietary => core}/ui/Checkbox.tsx |   0
 frontend/editor/src/core/ui/Chip.css          |  49 +++
 frontend/editor/src/core/ui/Chip.stories.tsx  |  91 ++++++
 frontend/editor/src/core/ui/Chip.tsx          | 113 +++++++
 .../src/{proprietary => core}/ui/ChipFlow.css |   0
 .../ui/ChipFlow.stories.tsx                   |   0
 .../src/{proprietary => core}/ui/ChipFlow.tsx |  14 +-
 .../{proprietary => core}/ui/CodeBlock.css    |   0
 .../ui/CodeBlock.stories.tsx                  |   0
 .../{proprietary => core}/ui/CodeBlock.tsx    |  26 +-
 .../{proprietary => core}/ui/Collapsible.css  |   0
 .../ui/Collapsible.stories.tsx                |   0
 .../{proprietary => core}/ui/Collapsible.tsx  |   0
 .../{proprietary => core}/ui/ColorInput.tsx   |   0
 .../src/{proprietary => core}/ui/DataRow.css  |   0
 .../ui/DataRow.stories.tsx                    |   0
 .../src/{proprietary => core}/ui/DataRow.tsx  |   0
 .../src/{proprietary => core}/ui/Drawer.css   |  16 +-
 .../ui/Drawer.stories.tsx                     |   6 +-
 .../src/{proprietary => core}/ui/Drawer.tsx   |  51 ++-
 .../src/{proprietary => core}/ui/Dropdown.css |   0
 .../ui/Dropdown.stories.tsx                   |   8 +-
 .../src/{proprietary => core}/ui/Dropdown.tsx |   0
 .../{proprietary => core}/ui/EmptyState.css   |   0
 .../ui/EmptyState.stories.tsx                 |   4 +-
 .../{proprietary => core}/ui/EmptyState.tsx   |   0
 frontend/editor/src/core/ui/FilePicker.tsx    |  55 ++++
 .../{proprietary => core}/ui/FormField.css    |   0
 .../{proprietary => core}/ui/FormField.tsx    |   0
 .../ui/Forms.stories.tsx                      |   0
 .../{proprietary => core}/ui/IconBadge.css    |   0
 .../ui/IconBadge.stories.tsx                  |   0
 .../{proprietary => core}/ui/IconBadge.tsx    |   0
 .../src/{proprietary => core}/ui/Inline.css   |   0
 .../ui/Inline.stories.tsx                     |   6 +-
 .../src/{proprietary => core}/ui/Inline.tsx   |   0
 .../src/{proprietary => core}/ui/Input.css    |   0
 .../src/{proprietary => core}/ui/Input.tsx    |   0
 .../src/{proprietary => core}/ui/ListRow.css  |   0
 .../ui/ListRow.stories.tsx                    |   0
 .../src/{proprietary => core}/ui/ListRow.tsx  |   0
 .../{proprietary => core}/ui/MantineForms.css |   0
 .../ui/MantineForms.stories.tsx               |   0
 .../{proprietary => core}/ui/MethodBadge.css  |   0
 .../ui/MethodBadge.stories.tsx                |   0
 .../{proprietary => core}/ui/MethodBadge.tsx  |   0
 .../{proprietary => core}/ui/MetricCard.css   |   0
 .../ui/MetricCard.stories.tsx                 |   0
 .../{proprietary => core}/ui/MetricCard.tsx   |   0
 .../{proprietary => core}/ui/MetricStrip.css  |   0
 .../ui/MetricStrip.stories.tsx                |   0
 .../{proprietary => core}/ui/MetricStrip.tsx  |   0
 .../src/{proprietary => core}/ui/Modal.css    |  17 +-
 .../src/{proprietary => core}/ui/Modal.tsx    |  58 ++--
 .../{proprietary => core}/ui/MultiSelect.tsx  |   0
 .../src/{proprietary => core}/ui/NavItem.css  |   0
 .../ui/NavItem.stories.tsx                    |   0
 .../src/{proprietary => core}/ui/NavItem.tsx  |   0
 .../{proprietary => core}/ui/NumberInput.tsx  |   0
 .../{proprietary => core}/ui/PanelHeader.css  |   0
 .../ui/PanelHeader.stories.tsx                |  27 +-
 .../{proprietary => core}/ui/PanelHeader.tsx  |   3 -
 .../{proprietary => core}/ui/ProgressBar.css  |   0
 .../ui/ProgressBar.stories.tsx                |   0
 .../{proprietary => core}/ui/ProgressBar.tsx  |   0
 .../src/{proprietary => core}/ui/Radio.css    |   0
 .../src/{proprietary => core}/ui/Radio.tsx    |   0
 .../ui/SectionDivider.css                     |   0
 .../ui/SectionDivider.stories.tsx             |   0
 .../ui/SectionDivider.tsx                     |   0
 .../ui/SectionHeader.css                      |   0
 .../ui/SectionHeader.stories.tsx              |   0
 .../ui/SectionHeader.tsx                      |   0
 .../editor/src/core/ui/SegmentedControl.css   |  38 +++
 .../src/core/ui/SegmentedControl.stories.tsx  | 135 ++++++++
 .../editor/src/core/ui/SegmentedControl.tsx   | 103 ++++++
 .../src/{proprietary => core}/ui/Select.css   |   0
 .../src/{proprietary => core}/ui/Select.tsx   |   0
 .../{proprietary => core}/ui/SettingsRow.css  |   0
 .../ui/SettingsRow.stories.tsx                |   0
 .../{proprietary => core}/ui/SettingsRow.tsx  |   0
 .../ui/SettingsShell.css                      |  20 +-
 .../ui/SettingsShell.stories.tsx              |   4 +-
 .../ui/SettingsShell.tsx                      |  62 ++--
 .../src/{proprietary => core}/ui/Skeleton.css |   0
 .../ui/Skeleton.stories.tsx                   |   0
 .../src/{proprietary => core}/ui/Skeleton.tsx |   0
 .../src/{proprietary => core}/ui/Slider.css   |   0
 .../src/{proprietary => core}/ui/Slider.tsx   |   0
 .../src/{proprietary => core}/ui/Spinner.css  |   0
 .../ui/Spinner.stories.tsx                    |   0
 .../src/{proprietary => core}/ui/Spinner.tsx  |   0
 .../src/{proprietary => core}/ui/Stack.css    |   0
 .../ui/Stack.stories.tsx                      |   0
 .../src/{proprietary => core}/ui/Stack.tsx    |   0
 .../src/{proprietary => core}/ui/StatTile.css |   0
 .../ui/StatTile.stories.tsx                   |   0
 .../src/{proprietary => core}/ui/StatTile.tsx |   0
 .../{proprietary => core}/ui/StatusBadge.css  |   0
 .../ui/StatusBadge.stories.tsx                |   0
 .../{proprietary => core}/ui/StatusBadge.tsx  |   0
 .../ui/StepIndicator.css                      |   0
 .../ui/StepIndicator.stories.tsx              |   0
 .../ui/StepIndicator.tsx                      |   0
 .../src/{proprietary => core}/ui/Table.css    |   0
 .../ui/Table.stories.tsx                      |   0
 .../src/{proprietary => core}/ui/Table.tsx    |   0
 .../src/{proprietary => core}/ui/Tabs.css     |   0
 .../{proprietary => core}/ui/Tabs.stories.tsx |   0
 .../src/{proprietary => core}/ui/Tabs.tsx     |   0
 .../src/{proprietary => core}/ui/Toast.css    |  13 +-
 .../ui/Toast.stories.tsx                      |   0
 .../src/{proprietary => core}/ui/Toast.tsx    |  18 +-
 .../{proprietary => core}/ui/ToggleSwitch.css |   0
 .../ui/ToggleSwitch.stories.tsx               |   0
 .../{proprietary => core}/ui/ToggleSwitch.tsx |   0
 frontend/editor/src/core/ui/accents.css       | 101 ++++++
 .../ui/ariaForwarding.test.tsx                |   0
 .../ui/ariaForwarding.ts                      |   0
 frontend/editor/src/core/ui/controlSizes.ts   |   9 +
 .../src/{proprietary => core}/ui/index.ts     |   3 +
 .../desktop/components/ConnectionSettings.tsx |   9 +-
 .../components/DesktopOnboardingModal.tsx     |  24 +-
 .../SetupWizard/DesktopOAuthButtons.tsx       |   6 +-
 .../SetupWizard/SaaSLoginScreen.tsx           |  13 +-
 .../components/SetupWizard/SelfHostedLink.tsx |   7 +-
 .../SetupWizard/ServerSelection.tsx           |  15 +-
 .../desktop/components/SetupWizard/index.tsx  |  24 +-
 .../shared/SelfHostedOfflineBanner.tsx        |  22 +-
 .../configSections/DefaultAppSettings.tsx     |   6 +-
 .../toolPicker/ToolPickerFooterExtensions.tsx |   8 +-
 .../src/desktop/routes/login/LoginHeader.tsx  |   9 +-
 .../src/portal/components/AssistantButton.tsx |   7 +-
 .../src/portal/components/AssistantPanel.tsx  |  20 +-
 .../components/ChatFABWidget.stories.tsx      |  68 ++--
 .../portal/components/ErrorBoundary.test.tsx  |  12 +-
 .../editor/src/portal/components/Header.tsx   |  25 +-
 .../src/portal/components/MocksToggle.tsx     |   7 +-
 .../components/NotificationsDropdown.tsx      |  20 +-
 .../portal/components/PipelineForkWizard.tsx  |  13 +-
 .../src/portal/components/PolicySummary.tsx   |   4 +-
 .../src/portal/components/PopularUseCases.tsx |  32 +-
 .../components/ProcessingStatusStrip.tsx      |   4 +-
 .../src/portal/components/RecentActivity.tsx  |   6 +-
 .../src/portal/components/SearchModal.tsx     |  10 +-
 .../src/portal/components/SettingsModal.tsx   |  15 +-
 .../editor/src/portal/components/Sidebar.tsx  |   8 +-
 .../src/portal/components/SingleOpRunner.tsx  |  22 +-
 .../src/portal/components/WelcomeCarousel.tsx |   9 +-
 .../account-link/LinkAccountCard.tsx          |   4 +-
 .../account-link/LinkAccountModal.tsx         |   2 +-
 .../account-link/LinkedInstancesTable.tsx     |   4 +-
 .../agent-builder/AgentSelector.tsx           |  10 +-
 .../agent-builder/BootstrapDialog.tsx         |   2 +-
 .../components/agent-builder/EvalsPanel.tsx   |   2 +-
 .../agent-builder/ScenariosPanel.tsx          |   4 +-
 .../components/agent-builder/ToolsPanel.tsx   |   4 +-
 .../agent-builder/VersionsPanel.tsx           |   4 +-
 .../components/billing/EnterpriseUpsell.tsx   |   6 +-
 .../components/billing/FreePdfEditorsCard.tsx |   4 +-
 .../components/billing/FreePlanView.tsx       |   3 +-
 .../components/billing/InvoicesList.tsx       |   2 +-
 .../components/billing/LinkAccountPrompt.tsx  |   6 +-
 .../components/billing/PaymentMethodCard.tsx  |   2 +-
 .../components/billing/SpendLimitCard.tsx     |  11 +-
 .../billing/StripeCheckoutModal.tsx           |   2 +-
 .../components/catalogue/ComponentCard.tsx    |   2 +-
 .../catalogue/ComponentDetailModal.tsx        |   4 +-
 .../catalogue/ComponentPropsTable.tsx         |   2 +-
 .../components/docs/AuthenticationSection.tsx |   4 +-
 .../components/docs/ComponentsSection.tsx     |   2 +-
 .../src/portal/components/docs/DocsNav.tsx    |  10 +-
 .../components/docs/GettingStartedSection.tsx |   2 +-
 .../components/docs/PlaybooksSection.tsx      |   4 +-
 .../components/docs/WebhooksSection.tsx       |   2 +-
 .../editor-admin/CredentialRotationCard.tsx   |   4 +-
 .../editor-admin/DeploymentTargets.tsx        |   5 +-
 .../editor-admin/InstanceHealthTable.tsx      |  13 +-
 .../editor-admin/OfflineActivationCard.tsx    |  10 +-
 .../components/editor-admin/PairingPanel.tsx  |   8 +-
 .../components/infrastructure/ApiKeyCard.tsx  |  12 +-
 .../components/infrastructure/ApiKeysTab.tsx  |   3 +-
 .../infrastructure/CreateKeyModal.tsx         |   7 +-
 .../infrastructure/DeploymentsTab.tsx         |   6 +-
 .../components/infrastructure/ModelsTab.tsx   |   6 +-
 .../components/infrastructure/SecurityTab.tsx |   6 +-
 .../components/infrastructure/StorageTab.tsx  |   2 +-
 .../components/infrastructure/infraFormat.ts  |  12 +-
 .../components/pipelines/PipelineComposer.tsx |  17 +-
 .../pipelines/PipelineDetailCard.tsx          |  20 +-
 .../components/pipelines/PipelinesTable.tsx   |   2 +-
 .../policies/PolicyCategoryCard.tsx           |   4 +-
 .../components/policies/PolicyDetailPanel.tsx |  18 +-
 .../components/policies/PolicyFieldRow.tsx    |   2 +-
 .../components/policies/PolicySetupWizard.tsx |  16 +-
 .../components/procurement/ActionModal.tsx    |   8 +-
 .../components/procurement/DealJourney.tsx    |   4 +-
 .../components/procurement/DealStatusHero.tsx |   4 +-
 .../portal/components/procurement/DocRow.tsx  |  14 +-
 .../components/procurement/DocumentLedger.tsx |   4 +-
 .../components/procurement/LockedState.tsx    |   2 +-
 .../procurement/ProcurementAgreement.tsx      |   4 +-
 .../procurement/ProcurementExtras.tsx         |   4 +-
 .../procurement/ProcurementHome.tsx           |   8 +-
 .../procurement/ProcurementModal.stories.tsx  |   4 +-
 .../procurement/ProcurementStages.tsx         |  14 +-
 .../components/procurement/QuoteBuilder.tsx   |  14 +-
 .../components/sources/ConnectWizard.tsx      |  10 +-
 .../components/sources/SourceDetailCard.tsx   |  21 +-
 .../components/sources/SourceDetailPanel.tsx  |   2 +-
 .../components/sources/SourcesTable.tsx       |   4 +-
 .../portal/components/sources/sourceTypes.ts  |  10 +-
 .../components/users/AccessControls.tsx       |   4 +-
 .../components/users/InviteMemberModal.tsx    |   2 +-
 .../portal/components/users/MembersTable.tsx  |  23 +-
 .../src/portal/components/users/RolesGrid.tsx |   3 +-
 .../src/portal/components/users/format.ts     |  19 +-
 frontend/editor/src/portal/mocks/docs.ts      |  11 +-
 .../editor/src/portal/views/AgentBuilder.tsx  |   2 +-
 frontend/editor/src/portal/views/Home.tsx     |  43 +--
 .../src/portal/views/Infrastructure.tsx       |   2 +-
 .../src/portal/views/Pipelines.test.tsx       |  13 +-
 .../editor/src/portal/views/Pipelines.tsx     |   6 +-
 frontend/editor/src/portal/views/Policies.css |  74 +++++
 frontend/editor/src/portal/views/Policies.tsx |   2 +-
 frontend/editor/src/portal/views/Sources.css  |  10 +-
 .../editor/src/portal/views/Sources.test.tsx  |  13 +-
 frontend/editor/src/portal/views/Sources.tsx  |  10 +-
 frontend/editor/src/portal/views/Usage.tsx    |   2 +-
 frontend/editor/src/portal/views/Users.tsx    |   2 +-
 .../proprietary/auth/ui/EmailPasswordForm.tsx |  16 +-
 .../auth/ui/LoginRightCarousel.tsx            |  11 +-
 .../src/proprietary/auth/ui/OAuthButtons.tsx  |  85 +++--
 .../proprietary/auth/ui/SpringLoginForm.tsx   |   5 +-
 .../src/proprietary/auth/ui/auth-theme.css    |   4 +-
 .../editor/src/proprietary/auth/ui/auth.css   |  55 ++++
 .../proprietary/billing/SpendCapControl.tsx   |  12 +-
 .../proprietary/components/chat/ChatFAB.css   |   8 +
 .../proprietary/components/chat/ChatFAB.tsx   |  26 +-
 .../proprietary/components/chat/ChatPanel.css | 107 ++++++-
 .../proprietary/components/chat/ChatPanel.tsx |  20 +-
 .../components/chat/ChatQuickActions.tsx      |  23 +-
 .../components/policies/Policies.css          |   5 +
 .../components/policies/PoliciesSidebar.tsx   |  37 ++-
 .../policies/PolicyDeleteConfirmModal.tsx     |   7 +-
 .../components/policies/PolicyDetailPanel.tsx |  18 +-
 .../components/policies/PolicyFieldRow.tsx    |   7 +-
 .../components/policies/PolicySetupWizard.tsx |  11 +-
 .../components/policies/PolicyToolConfig.tsx  |   6 +-
 .../shared/ChangeUserPasswordModal.tsx        |  22 +-
 .../components/shared/InviteMembersModal.tsx  |  26 +-
 .../components/shared/ManageBillingButton.tsx |   4 +-
 .../components/shared/UpdateSeatsButton.tsx   |   6 +-
 .../components/shared/UpdateSeatsModal.tsx    |   4 +-
 .../components/shared/UpgradeBanner.tsx       |   2 +-
 .../shared/config/OverviewHeader.tsx          |   5 +-
 .../config/configSections/AccountSection.tsx  |  22 +-
 .../configSections/AdminAdvancedSection.tsx   |   6 +-
 .../configSections/AdminAuditSection.tsx      |   6 +-
 .../configSections/AdminDatabaseSection.tsx   |  36 ++-
 .../configSections/AdminGeneralSection.tsx    |   4 +-
 .../configSections/AdminUsageSection.tsx      |  35 +--
 .../configSections/LoginAgreementEditor.tsx   |   3 +-
 .../config/configSections/PeopleSection.tsx   |  38 ++-
 .../configSections/TeamDetailsSection.tsx     |  50 ++-
 .../config/configSections/TeamsSection.tsx    |  42 ++-
 .../configSections/apiKeys/ApiKeySection.tsx  |  27 +-
 .../configSections/apiKeys/RefreshModal.tsx   |   7 +-
 .../audit/AuditChartsSection.tsx              |  25 +-
 .../audit/AuditClearDataSection.tsx           |  12 +-
 .../configSections/audit/AuditEventsTable.tsx |  28 +-
 .../audit/AuditExportSection.tsx              |  21 +-
 .../configSections/audit/AuditFiltersForm.tsx |  28 +-
 .../plan/AvailablePlansSection.tsx            |   5 +-
 .../configSections/plan/LicenseKeySection.tsx |  52 ++--
 .../config/configSections/plan/PlanCard.tsx   |   6 +-
 .../plan/StaticCheckoutModal.tsx              |   8 +-
 .../configSections/plan/StaticPlanSection.tsx |  29 +-
 .../shared/stripeCheckout/StripeCheckout.tsx  |   5 +-
 .../stripeCheckout/stages/EmailStage.tsx      |   5 +-
 .../stripeCheckout/stages/ErrorStage.tsx      |   5 +-
 .../stages/PlanSelectionStage.tsx             |  15 +-
 .../stripeCheckout/stages/SuccessStage.tsx    |  19 +-
 .../watchedFolders/CardExpansionModal.tsx     |   6 +-
 .../DeleteFolderConfirmModal.tsx              |  12 +-
 .../watchedFolders/WatchedFolderCard.tsx      |  28 +-
 .../watchedFolders/WatchedFolderHomePage.tsx  |  34 +-
 .../WatchedFolderManagementModal.tsx          |  38 +--
 .../watchedFolders/WatchedFolderSection.tsx   |  10 +-
 .../WatchedFolderWorkbenchView.tsx            |  99 +++---
 .../components/workflow/ParticipantView.tsx   |  10 +-
 .../src/proprietary/routes/InviteAccept.tsx   |  10 +-
 .../editor/src/proprietary/routes/Landing.tsx |   5 +-
 .../src/proprietary/routes/Login.test.tsx     |  16 +-
 .../editor/src/proprietary/routes/Login.tsx   |  11 +-
 .../src/proprietary/routes/ShareLinkPage.tsx  |   4 +-
 .../editor/src/proprietary/routes/Signup.tsx  |   7 +-
 .../routes/login/NavigationLink.tsx           |   5 +-
 .../routes/login/OAuthButtons.stories.tsx     |  33 ++
 .../proprietary/routes/signup/SignupForm.tsx  |   3 +-
 frontend/editor/src/proprietary/ui/Button.css | 118 -------
 .../src/proprietary/ui/Button.stories.tsx     |  57 ----
 frontend/editor/src/proprietary/ui/Button.tsx |  68 ----
 frontend/editor/src/proprietary/ui/Chip.css   |  96 ------
 .../src/proprietary/ui/Chip.stories.tsx       |  79 -----
 frontend/editor/src/proprietary/ui/Chip.tsx   |  88 ------
 .../components/SignupRequiredBootstrap.tsx    |   5 +-
 .../saas/components/auth/GuestUserBanner.css  |  32 --
 .../saas/components/auth/GuestUserBanner.tsx  |  17 +-
 .../saas/components/shared/AppConfigModal.tsx |  12 +-
 .../shared/config/ProfilePictureCropper.tsx   |   5 +-
 .../shared/config/configSections/ApiKeys.tsx  |   3 +-
 .../config/configSections/McpSection.tsx      |  13 +-
 .../shared/config/configSections/Overview.tsx |  64 ++--
 .../configSections/PasswordSecurity.tsx       |   6 +-
 .../components/tools/sign/SignSettings.tsx    |  59 ++--
 .../editor/src/saas/routes/AuthCallback.tsx   |   4 +-
 frontend/editor/src/saas/routes/Login.tsx     |  37 +--
 .../editor/src/saas/routes/OAuthConsent.tsx   |  18 +-
 .../editor/src/saas/routes/ResetPassword.tsx  |   5 +-
 frontend/editor/src/saas/routes/Signup.tsx    |  21 +-
 .../routes/authShared/GuestSignInButton.tsx   |   9 +-
 .../src/saas/routes/authShared/saas-auth.css  |   5 +
 .../saas/routes/login/EmailPasswordForm.tsx   |   8 +-
 .../src/saas/routes/login/MagicLinkForm.tsx   |  10 +-
 .../src/saas/routes/login/OAuthButtons.tsx    |  29 +-
 .../editor/src/saas/styles/saas-theme.css     |  36 +--
 frontend/editor/tsconfig.portal.vite.json     |   2 +-
 frontend/editor/vitest.config.ts              |   2 +-
 frontend/eslint.config.mjs                    |  77 +++++
 frontend/scripts/find-unused-css.mjs          | 129 ++++++++
 frontend/shared/components/index.ts           |  45 +++
 592 files changed, 6399 insertions(+), 5057 deletions(-)
 create mode 100644 frontend/.storybook/declarations.d.ts
 create mode 100644 frontend/.storybook/tsconfig.json
 create mode 100644 frontend/editor/src/core/ui/ActionIcon.css
 create mode 100644 frontend/editor/src/core/ui/ActionIcon.stories.tsx
 create mode 100644 frontend/editor/src/core/ui/ActionIcon.tsx
 rename frontend/editor/src/{proprietary => core}/ui/Avatar.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Avatar.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Avatar.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Banner.css (85%)
 rename frontend/editor/src/{proprietary => core}/ui/Banner.stories.tsx (96%)
 rename frontend/editor/src/{proprietary => core}/ui/Banner.tsx (71%)
 create mode 100644 frontend/editor/src/core/ui/Button.css
 create mode 100644 frontend/editor/src/core/ui/Button.stories.tsx
 create mode 100644 frontend/editor/src/core/ui/Button.tsx
 rename frontend/editor/src/{proprietary => core}/ui/Card.css (74%)
 rename frontend/editor/src/{proprietary => core}/ui/Card.stories.tsx (82%)
 rename frontend/editor/src/{proprietary => core}/ui/Card.tsx (86%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABButton.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABButton.stories.tsx (90%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABButton.tsx (84%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABWindow.css (93%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABWindow.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ChatFABWindow.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Checkbox.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Checkbox.tsx (100%)
 create mode 100644 frontend/editor/src/core/ui/Chip.css
 create mode 100644 frontend/editor/src/core/ui/Chip.stories.tsx
 create mode 100644 frontend/editor/src/core/ui/Chip.tsx
 rename frontend/editor/src/{proprietary => core}/ui/ChipFlow.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ChipFlow.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ChipFlow.tsx (65%)
 rename frontend/editor/src/{proprietary => core}/ui/CodeBlock.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/CodeBlock.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/CodeBlock.tsx (66%)
 rename frontend/editor/src/{proprietary => core}/ui/Collapsible.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Collapsible.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Collapsible.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ColorInput.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/DataRow.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/DataRow.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/DataRow.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Drawer.css (83%)
 rename frontend/editor/src/{proprietary => core}/ui/Drawer.stories.tsx (91%)
 rename frontend/editor/src/{proprietary => core}/ui/Drawer.tsx (75%)
 rename frontend/editor/src/{proprietary => core}/ui/Dropdown.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Dropdown.stories.tsx (90%)
 rename frontend/editor/src/{proprietary => core}/ui/Dropdown.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/EmptyState.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/EmptyState.stories.tsx (90%)
 rename frontend/editor/src/{proprietary => core}/ui/EmptyState.tsx (100%)
 create mode 100644 frontend/editor/src/core/ui/FilePicker.tsx
 rename frontend/editor/src/{proprietary => core}/ui/FormField.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/FormField.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Forms.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/IconBadge.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/IconBadge.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/IconBadge.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Inline.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Inline.stories.tsx (88%)
 rename frontend/editor/src/{proprietary => core}/ui/Inline.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Input.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Input.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ListRow.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ListRow.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ListRow.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MantineForms.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MantineForms.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MethodBadge.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MethodBadge.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MethodBadge.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricCard.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricCard.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricCard.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricStrip.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricStrip.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/MetricStrip.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Modal.css (83%)
 rename frontend/editor/src/{proprietary => core}/ui/Modal.tsx (66%)
 rename frontend/editor/src/{proprietary => core}/ui/MultiSelect.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/NavItem.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/NavItem.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/NavItem.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/NumberInput.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/PanelHeader.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/PanelHeader.stories.tsx (75%)
 rename frontend/editor/src/{proprietary => core}/ui/PanelHeader.tsx (94%)
 rename frontend/editor/src/{proprietary => core}/ui/ProgressBar.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ProgressBar.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ProgressBar.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Radio.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Radio.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionDivider.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionDivider.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionDivider.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionHeader.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionHeader.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SectionHeader.tsx (100%)
 create mode 100644 frontend/editor/src/core/ui/SegmentedControl.css
 create mode 100644 frontend/editor/src/core/ui/SegmentedControl.stories.tsx
 create mode 100644 frontend/editor/src/core/ui/SegmentedControl.tsx
 rename frontend/editor/src/{proprietary => core}/ui/Select.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Select.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsRow.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsRow.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsRow.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsShell.css (88%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsShell.stories.tsx (94%)
 rename frontend/editor/src/{proprietary => core}/ui/SettingsShell.tsx (65%)
 rename frontend/editor/src/{proprietary => core}/ui/Skeleton.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Skeleton.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Skeleton.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Slider.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Slider.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Spinner.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Spinner.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Spinner.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Stack.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Stack.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Stack.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatTile.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatTile.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatTile.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatusBadge.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatusBadge.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StatusBadge.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StepIndicator.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StepIndicator.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/StepIndicator.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Table.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Table.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Table.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Tabs.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Tabs.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Tabs.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Toast.css (81%)
 rename frontend/editor/src/{proprietary => core}/ui/Toast.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/Toast.tsx (90%)
 rename frontend/editor/src/{proprietary => core}/ui/ToggleSwitch.css (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ToggleSwitch.stories.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ToggleSwitch.tsx (100%)
 create mode 100644 frontend/editor/src/core/ui/accents.css
 rename frontend/editor/src/{proprietary => core}/ui/ariaForwarding.test.tsx (100%)
 rename frontend/editor/src/{proprietary => core}/ui/ariaForwarding.ts (100%)
 create mode 100644 frontend/editor/src/core/ui/controlSizes.ts
 rename frontend/editor/src/{proprietary => core}/ui/index.ts (92%)
 create mode 100644 frontend/editor/src/proprietary/routes/login/OAuthButtons.stories.tsx
 delete mode 100644 frontend/editor/src/proprietary/ui/Button.css
 delete mode 100644 frontend/editor/src/proprietary/ui/Button.stories.tsx
 delete mode 100644 frontend/editor/src/proprietary/ui/Button.tsx
 delete mode 100644 frontend/editor/src/proprietary/ui/Chip.css
 delete mode 100644 frontend/editor/src/proprietary/ui/Chip.stories.tsx
 delete mode 100644 frontend/editor/src/proprietary/ui/Chip.tsx
 create mode 100644 frontend/scripts/find-unused-css.mjs
 create mode 100644 frontend/shared/components/index.ts

diff --git a/frontend/.storybook/declarations.d.ts b/frontend/.storybook/declarations.d.ts
new file mode 100644
index 0000000000..ef6d741f62
--- /dev/null
+++ b/frontend/.storybook/declarations.d.ts
@@ -0,0 +1 @@
+declare module "*.css" {}
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index cd601cf525..bab413a0e8 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -14,7 +14,7 @@ void React;
 
 import { TierProvider, type Tier } from "@portal/contexts/TierContext";
 import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
-import { ThemeProvider } from "@portal/contexts/ThemeContext";
+import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
 import { UIProvider } from "@portal/contexts/UIContext";
 import { SuiProvider } from "@portal/theme/SuiProvider";
 import { handlers } from "@portal/mocks/handlers";
@@ -78,13 +78,21 @@ function TierKey({
   );
 }
 
-/** Keeps useTheme() and the data-theme attribute in sync. */
-function ThemeWatcher() {
+/**
+ * Makes the Storybook toolbar the SINGLE source of truth for the theme.
+ */
+function ThemeBridge({
+  theme,
+  children,
+}: {
+  theme: "light" | "dark";
+  children: React.ReactNode;
+}) {
+  const { setTheme } = useTheme();
   useEffect(() => {
-    // The addon-themes decorator already sets data-theme on <html>.
-    // We just read it on mount so ThemeProvider picks it up.
-  }, []);
-  return null;
+    setTheme(theme);
+  }, [theme, setTheme]);
+  return <>{children}</>;
 }
 
 const withProviders: Decorator = (Story, context) => {
@@ -101,20 +109,21 @@ const withProviders: Decorator = (Story, context) => {
   return (
     <MemoryRouter initialEntries={["/"]}>
       <ThemeProvider>
-        <SuiProvider colorScheme={colorScheme}>
-          {/* LinkProvider must wrap TierProvider: TierContext derives its tier
-              from useLink() (matches App.tsx's nesting). */}
-          <LinkProvider key={linkState} initialState={linkState}>
-            <TierKey tier={tier}>
-              <UIProvider>
-                <ThemeWatcher />
-                <Suspense fallback={null}>
-                  <Story />
-                </Suspense>
-              </UIProvider>
-            </TierKey>
-          </LinkProvider>
-        </SuiProvider>
+        <ThemeBridge theme={colorScheme}>
+          <SuiProvider colorScheme={colorScheme}>
+            {/* LinkProvider must wrap TierProvider: TierContext derives its tier
+                from useLink() (matches App.tsx's nesting). */}
+            <LinkProvider key={linkState} initialState={linkState}>
+              <TierKey tier={tier}>
+                <UIProvider>
+                  <Suspense fallback={null}>
+                    <Story />
+                  </Suspense>
+                </UIProvider>
+              </TierKey>
+            </LinkProvider>
+          </SuiProvider>
+        </ThemeBridge>
       </ThemeProvider>
     </MemoryRouter>
   );
diff --git a/frontend/.storybook/tsconfig.json b/frontend/.storybook/tsconfig.json
new file mode 100644
index 0000000000..9615d34a22
--- /dev/null
+++ b/frontend/.storybook/tsconfig.json
@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "paths": {
+      "@app/*": [
+        "../editor/src/desktop/*",
+        "../editor/src/proprietary/*",
+        "../editor/src/core/*"
+      ],
+      "@core/*": ["../editor/src/core/*"],
+      "@proprietary/*": ["../editor/src/proprietary/*"],
+      "@portal/*": ["../editor/src/portal/*"]
+    },
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["./**/*"]
+}
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 241289d1db..6d827eb895 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7,6 +7,7 @@ black = "Black"
 blue = "Blue"
 cancel = "Cancel"
 chooseFile = "Choose File"
+clear = "Clear"
 close = "Close"
 comingSoon = "Coming soon"
 confirm = "Confirm"
@@ -87,6 +88,7 @@ processingCompleteMultiple = "{{count}} files are ready."
 property = "Property"
 quickPosition = "Quick Position"
 red = "Red"
+remove = "Remove"
 reset = "Reset"
 review = "Review"
 save = "Save"
@@ -180,6 +182,7 @@ addMoreFiles = "Add more files..."
 attachments = "Select Attachments"
 info = "Select files to attach to your PDF. These files will be embedded and accessible through the PDF's attachment panel."
 placeholder = "Choose files..."
+removeFile = "Remove file"
 selectedFiles = "Selected Files"
 submit = "Add Attachments"
 
@@ -1628,6 +1631,9 @@ title = "Do you want to help make Stirling PDF better?"
 tags = "annotate,highlight,draw,markup,comment,notes,review,redline,feedback,markup tools,sticky notes,shapes,arrows,text box,freehand"
 
 [annotation]
+alignCenter = "Align center"
+alignLeft = "Align left"
+alignRight = "Align right"
 annotationStyle = "Annotation style"
 backgroundColor = "Background color"
 borderOff = "Border: Off"
@@ -2531,6 +2537,7 @@ title = "Rule of thumb"
 
 [certSign.source]
 device = "This device"
+noOtherSources = "No other certificate sources are available."
 server = "Server"
 stepTitle = "Certificate source"
 upload = "Upload"
@@ -3595,7 +3602,9 @@ makeCopy = "Make a copy"
 mobileShort = "Mobile"
 mobileUpload = "Mobile Upload"
 mobileUploadNotAvailable = "Mobile upload not enabled"
+moreOptions = "More options"
 myFiles = "My Files"
+nextFile = "Next file"
 noFiles = "No files available"
 noFilesFound = "No files found matching your search"
 noRecentFiles = "No recent files found"
@@ -3605,6 +3614,7 @@ openInFileEditor = "Open in File Editor"
 openInPageEditor = "Open in Page Editor"
 owner = "Owner"
 ownerUnknown = "Unknown"
+previousFile = "Previous file"
 recent = "Recent"
 removeBoth = "Remove from both"
 removeFilePrompt = "This file is saved on this device and on your server. Where would you like to remove it from?"
@@ -4614,10 +4624,10 @@ welcomeTitle = "You've been invited!"
 [landing]
 addFiles = "Add Files"
 heroSubtitle = "Drop in or add an existing PDF to get started."
-heroTitle = "Stirling PDF"
 mobileUpload = "Upload from Mobile"
 openFromComputer = "Open from computer"
 uploadFromComputer = "Upload from computer"
+workbenchEmptyStateHero = "Drop a PDF anywhere"
 
 [language]
 direction = "ltr"
@@ -4930,6 +4940,7 @@ title = "Output"
 [onboarding]
 activeFiles = "The <strong>Active Files</strong> view shows all of the PDFs you have loaded into the tool, and allows you to select which ones to process."
 allTools = "This is the <strong>Tools</strong> panel, where you can browse and select from all available PDF tools."
+close = "Close"
 cropSettings = "Now that we've selected the file we want crop, we can configure the Crop tool to choose the area that we want to crop the PDF to."
 fileCheckbox = "Clicking one of the files selects it for processing. You can select multiple files for batch operations."
 fileReplacement = "The modified file will replace the original file in the Workbench automatically, allowing you to easily run it through more tools."
@@ -4955,6 +4966,7 @@ skipTheTour = "Skip the tour"
 
 [onboarding.desktopInstall]
 body = "Stirling works best as a desktop app. You can use it offline, access documents faster, and make edits locally on your computer."
+selectOs = "Select operating system"
 title = "Download"
 titleWithOs = "Download for {{osLabel}}"
 
@@ -5566,7 +5578,9 @@ viewLabel = "PDF Editor"
 
 [pdfTextEditor.actions]
 applyChanges = "Apply Changes"
+clearText = "Clear text"
 downloadCopy = "Download Copy"
+moreOptions = "More options"
 reset = "Reset Changes"
 
 [pdfTextEditor.badges]
@@ -9670,7 +9684,9 @@ memberRemoved = "Member removed successfully"
 namePlaceholder = "Enter team name"
 personal = "Personal"
 removeError = "Failed to remove member"
+renameCancel = "Cancel rename"
 renameError = "Failed to rename team"
+renameSubmit = "Save team name"
 renameSuccess = "Team renamed successfully"
 
 [team.invitationBanner]
@@ -9686,6 +9702,7 @@ sendButton = "Send Invitation"
 title = "Invite Team Member"
 
 [team.members]
+actions = "Member actions"
 emailColumn = "Email"
 empty = "No team members yet"
 nameColumn = "Name"
@@ -10041,14 +10058,23 @@ zoomOut = "Zoom Out"
 [viewer.attachments]
 addAttachment = "Add attachment"
 close = "Close attachments"
+closeSidebar = "Close attachments sidebar"
+download = "Download attachment"
 empty = "No attachments in this document"
 loading = "Loading attachments..."
 noDocument = "Open a PDF to view its attachments."
 noMatch = "No attachments match your search"
 noSupport = "Attachment support is unavailable for this viewer."
+retry = "Retry"
 searchPlaceholder = "Search attachments"
 title = "Attachments"
 
+[viewer.bookmarks]
+bookmarkTitle = "Bookmark title"
+closeSidebar = "Close bookmarks sidebar"
+collapseAll = "Collapse all bookmarks"
+expandAll = "Expand all bookmarks"
+
 [viewer.comments]
 addComment = "Add comment"
 addCommentPlaceholder = "Add comment..."
@@ -10059,6 +10085,7 @@ clearAll = "Clear all comments"
 clearAllDescription = "This removes comments and replies from the sidebar while keeping any attached annotations in the document."
 clearAllTitle = "Clear all comments?"
 close = "Close comments"
+closeSidebar = "Close comments sidebar"
 deleteAnnotationAndComment = "Delete annotation & comment"
 deleteDescription = "This annotation has a comment attached. You can remove just the comment from the sidebar while keeping the annotation, or delete everything."
 deleteTitle = "Remove annotation from comments?"
@@ -10090,6 +10117,11 @@ title = "Form Fields"
 unsavedBadge = "Unsaved"
 unsavedDesc = "You have unsaved changes"
 
+[viewer.layers]
+closeSidebar = "Close layers sidebar"
+hideAll = "Hide all layers"
+showAll = "Show all layers"
+
 [viewer.link]
 delete = "Delete link"
 
@@ -10120,6 +10152,9 @@ resultsOf = "of {{total}}"
 [viewer.signature]
 delete = "Delete signature"
 
+[viewer.thumbnails]
+closeSidebar = "Close thumbnails sidebar"
+
 [viewPdf]
 tags = "view,read,annotate,text,image,highlight,edit"
 title = "View/Edit PDF"
@@ -10546,6 +10581,7 @@ loading = "Loading people..."
 locked = "locked"
 lockedBadge = "Locked"
 loginRequired = "Enable login mode first"
+memberActions = "Member actions"
 noMembersFound = "No members found"
 role = "Role"
 searchMembers = "Search members..."
@@ -10555,6 +10591,7 @@ unlockAccount = "Unlock Account"
 unlockUserError = "Failed to unlock user account"
 unlockUserSuccess = "User account unlocked successfully"
 user = "User"
+userInfo = "User info"
 
 [workspace.people.actions]
 upgrade = "Upgrade"
@@ -10700,6 +10737,7 @@ removeMemberError = "Failed to remove user from team"
 removeMemberSuccess = "User removed from team"
 renameTeamLabel = "Rename Team"
 system = "System"
+teamActions = "Team actions"
 teamName = "Team Name"
 teamNotFound = "Team not found"
 title = "Teams"
diff --git a/frontend/editor/src/cloud/components/onboarding/renderButtons.tsx b/frontend/editor/src/cloud/components/onboarding/renderButtons.tsx
index f2857af460..7ff108d121 100644
--- a/frontend/editor/src/cloud/components/onboarding/renderButtons.tsx
+++ b/frontend/editor/src/cloud/components/onboarding/renderButtons.tsx
@@ -1,5 +1,7 @@
 import React from "react";
-import { Button, Group, ActionIcon } from "@mantine/core";
+import { Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import { TFunction } from "i18next";
 import {
@@ -31,22 +33,6 @@ export function renderButtons({
     (btn) => btn.group === "right",
   );
 
-  const buttonStyles = (variant: ButtonDefinition["variant"]) =>
-    variant === "primary"
-      ? {
-          root: {
-            background: "var(--onboarding-primary-button-bg)",
-            color: "var(--onboarding-primary-button-text)",
-          },
-        }
-      : {
-          root: {
-            background: "var(--onboarding-secondary-button-bg)",
-            border: "1px solid var(--onboarding-secondary-button-border)",
-            color: "var(--onboarding-secondary-button-text)",
-          },
-        };
-
   const resolveButtonLabel = (button: ButtonDefinition) => {
     // Translate the label (it's a translation key)
     const label = button.label ?? "";
@@ -65,20 +51,15 @@ export function renderButtons({
         <ActionIcon
           key={button.key}
           onClick={() => onAction(button.action)}
-          radius="md"
-          size={40}
+          size="lg"
+          variant="secondary"
+          accent="neutral"
           disabled={disabled}
-          styles={{
-            root: {
-              background: "var(--onboarding-secondary-button-bg)",
-              border: "1px solid var(--onboarding-secondary-button-border)",
-              color: "var(--onboarding-secondary-button-text)",
-            },
-          }}
+          aria-label={t("onboarding.buttons.back", "Back")}
         >
-          {button.icon === "chevron-left" && (
+          {button.icon === "chevron-left" ? (
             <ChevronLeftIcon fontSize="small" />
-          )}
+          ) : null}
         </ActionIcon>
       );
     }
@@ -91,7 +72,8 @@ export function renderButtons({
         key={button.key}
         onClick={() => onAction(button.action)}
         disabled={disabled}
-        styles={buttonStyles(variant)}
+        variant={variant === "primary" ? "primary" : "secondary"}
+        accent="neutral"
       >
         {label}
       </Button>
diff --git a/frontend/editor/src/cloud/components/onboarding/slides/TeamSlide.tsx b/frontend/editor/src/cloud/components/onboarding/slides/TeamSlide.tsx
index 03eadf0f4c..a1948f2f06 100644
--- a/frontend/editor/src/cloud/components/onboarding/slides/TeamSlide.tsx
+++ b/frontend/editor/src/cloud/components/onboarding/slides/TeamSlide.tsx
@@ -1,5 +1,6 @@
 import React, { useEffect, useState } from "react";
-import { Badge, Button, TextInput } from "@mantine/core";
+import { Badge, TextInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { SlideConfig } from "@app/types/types";
 import { createLightSlideBackground } from "@app/components/onboarding/slides/unifiedBackgroundConfig";
diff --git a/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx b/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
index 7db30887e7..177a15b7af 100644
--- a/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
+++ b/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
@@ -1,5 +1,6 @@
 import { useMemo } from "react";
-import { Modal, Stack, Button } from "@mantine/core";
+import { Modal, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import CelebrationIcon from "@mui/icons-material/CelebrationOutlined";
 import AnimatedSlideBackground from "@app/components/onboarding/slides/AnimatedSlideBackground";
@@ -169,7 +170,7 @@ export function FreeLimitReachedModal({ onClose }: FreeLimitReachedModalProps) {
               >
                 <Button
                   onClick={onClose}
-                  variant="default"
+                  variant="secondary"
                   size="sm"
                   className="free-limit-modal-button"
                   style={{
diff --git a/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx b/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
index c124b9baec..91f4ec6e95 100644
--- a/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
+++ b/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
@@ -1,5 +1,6 @@
 import { useMemo } from "react";
-import { Modal, Stack, Button } from "@mantine/core";
+import { Modal, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import TrendingUpIcon from "@mui/icons-material/TrendingUpOutlined";
 import AnimatedSlideBackground from "@app/components/onboarding/slides/AnimatedSlideBackground";
@@ -167,7 +168,7 @@ export function SpendCapReachedModal({ onClose }: SpendCapReachedModalProps) {
               >
                 <Button
                   onClick={onClose}
-                  variant="default"
+                  variant="secondary"
                   size="sm"
                   className="spend-cap-modal-button"
                   style={{
diff --git a/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx b/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
index aa07d823df..3b373e9c3b 100644
--- a/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
+++ b/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
-import { Button, Group, Text } from "@mantine/core";
+import { Group, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { InfoBanner } from "@app/components/shared/InfoBanner";
@@ -75,9 +76,9 @@ export function TeamInvitationBanner() {
   const actionButtons = (
     <Group gap="xs" wrap="nowrap">
       <Button
-        variant="white"
-        color="gray"
-        size="xs"
+        variant="secondary"
+        accent="neutral"
+        size="sm"
         onClick={handleAccept}
         loading={processing}
         leftSection={
@@ -88,17 +89,12 @@ export function TeamInvitationBanner() {
             style={{ color: "var(--mantine-color-dark-9)" }}
           />
         }
-        styles={{
-          label: {
-            color: "var(--mantine-color-dark-9)",
-          },
-        }}
       >
         {t("team.invitationBanner.acceptButton", "Accept")}
       </Button>
       <Button
-        variant="subtle"
-        size="xs"
+        variant="tertiary"
+        size="sm"
         onClick={handleReject}
         loading={processing}
         style={{ color: "rgba(255, 255, 255, 0.7)" }}
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
index 8e1921d061..cf9378ac9e 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
@@ -14,14 +14,13 @@
   --payg-divider: var(--border-subtle);
 }
 
-/* Dark mode: the modal content bg is #2a2f36 and so is --bg-surface, so plain
-   cards vanish. Lift cards a shade above the modal and strengthen borders. */
+/* Dark mode: modal content bg is #131729 (--bg-surface), so lift cards above it */
 [data-mantine-color-scheme="dark"] .payg {
-  --payg-card-bg: #313842;
-  --payg-card-border: #3d444e;
-  --payg-inset-bg: #272c33;
-  --payg-accent-soft: rgba(10, 139, 255, 0.16);
-  --payg-divider: #3d444e;
+  --payg-card-bg: #1c2340;
+  --payg-card-border: #2d3560;
+  --payg-inset-bg: #0d1020;
+  --payg-accent-soft: rgba(79, 142, 245, 0.16);
+  --payg-divider: #2d3560;
 }
 
 /* ── Header ─────────────────────────────────────────────────────────── */
@@ -258,16 +257,16 @@
 
 /* Dark mode: the stock default button is a flat slab that disappears into the
    card. Lift it with a soft top-down gradient + brighter border, and warm the
-   hover so the buttons feel tactile against --payg-card-bg (#313842). Driven
+   hover so the buttons feel tactile against --payg-card-bg (#1c2340). Driven
    through Mantine's --button-* vars. The same rule covers disabled buttons
    (Cancel/Update cap before the form is dirty) so they read identically to the
    always-enabled ones — Mantine only fades them via opacity. */
 [data-mantine-color-scheme="dark"]
   .payg
   .mantine-Button-root[data-variant="default"] {
-  --button-bg: linear-gradient(180deg, #3d4651 0%, #353d48 100%);
-  --button-hover: linear-gradient(180deg, #475160 0%, #3d4654 100%);
-  --button-bd: 1px solid #4b5563;
+  --button-bg: linear-gradient(180deg, #232a50 0%, #1c2340 100%);
+  --button-hover: linear-gradient(180deg, #2d3560 0%, #232a50 100%);
+  --button-bd: 1px solid #2d3560;
   --button-color: var(--mantine-color-white);
   box-shadow:
     0 1px 0 rgba(255, 255, 255, 0.04) inset,
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
index ea0e7f3d32..8cf61f2385 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
@@ -16,7 +16,8 @@
  *     V1 — so it shows a real empty state, not fabricated rows
  */
 import React, { useState } from "react";
-import { Button, Group, Stack, Text } from "@mantine/core";
+import { Group, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useRenderCount } from "@app/hooks/useRenderCount";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
 import LockIcon from "@mui/icons-material/LockOutlined";
@@ -110,16 +111,16 @@ export function DocHelp() {
   const [open, setOpen] = useState(false);
   return (
     <div className="payg-help">
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         className="payg-help__toggle"
         aria-expanded={open}
         onClick={() => setOpen((o) => !o)}
+        leftSection={<HelpOutlineIcon sx={{ fontSize: 15 }} />}
       >
-        <HelpOutlineIcon sx={{ fontSize: 15 }} />
         {t("payg.docHelp.toggle", "What counts as a PDF?")}
         <ExpandMoreIcon className="payg-help__chevron" sx={{ fontSize: 16 }} />
-      </button>
+      </Button>
       {open && (
         <div className="payg-help__panel">
           <ul>
@@ -446,16 +447,16 @@ function CapReachedHelp() {
   const [open, setOpen] = useState(false);
   return (
     <div className="payg-help">
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         className="payg-help__toggle"
         aria-expanded={open}
         onClick={() => setOpen((o) => !o)}
+        leftSection={<HelpOutlineIcon sx={{ fontSize: 15 }} />}
       >
-        <HelpOutlineIcon sx={{ fontSize: 15 }} />
         {t("payg.gates.title", "What happens when the cap is reached")}
         <ExpandMoreIcon className="payg-help__chevron" sx={{ fontSize: 16 }} />
-      </button>
+      </Button>
       {open && (
         <div className="payg-help__panel">
           <div className="payg-gates">
@@ -656,7 +657,7 @@ function StripePortalLink({
         onClick={handleClick}
         loading={loading}
         rightSection={<OpenInNewIcon sx={{ fontSize: 16 }} />}
-        variant="light"
+        variant="secondary"
       >
         {t("payg.stripe.open", "Open billing portal")}
       </Button>
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
index 17ef96e8b3..6ade6c7b6d 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
@@ -217,25 +217,6 @@
   border-top: 1px solid var(--payg-divider);
   padding-top: 16px;
 }
-.paygf-cta__button {
-  padding: 13px 22px;
-  border: none;
-  border-radius: 11px;
-  background: linear-gradient(135deg, var(--payg-accent) 0%, #6c5ce7 100%);
-  color: white;
-  font-weight: 600;
-  font-size: 0.95rem;
-  font-family: inherit;
-  cursor: pointer;
-  transition:
-    transform 120ms ease,
-    box-shadow 120ms ease;
-  white-space: nowrap;
-}
-.paygf-cta__button:hover {
-  transform: translateY(-1px);
-  box-shadow: 0 8px 22px -6px rgba(10, 139, 255, 0.55);
-}
 .paygf-cta__reassurance {
   margin: 0;
   font-size: 0.78rem;
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.tsx
index 330bffa71e..ae3738bd5f 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.tsx
@@ -25,6 +25,7 @@
  */
 import React, { useState } from "react";
 import { Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import BoltIcon from "@mui/icons-material/BoltRounded";
 import AllInclusiveIcon from "@mui/icons-material/AllInclusiveRounded";
 import CheckIcon from "@mui/icons-material/CheckRounded";
@@ -171,14 +172,14 @@ function ProcessorCard({ snap, isLeader, onTurnOn }: ProcessorCardProps) {
           <FreeMeterPanel snap={snap} />
           {isLeader ? (
             <>
-              <button
-                type="button"
-                className="paygf-cta__button paygf-proc__cta"
+              <Button
+                fullWidth
+                className="paygf-proc__cta"
                 onClick={onTurnOn}
                 data-testid="turn-on-processor"
               >
                 {t("payg.free.cta.button", "Turn on Processor →")}
-              </button>
+              </Button>
               <span className="paygf-cta__reassurance paygf-proc__reassure">
                 {t(
                   "payg.free.cta.reassurance",
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
index 90083fb80e..bc9ce0cef8 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
@@ -22,10 +22,10 @@
   gap: 14px;
 }
 [data-mantine-color-scheme="dark"] .scc {
-  --scc-accent-text: #66b8ff;
-  --scc-accent-soft: rgba(10, 139, 255, 0.16);
-  --scc-chip-bg: #272d35;
-  --scc-chip-border: #3d444e;
+  --scc-accent-text: #7ab4ff;
+  --scc-accent-soft: rgba(79, 142, 245, 0.16);
+  --scc-chip-bg: #1c2340;
+  --scc-chip-border: #2d3560;
 }
 
 /* ── Inline row: presets · custom · no-cap · (save) ──────────────────── */
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/StripeCheckoutPanel.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/StripeCheckoutPanel.tsx
index 1ffc9f4ee2..03584f11de 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/StripeCheckoutPanel.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/StripeCheckoutPanel.tsx
@@ -64,6 +64,7 @@
  */
 import React, { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import { useAuth } from "@app/auth/UseSession";
 import {
   createCheckoutSession,
@@ -267,17 +268,12 @@ const StripeCheckoutPanel: React.FC<StripeCheckoutPanelProps> = ({
               )}
         </div>
         <div style={{ marginTop: 12 }}>
-          <button
-            type="button"
-            className="upm-btn"
-            data-variant="primary"
-            onClick={onComplete}
-          >
+          <Button onClick={onComplete}>
             {t(
               "payg.checkout.mock.continue",
               "Continue with mock subscription",
             )}
-          </button>
+          </Button>
         </div>
       </div>
     );
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
index 6755a4d746..44fc59c738 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
@@ -1,6 +1,5 @@
 import React, { useState, useEffect } from "react";
 import {
-  Button,
   TextInput,
   Group,
   Text,
@@ -8,9 +7,10 @@ import {
   Alert,
   Table,
   Badge,
-  ActionIcon,
   Menu,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { useSaaSTeam } from "@app/contexts/SaaSTeamContext";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -233,19 +233,18 @@ const TeamSection: React.FC = () => {
                   }}
                 />
                 <ActionIcon
-                  variant="filled"
-                  color="blue"
                   onClick={handleRenameSubmit}
                   loading={renamingTeam}
                   disabled={!newTeamName.trim()}
+                  aria-label={t("team.renameSubmit", "Save team name")}
                 >
                   <LocalIcon icon="check" width="1rem" height="1rem" />
                 </ActionIcon>
                 <ActionIcon
-                  variant="subtle"
-                  color="gray"
+                  variant="tertiary"
                   onClick={handleCancelRename}
                   disabled={renamingTeam}
+                  aria-label={t("team.renameCancel", "Cancel rename")}
                 >
                   <LocalIcon icon="close" width="1rem" height="1rem" />
                 </ActionIcon>
@@ -257,7 +256,7 @@ const TeamSection: React.FC = () => {
                 </Text>
                 {isTeamLeader && !isPersonalTeam && (
                   <ActionIcon
-                    variant="subtle"
+                    variant="tertiary"
                     size="sm"
                     onClick={handleStartRename}
                     aria-label={t("team.editName", "Edit team name")}
@@ -285,9 +284,9 @@ const TeamSection: React.FC = () => {
           </div>
           {!isPersonalTeam && !isTeamLeader && !isEditingName && (
             <Button
-              color="red"
-              variant="outline"
-              size="xs"
+              accent="danger"
+              variant="secondary"
+              size="sm"
               onClick={handleLeaveTeam}
               leftSection={
                 <LocalIcon icon="logout" width="1rem" height="1rem" />
@@ -449,7 +448,13 @@ const TeamSection: React.FC = () => {
                             zIndex={Z_INDEX_OVER_CONFIG_MODAL}
                           >
                             <Menu.Target>
-                              <ActionIcon variant="subtle">
+                              <ActionIcon
+                                variant="tertiary"
+                                aria-label={t(
+                                  "team.members.actions",
+                                  "Member actions",
+                                )}
+                              >
                                 <LocalIcon
                                   icon="more-vert"
                                   width="1rem"
@@ -504,8 +509,8 @@ const TeamSection: React.FC = () => {
                       {isTeamLeader && !isPersonalTeam && (
                         <Table.Td>
                           <ActionIcon
-                            variant="subtle"
-                            color="red"
+                            variant="tertiary"
+                            accent="danger"
                             onClick={() =>
                               handleCancelInvitation(
                                 invitation.invitationId,
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
index 2e7aafef5c..c6da318f0f 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
@@ -17,10 +17,10 @@
   --upm-muted: var(--text-muted);
 }
 [data-mantine-color-scheme="dark"] .upm {
-  --upm-card-bg: #313842;
-  --upm-border: #3d444e;
-  --upm-divider: #3d444e;
-  --upm-accent-soft: rgba(10, 139, 255, 0.14);
+  --upm-card-bg: #1c2340;
+  --upm-border: #2d3560;
+  --upm-divider: #2d3560;
+  --upm-accent-soft: rgba(79, 142, 245, 0.14);
 }
 
 /* Backdrop locks the page and centres the modal. z-index matches
@@ -101,26 +101,6 @@
   color: var(--upm-text);
   margin: 0;
 }
-.upm-header__close {
-  background: transparent;
-  border: none;
-  color: var(--upm-muted);
-  cursor: pointer;
-  width: 32px;
-  height: 32px;
-  border-radius: 8px;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  transition:
-    background 120ms ease,
-    color 120ms ease;
-}
-.upm-header__close:hover {
-  background: var(--upm-divider);
-  color: var(--upm-text);
-}
-
 /* Left cluster: optional back arrow + title. The back arrow only renders on the
    checkout step (cap/confirm have no parent step to return to) — it replaces the
    old footer "← Back" button. */
@@ -130,28 +110,6 @@
   gap: 6px;
   min-width: 0;
 }
-.upm-header__back {
-  background: transparent;
-  border: none;
-  color: var(--upm-muted);
-  cursor: pointer;
-  width: 32px;
-  height: 32px;
-  border-radius: 8px;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  margin-left: -6px;
-  transition:
-    background 120ms ease,
-    color 120ms ease;
-}
-.upm-header__back:hover {
-  background: var(--upm-divider);
-  color: var(--upm-text);
-}
-
 .upm-steps {
   display: flex;
   align-items: center;
@@ -357,41 +315,6 @@
   display: flex;
   gap: 8px;
 }
-.upm-btn {
-  padding: 10px 18px;
-  border-radius: 10px;
-  border: 1.5px solid transparent;
-  font-weight: 600;
-  font-size: 0.9rem;
-  cursor: pointer;
-  transition: all 120ms ease;
-  font-family: inherit;
-  white-space: nowrap;
-}
-.upm-btn[data-variant="ghost"] {
-  background: transparent;
-  border-color: var(--upm-divider);
-  color: var(--upm-text);
-}
-.upm-btn[data-variant="ghost"]:hover {
-  border-color: var(--upm-accent);
-  color: var(--upm-accent);
-}
-.upm-btn[data-variant="primary"] {
-  background: linear-gradient(135deg, var(--upm-accent), var(--upm-accent-2));
-  color: white;
-}
-.upm-btn[data-variant="primary"]:hover {
-  transform: translateY(-1px);
-  box-shadow: 0 6px 18px -6px rgba(10, 139, 255, 0.5);
-}
-.upm-btn[disabled] {
-  opacity: 0.5;
-  cursor: not-allowed;
-  transform: none !important;
-  box-shadow: none !important;
-}
-
 /* ── Step 3: confirmation ─────────────────────────────────────────────── */
 
 .upm-confirm {
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.tsx
index 0ca290611b..bdbd84c6bc 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.tsx
@@ -18,6 +18,8 @@
  */
 import React, { Suspense, useEffect, useState } from "react";
 import { createPortal } from "react-dom";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/CloseRounded";
 import ArrowBackIcon from "@mui/icons-material/ArrowBackRounded";
 import ShieldIcon from "@mui/icons-material/ShieldOutlined";
@@ -152,14 +154,14 @@ export default function UpgradeModal({
           <header className="upm-header">
             <div className="upm-header__left">
               {step === "checkout" && (
-                <button
-                  type="button"
-                  className="upm-header__back"
+                <ActionIcon
+                  variant="tertiary"
                   aria-label={t("payg.upgrade.backAria", "Back")}
                   onClick={goBackToCap}
+                  style={{ marginLeft: -6 }}
                 >
                   <ArrowBackIcon fontSize="small" />
-                </button>
+                </ActionIcon>
               )}
               <h2 className="upm-header__title">
                 {step === "confirm"
@@ -170,14 +172,13 @@ export default function UpgradeModal({
                     )}
               </h2>
             </div>
-            <button
-              type="button"
-              className="upm-header__close"
+            <ActionIcon
+              variant="tertiary"
               aria-label={t("payg.upgrade.closeAria", "Close")}
               onClick={closeAndReset}
             >
               <CloseIcon fontSize="small" />
-            </button>
+            </ActionIcon>
           </header>
 
           {/* Step indicator. Hidden on the confirmation panel since the
@@ -198,13 +199,13 @@ export default function UpgradeModal({
                           "{{symbol}}{{amount}} / month",
                           { symbol: sym, amount: effectiveCap },
                         )}
-                    <button
-                      type="button"
+                    <Button
+                      variant="tertiary"
                       className="upm-step__edit"
                       onClick={goBackToCap}
                     >
                       {t("payg.upgrade.checkout.edit", "Edit")}
-                    </button>
+                    </Button>
                   </span>
                 ) : (
                   <span>
@@ -264,36 +265,23 @@ export default function UpgradeModal({
               <div className="upm-footer__actions">
                 {step === "cap" && (
                   <>
-                    <button
-                      type="button"
-                      className="upm-btn"
-                      data-variant="ghost"
-                      onClick={closeAndReset}
-                    >
+                    <Button variant="secondary" onClick={closeAndReset}>
                       {t("payg.upgrade.button.cancel", "Cancel")}
-                    </button>
-                    <button
-                      type="button"
-                      className="upm-btn"
-                      data-variant="primary"
-                      onClick={goToCheckout}
-                    >
+                    </Button>
+                    <Button onClick={goToCheckout}>
                       {t("payg.upgrade.button.continue", "Continue →")}
-                    </button>
+                    </Button>
                   </>
                 )}
                 {step === "confirm" && (
-                  <button
-                    type="button"
-                    className="upm-btn"
-                    data-variant="primary"
+                  <Button
                     onClick={() => {
                       setStep("cap");
                       onComplete({ capUsd: effectiveCap });
                     }}
                   >
                     {t("payg.upgrade.button.finish", "Finish")}
-                  </button>
+                  </Button>
                 )}
               </div>
             </footer>
diff --git a/frontend/editor/src/core/assets/login/github.svg b/frontend/editor/src/core/assets/login/github.svg
index 651eaac2b8..1174b67928 100644
--- a/frontend/editor/src/core/assets/login/github.svg
+++ b/frontend/editor/src/core/assets/login/github.svg
@@ -1,3 +1,3 @@
 <svg width="37" height="36" viewBox="0 0 37 36" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M18.5 3.3125C16.5712 3.3125 14.6613 3.6924 12.8793 4.43052C11.0974 5.16864 9.47823 6.25051 8.11437 7.61437C5.35993 10.3688 3.8125 14.1046 3.8125 18C3.8125 24.4919 8.02781 29.9997 13.8588 31.9531C14.5931 32.0706 14.8281 31.6153 14.8281 31.2187V28.7366C10.7597 29.6178 9.89312 26.7684 9.89312 26.7684C9.2175 25.0647 8.26281 24.6094 8.26281 24.6094C6.92625 23.6987 8.36562 23.7281 8.36562 23.7281C9.83437 23.8309 10.6128 25.2409 10.6128 25.2409C11.8906 27.4734 14.0497 26.8125 14.8869 26.46C15.0191 25.5053 15.4009 24.8591 15.8122 24.4919C12.5516 24.1247 9.12937 22.8616 9.12937 17.2656C9.12937 15.6353 9.6875 14.3281 10.6422 13.2853C10.4953 12.9181 9.98125 11.3906 10.7891 9.40781C10.7891 9.40781 12.0228 9.01125 14.8281 10.9059C15.9884 10.5828 17.2516 10.4212 18.5 10.4212C19.7484 10.4212 21.0116 10.5828 22.1719 10.9059C24.9772 9.01125 26.2109 9.40781 26.2109 9.40781C27.0188 11.3906 26.5047 12.9181 26.3578 13.2853C27.3125 14.3281 27.8706 15.6353 27.8706 17.2656C27.8706 22.8762 24.4338 24.11 21.1584 24.4772C21.6872 24.9325 22.1719 25.8284 22.1719 27.1944V31.2187C22.1719 31.6153 22.4069 32.0853 23.1559 31.9531C28.9869 29.985 33.1875 24.4919 33.1875 18C33.1875 16.0712 32.8076 14.1613 32.0695 12.3793C31.3314 10.5974 30.2495 8.97823 28.8856 7.61437C27.5218 6.25051 25.9026 5.16864 24.1207 4.43052C22.3387 3.6924 20.4288 3.3125 18.5 3.3125Z" fill="black"/>
+<path d="M18.5 3.3125C16.5712 3.3125 14.6613 3.6924 12.8793 4.43052C11.0974 5.16864 9.47823 6.25051 8.11437 7.61437C5.35993 10.3688 3.8125 14.1046 3.8125 18C3.8125 24.4919 8.02781 29.9997 13.8588 31.9531C14.5931 32.0706 14.8281 31.6153 14.8281 31.2187V28.7366C10.7597 29.6178 9.89312 26.7684 9.89312 26.7684C9.2175 25.0647 8.26281 24.6094 8.26281 24.6094C6.92625 23.6987 8.36562 23.7281 8.36562 23.7281C9.83437 23.8309 10.6128 25.2409 10.6128 25.2409C11.8906 27.4734 14.0497 26.8125 14.8869 26.46C15.0191 25.5053 15.4009 24.8591 15.8122 24.4919C12.5516 24.1247 9.12937 22.8616 9.12937 17.2656C9.12937 15.6353 9.6875 14.3281 10.6422 13.2853C10.4953 12.9181 9.98125 11.3906 10.7891 9.40781C10.7891 9.40781 12.0228 9.01125 14.8281 10.9059C15.9884 10.5828 17.2516 10.4212 18.5 10.4212C19.7484 10.4212 21.0116 10.5828 22.1719 10.9059C24.9772 9.01125 26.2109 9.40781 26.2109 9.40781C27.0188 11.3906 26.5047 12.9181 26.3578 13.2853C27.3125 14.3281 27.8706 15.6353 27.8706 17.2656C27.8706 22.8762 24.4338 24.11 21.1584 24.4772C21.6872 24.9325 22.1719 25.8284 22.1719 27.1944V31.2187C22.1719 31.6153 22.4069 32.0853 23.1559 31.9531C28.9869 29.985 33.1875 24.4919 33.1875 18C33.1875 16.0712 32.8076 14.1613 32.0695 12.3793C31.3314 10.5974 30.2495 8.97823 28.8856 7.61437C27.5218 6.25051 25.9026 5.16864 24.1207 4.43052C22.3387 3.6924 20.4288 3.3125 18.5 3.3125Z" fill="currentColor"/>
 </svg>
diff --git a/frontend/editor/src/core/components/StorageStatsCard.tsx b/frontend/editor/src/core/components/StorageStatsCard.tsx
index 468d24fe37..186b56c4ca 100644
--- a/frontend/editor/src/core/components/StorageStatsCard.tsx
+++ b/frontend/editor/src/core/components/StorageStatsCard.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Card, Group, Text, Button, Progress } from "@mantine/core";
+import { Card, Group, Text, Progress } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import StorageIcon from "@mui/icons-material/Storage";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -58,21 +59,16 @@ const StorageStatsCard: React.FC<StorageStatsCardProps> = ({
         <Group gap="xs">
           {filesCount > 0 && (
             <Button
-              variant="light"
-              color="red"
-              size="xs"
+              variant="secondary"
+              accent="danger"
+              size="sm"
               onClick={onClearAll}
               leftSection={<DeleteIcon style={{ fontSize: 16 }} />}
             >
               {t("fileManager.clearAll", "Clear All")}
             </Button>
           )}
-          <Button
-            variant="light"
-            color="blue"
-            size="xs"
-            onClick={onReloadFiles}
-          >
+          <Button variant="secondary" size="sm" onClick={onReloadFiles}>
             Reload Files
           </Button>
         </Group>
diff --git a/frontend/editor/src/core/components/annotation/shared/ColorControl.tsx b/frontend/editor/src/core/components/annotation/shared/ColorControl.tsx
index ca41f0f6a2..524314ee62 100644
--- a/frontend/editor/src/core/components/annotation/shared/ColorControl.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/ColorControl.tsx
@@ -1,5 +1,4 @@
 import {
-  ActionIcon,
   Tooltip,
   Popover,
   Stack,
@@ -10,6 +9,7 @@ import {
 import { useState, useCallback, useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import ColorizeIcon from "@mui/icons-material/Colorize";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 // safari and firefox do not support the eye dropper API, only edge, chrome and opera do.
 // the button is hidden in the UI if the API is not supported.
@@ -66,24 +66,12 @@ export function ColorControl({
       <Popover.Target>
         <Tooltip label={label}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={label}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={() => setOpened(!opened)}
             disabled={disabled}
-            styles={{
-              root: {
-                flexShrink: 0,
-                backgroundColor: "var(--bg-raised)",
-                border: "1px solid var(--border-default)",
-                color: "var(--text-secondary)",
-                "&:hover": {
-                  backgroundColor: "var(--hover-bg)",
-                  borderColor: "var(--border-strong)",
-                  color: "var(--text-primary)",
-                },
-              },
-            }}
           >
             <ColorSwatch color={localColor} size={18} />
           </ActionIcon>
@@ -117,11 +105,14 @@ export function ColorControl({
                 label={t("color.eyeDropper.tooltip", "Pick colour from screen")}
               >
                 <ActionIcon
-                  variant="subtle"
-                  color="gray"
+                  aria-label={t(
+                    "color.eyeDropper.tooltip",
+                    "Pick colour from screen",
+                  )}
+                  variant="tertiary"
+                  accent="neutral"
                   size="sm"
                   onClick={handleEyeDropper}
-                  style={{ color: "var(--text-primary)" }}
                 >
                   <ColorizeIcon style={{ fontSize: 16 }} />
                 </ActionIcon>
diff --git a/frontend/editor/src/core/components/annotation/shared/ColorPicker.tsx b/frontend/editor/src/core/components/annotation/shared/ColorPicker.tsx
index e12db7f340..ec854426e6 100644
--- a/frontend/editor/src/core/components/annotation/shared/ColorPicker.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/ColorPicker.tsx
@@ -4,13 +4,12 @@ import {
   Stack,
   ColorPicker as MantineColorPicker,
   Group,
-  Button,
   ColorSwatch,
   Slider,
   Text,
 } from "@mantine/core";
 import { useTranslation } from "react-i18next";
-
+import { Button } from "@app/ui/Button";
 interface ColorPickerProps {
   isOpen: boolean;
   onClose: () => void;
diff --git a/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.tsx b/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.tsx
index 08808b5b61..c10d9d9023 100644
--- a/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.tsx
@@ -1,6 +1,7 @@
 import React, { useEffect, useRef, useState } from "react";
-import { Paper, Button, Modal, Stack, Text, Group } from "@mantine/core";
+import { Paper, Modal, Stack, Text, Group } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import { ColorSwatchButton } from "@app/components/annotation/shared/ColorPicker";
 import PenSizeSelector from "@app/components/tools/sign/PenSizeSelector";
 import SignaturePad from "signature_pad";
@@ -331,7 +332,7 @@ export const DrawingCanvas: React.FC<DrawingCanvasProps> = ({
           </PrivateContent>
 
           <div style={{ display: "flex", justifyContent: "space-between" }}>
-            <Button variant="subtle" color="red" onClick={clear}>
+            <Button variant="tertiary" accent="danger" onClick={clear}>
               {t("sign.canvas.clear", "Clear canvas")}
             </Button>
             <Button onClick={closeModal}>{t("common.done", "Done")}</Button>
diff --git a/frontend/editor/src/core/components/annotation/shared/DrawingControls.tsx b/frontend/editor/src/core/components/annotation/shared/DrawingControls.tsx
index 7118a817e8..0844125117 100644
--- a/frontend/editor/src/core/components/annotation/shared/DrawingControls.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/DrawingControls.tsx
@@ -1,7 +1,9 @@
 import React from "react";
-import { Group, Button, ActionIcon, Tooltip } from "@mantine/core";
+import { Group, Tooltip } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { LocalIcon } from "@app/components/shared/LocalIcon";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 interface DrawingControlsProps {
   onUndo?: () => void;
@@ -37,12 +39,11 @@ export const DrawingControls: React.FC<DrawingControlsProps> = ({
       {onUndo && (
         <Tooltip label={t("sign.undo", "Undo")}>
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
             size="lg"
             aria-label={t("sign.undo", "Undo")}
             onClick={onUndo}
             disabled={undoDisabled}
-            color={undoDisabled ? "gray" : "blue"}
           >
             <LocalIcon
               icon="undo"
@@ -56,12 +57,11 @@ export const DrawingControls: React.FC<DrawingControlsProps> = ({
       {onRedo && (
         <Tooltip label={t("sign.redo", "Redo")}>
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
             size="lg"
             aria-label={t("sign.redo", "Redo")}
             onClick={onRedo}
             disabled={redoDisabled}
-            color={redoDisabled ? "gray" : "blue"}
           >
             <LocalIcon
               icon="redo"
@@ -78,11 +78,9 @@ export const DrawingControls: React.FC<DrawingControlsProps> = ({
       {/* Place Signature Button */}
       {showPlaceButton && onPlaceSignature && (
         <Button
-          variant="filled"
-          color="blue"
           onClick={onPlaceSignature}
           disabled={disabled || !hasSignatureData}
-          ml="auto"
+          style={{ marginLeft: "auto" }}
         >
           {placeButtonText}
         </Button>
diff --git a/frontend/editor/src/core/components/annotation/shared/OpacityControl.tsx b/frontend/editor/src/core/components/annotation/shared/OpacityControl.tsx
index 496b5c4070..3853fa32c2 100644
--- a/frontend/editor/src/core/components/annotation/shared/OpacityControl.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/OpacityControl.tsx
@@ -1,14 +1,8 @@
-import {
-  ActionIcon,
-  Tooltip,
-  Popover,
-  Stack,
-  Slider,
-  Text,
-} from "@mantine/core";
+import { Tooltip, Popover, Stack, Slider, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { useState } from "react";
 import OpacityIcon from "@mui/icons-material/Opacity";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 interface OpacityControlProps {
   value: number; // 0-100
@@ -29,24 +23,12 @@ export function OpacityControl({
       <Popover.Target>
         <Tooltip label={t("annotation.opacity", "Opacity")}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={t("annotation.opacity", "Opacity")}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={() => setOpened(!opened)}
             disabled={disabled}
-            styles={{
-              root: {
-                flexShrink: 0,
-                backgroundColor: "var(--bg-raised)",
-                border: "1px solid var(--border-default)",
-                color: "var(--text-secondary)",
-                "&:hover": {
-                  backgroundColor: "var(--hover-bg)",
-                  borderColor: "var(--border-strong)",
-                  color: "var(--text-primary)",
-                },
-              },
-            }}
           >
             <OpacityIcon style={{ fontSize: 18 }} />
           </ActionIcon>
diff --git a/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.tsx b/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.tsx
index 5f23b81ede..2f2a42b982 100644
--- a/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.tsx
@@ -1,14 +1,7 @@
-import {
-  ActionIcon,
-  Tooltip,
-  Popover,
-  Stack,
-  Slider,
-  Text,
-  Group,
-  Button,
-} from "@mantine/core";
+import { Tooltip, Popover, Stack, Slider, Text, Group } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useState } from "react";
 import type { TrackedAnnotation } from "@embedpdf/plugin-annotation";
 import type { PdfAnnotationObject } from "@embedpdf/models";
@@ -106,21 +99,24 @@ export function PropertiesPopover({
         </Text>
         <Group gap="xs">
           <ActionIcon
-            variant={currentAlign === "left" ? "filled" : "default"}
+            aria-label={t("annotation.alignLeft", "Align left")}
+            variant={currentAlign === "left" ? "primary" : "secondary"}
             onClick={() => onUpdate({ textAlign: 0 })}
             size="md"
           >
             <FormatAlignLeftIcon style={{ fontSize: 18 }} />
           </ActionIcon>
           <ActionIcon
-            variant={currentAlign === "center" ? "filled" : "default"}
+            aria-label={t("annotation.alignCenter", "Align center")}
+            variant={currentAlign === "center" ? "primary" : "secondary"}
             onClick={() => onUpdate({ textAlign: 1 })}
             size="md"
           >
             <FormatAlignCenterIcon style={{ fontSize: 18 }} />
           </ActionIcon>
           <ActionIcon
-            variant={currentAlign === "right" ? "filled" : "default"}
+            aria-label={t("annotation.alignRight", "Align right")}
+            variant={currentAlign === "right" ? "primary" : "secondary"}
             onClick={() => onUpdate({ textAlign: 2 })}
             size="md"
           >
@@ -176,8 +172,8 @@ export function PropertiesPopover({
             />
           </div>
           <Button
-            size="xs"
-            variant={!borderVisible ? "filled" : "light"}
+            size="sm"
+            variant={!borderVisible ? "primary" : "secondary"}
             onClick={() => {
               const newValue = borderVisible ? 0 : 1;
               onUpdate({
@@ -201,24 +197,12 @@ export function PropertiesPopover({
       <Popover.Target>
         <Tooltip label={t("annotation.properties", "Properties")}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={t("annotation.properties", "Properties")}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={() => setOpened(!opened)}
             disabled={disabled}
-            styles={{
-              root: {
-                flexShrink: 0,
-                backgroundColor: "var(--bg-raised)",
-                border: "1px solid var(--border-default)",
-                color: "var(--text-secondary)",
-                "&:hover": {
-                  backgroundColor: "var(--hover-bg)",
-                  borderColor: "var(--border-strong)",
-                  color: "var(--text-primary)",
-                },
-              },
-            }}
           >
             <TuneIcon style={{ fontSize: 18 }} />
           </ActionIcon>
diff --git a/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
index a1a07a95b7..60905d3065 100644
--- a/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
@@ -7,8 +7,8 @@ import {
   useCombobox,
   Group,
   Box,
-  SegmentedControl,
 } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import { ColorPicker } from "@app/components/annotation/shared/ColorPicker";
 
@@ -253,14 +253,14 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
 
       {/* Text Alignment */}
       {onTextAlignChange && (
-        <SegmentedControl
+        <SegmentedControl<"left" | "center" | "right">
           value={textAlign}
-          onChange={(value: string) => {
-            onTextAlignChange(value as "left" | "center" | "right");
+          onChange={(value) => {
+            onTextAlignChange(value);
             onAnyChange?.();
           }}
-          disabled={disabled}
-          data={[
+          loading={disabled}
+          options={[
             { label: t("textAlign.left", "Left"), value: "left" },
             { label: t("textAlign.center", "Center"), value: "center" },
             { label: t("textAlign.right", "Right"), value: "right" },
diff --git a/frontend/editor/src/core/components/annotation/shared/WidthControl.tsx b/frontend/editor/src/core/components/annotation/shared/WidthControl.tsx
index d4f063f604..b7e9d28531 100644
--- a/frontend/editor/src/core/components/annotation/shared/WidthControl.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/WidthControl.tsx
@@ -1,14 +1,8 @@
-import {
-  ActionIcon,
-  Tooltip,
-  Popover,
-  Stack,
-  Slider,
-  Text,
-} from "@mantine/core";
+import { Tooltip, Popover, Stack, Slider, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { useState } from "react";
 import LineWeightIcon from "@mui/icons-material/LineWeight";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 interface WidthControlProps {
   value: number;
@@ -33,24 +27,12 @@ export function WidthControl({
       <Popover.Target>
         <Tooltip label={t("annotation.width", "Width")}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={t("annotation.width", "Width")}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={() => setOpened(!opened)}
             disabled={disabled}
-            styles={{
-              root: {
-                flexShrink: 0,
-                backgroundColor: "var(--bg-raised)",
-                border: "1px solid var(--border-default)",
-                color: "var(--text-secondary)",
-                "&:hover": {
-                  backgroundColor: "var(--hover-bg)",
-                  borderColor: "var(--border-strong)",
-                  color: "var(--text-primary)",
-                },
-              },
-            }}
           >
             <LineWeightIcon style={{ fontSize: 18 }} />
           </ActionIcon>
diff --git a/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx b/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
index 00c9e4b396..bf19c16967 100644
--- a/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
+++ b/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
@@ -1,5 +1,6 @@
 import React, { useRef, useState } from "react";
-import { Button, Group } from "@mantine/core";
+import { Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useFilesModalContext } from "@app/contexts/FilesModalContext";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -106,6 +107,7 @@ const AddFileCard = ({
           >
             {!isUploadHover && (
               <Button
+                variant="tertiary"
                 style={{
                   backgroundColor: "var(--landing-button-bg)",
                   color: "var(--landing-button-color)",
@@ -133,6 +135,7 @@ const AddFileCard = ({
               </Button>
             )}
             <Button
+              variant="tertiary"
               aria-label={t("addFileCard.upload", "Upload")}
               title={terminology.uploadFromComputer}
               style={{
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
index 2e601f8f7f..da407cf261 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
+++ b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
@@ -291,15 +291,15 @@
    DARK MODE OVERRIDES
    ========================= */
 :global([data-mantine-color-scheme="dark"]) .card {
-  outline-color: #3a4047; /* deselected stroke */
+  outline-color: #1c2340; /* deselected stroke */
 }
 
 :global([data-mantine-color-scheme="dark"]) .card[data-selected="true"] {
-  outline-color: #4b525a; /* selected stroke (subtle grey) */
+  outline-color: #2d3560; /* selected stroke (subtle navy) */
 }
 
 :global([data-mantine-color-scheme="dark"]) .headerResting {
-  background: #1f2329; /* requested default unselected color */
+  background: #0d1020; /* requested default unselected color */
   color: var(--tool-header-text); /* #D0D6DC */
   border-bottom-color: var(--tool-header-border); /* #3A4047 */
 }
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
index 87bcfab3f1..07d134f75c 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
@@ -1,13 +1,7 @@
 import React, { useState, useCallback, useRef, useMemo } from "react";
-import {
-  Text,
-  Modal,
-  Button,
-  Group,
-  Stack,
-  ActionIcon,
-  Tooltip,
-} from "@mantine/core";
+import { Text, Modal, Group, Stack, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
 import { useIsMobile } from "@app/hooks/useIsMobile";
 import { alert } from "@app/components/toast";
 import { useTranslation } from "react-i18next";
@@ -545,9 +539,12 @@ const FileEditorThumbnail = ({
                     )}
                   >
                     <ActionIcon
-                      size="xs"
-                      variant="filled"
-                      color="yellow"
+                      size="sm"
+                      accent="warning"
+                      aria-label={t(
+                        "encryptedPdfUnlock.unlockPrompt",
+                        "Unlock PDF to continue",
+                      )}
                       onClick={(e) => {
                         e.stopPropagation();
                         openEncryptedUnlockPrompt(file.id);
@@ -606,17 +603,13 @@ const FileEditorThumbnail = ({
                 <PrivateContent>{file.name}</PrivateContent>
               </Text>
               <Group justify="flex-end" gap="sm">
-                <Button variant="light" onClick={handleCancelClose}>
+                <Button variant="secondary" onClick={handleCancelClose}>
                   {t("confirmCloseCancel", "Cancel")}
                 </Button>
-                <Button
-                  variant="filled"
-                  color="red"
-                  onClick={handleConfirmClose}
-                >
+                <Button accent="danger" onClick={handleConfirmClose}>
                   {t("confirmCloseDiscard", "Discard changes and close")}
                 </Button>
-                <Button variant="filled" onClick={handleSaveAndClose}>
+                <Button onClick={handleSaveAndClose}>
                   {t("confirmCloseSave", "Save and close")}
                 </Button>
               </Group>
@@ -633,14 +626,10 @@ const FileEditorThumbnail = ({
                 <PrivateContent>{file.name}</PrivateContent>
               </Text>
               <Group justify="flex-end" gap="sm">
-                <Button variant="light" onClick={handleCancelClose}>
+                <Button variant="secondary" onClick={handleCancelClose}>
                   {t("confirmCloseCancel", "Cancel")}
                 </Button>
-                <Button
-                  variant="filled"
-                  color="red"
-                  onClick={handleConfirmClose}
-                >
+                <Button accent="danger" onClick={handleConfirmClose}>
                   {t("confirmCloseConfirm", "Close File")}
                 </Button>
               </Group>
diff --git a/frontend/editor/src/core/components/fileManager/CompactFileDetails.tsx b/frontend/editor/src/core/components/fileManager/CompactFileDetails.tsx
index 09ca9a10b1..11657cc288 100644
--- a/frontend/editor/src/core/components/fileManager/CompactFileDetails.tsx
+++ b/frontend/editor/src/core/components/fileManager/CompactFileDetails.tsx
@@ -1,5 +1,7 @@
 import React from "react";
-import { Stack, Box, Text, Button, ActionIcon, Center } from "@mantine/core";
+import { Stack, Box, Text, Center } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import ChevronRightIcon from "@mui/icons-material/ChevronRight";
@@ -128,18 +130,20 @@ const CompactFileDetails: React.FC<CompactFileDetailsProps> = ({
         {hasMultipleFiles && (
           <Box style={{ display: "flex", gap: "0.25rem" }}>
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="sm"
               onClick={onPrevious}
               disabled={isAnimating}
+              aria-label={t("fileManager.previousFile", "Previous file")}
             >
               <ChevronLeftIcon style={{ fontSize: 16 }} />
             </ActionIcon>
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="sm"
               onClick={onNext}
               disabled={isAnimating}
+              aria-label={t("fileManager.nextFile", "Next file")}
             >
               <ChevronRightIcon style={{ fontSize: 16 }} />
             </ActionIcon>
@@ -150,16 +154,10 @@ const CompactFileDetails: React.FC<CompactFileDetailsProps> = ({
       {/* Action Button */}
       <Button
         size="sm"
+        accent="neutral"
         onClick={onOpenFiles}
         disabled={!hasSelection && !canCloseAll}
         fullWidth
-        style={{
-          backgroundColor:
-            hasSelection || canCloseAll
-              ? "var(--btn-open-file)"
-              : "var(--mantine-color-gray-4)",
-          color: "white",
-        }}
       >
         {canCloseAll
           ? t("fileManager.closeAllFiles", "Close all files")
diff --git a/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx b/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
index 422dd8306e..95cbff8b9b 100644
--- a/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
+++ b/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Button, Group, Text, Stack } from "@mantine/core";
+import { Group, Text, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import HistoryIcon from "@mui/icons-material/History";
 import { useTranslation } from "react-i18next";
 import { useFileManagerContext } from "@app/contexts/FileManagerContext";
@@ -77,6 +78,7 @@ const EmptyFilesState: React.FC = () => {
           onMouseLeave={() => setIsUploadHover(false)}
         >
           <Button
+            variant="tertiary"
             aria-label={t("emptyFilesState.upload", "Upload")}
             style={{
               backgroundColor: "var(--bg-file-manager)",
diff --git a/frontend/editor/src/core/components/fileManager/FileActions.tsx b/frontend/editor/src/core/components/fileManager/FileActions.tsx
index e228bc9457..3226420c3f 100644
--- a/frontend/editor/src/core/components/fileManager/FileActions.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileActions.tsx
@@ -1,11 +1,7 @@
 import React, { useEffect } from "react";
-import {
-  Group,
-  Text,
-  ActionIcon,
-  Tooltip,
-  SegmentedControl,
-} from "@mantine/core";
+import { Group, Text, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import SelectAllIcon from "@mui/icons-material/SelectAll";
 import DeleteIcon from "@mui/icons-material/Delete";
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
@@ -131,26 +127,29 @@ const FileActions: React.FC = () => {
           }
         >
           <ActionIcon
-            variant="light"
+            variant="secondary"
             size="sm"
-            color="dimmed"
             onClick={handleSelectAll}
             disabled={filteredFiles.length === 0}
-            radius="sm"
+            aria-label={
+              allFilesSelected
+                ? t("fileManager.deselectAll", "Deselect All")
+                : t("fileManager.selectAll", "Select All")
+            }
           >
             <SelectAllIcon style={{ fontSize: "1rem" }} />
           </ActionIcon>
         </Tooltip>
         {showStorageFilter && (
           <SegmentedControl
-            size="xs"
+            size="sm"
             value={storageFilter}
             onChange={(value) =>
               onStorageFilterChange(
                 value as "all" | "local" | "sharedWithMe" | "sharedByMe",
               )
             }
-            data={storageFilterOptions}
+            options={storageFilterOptions}
           />
         )}
       </Group>
@@ -177,12 +176,11 @@ const FileActions: React.FC = () => {
         {uploadEnabled && (
           <Tooltip label={t("fileManager.uploadSelected", "Upload Selected")}>
             <ActionIcon
-              variant="light"
+              variant="secondary"
               size="sm"
-              color="dimmed"
               onClick={() => setShowBulkUploadModal(true)}
               disabled={!canBulkUpload}
-              radius="sm"
+              aria-label={t("fileManager.uploadSelected", "Upload Selected")}
             >
               <CloudUploadIcon style={{ fontSize: "1rem" }} />
             </ActionIcon>
@@ -191,12 +189,11 @@ const FileActions: React.FC = () => {
         {shareLinksEnabled && (
           <Tooltip label={t("fileManager.shareSelected", "Share Selected")}>
             <ActionIcon
-              variant="light"
+              variant="secondary"
               size="sm"
-              color="dimmed"
               onClick={() => setShowBulkShareModal(true)}
               disabled={!canBulkShare}
-              radius="sm"
+              aria-label={t("fileManager.shareSelected", "Share Selected")}
             >
               <LinkIcon style={{ fontSize: "1rem" }} />
             </ActionIcon>
@@ -204,12 +201,12 @@ const FileActions: React.FC = () => {
         )}
         <Tooltip label={t("fileManager.deleteSelected", "Delete Selected")}>
           <ActionIcon
-            variant="light"
+            variant="secondary"
             size="sm"
-            color="dimmed"
+            accent="danger"
             onClick={handleDeleteSelected}
             disabled={!hasSelection}
-            radius="sm"
+            aria-label={t("fileManager.deleteSelected", "Delete Selected")}
           >
             <DeleteIcon style={{ fontSize: "1rem" }} />
           </ActionIcon>
@@ -217,12 +214,11 @@ const FileActions: React.FC = () => {
 
         <Tooltip label={terminology.downloadSelected}>
           <ActionIcon
-            variant="light"
+            variant="secondary"
             size="sm"
-            color="dimmed"
             onClick={handleDownloadSelected}
             disabled={!hasSelection || !hasDownloadAccess}
-            radius="sm"
+            aria-label={terminology.downloadSelected}
           >
             <DownloadIcon style={{ fontSize: "1rem" }} />
           </ActionIcon>
diff --git a/frontend/editor/src/core/components/fileManager/FileDetails.tsx b/frontend/editor/src/core/components/fileManager/FileDetails.tsx
index 4621559ae8..3fd116b75e 100644
--- a/frontend/editor/src/core/components/fileManager/FileDetails.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileDetails.tsx
@@ -1,5 +1,6 @@
 import React, { useEffect, useState } from "react";
-import { Stack, Button, Box } from "@mantine/core";
+import { Stack, Box } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useIndexedDBThumbnail } from "@app/hooks/useIndexedDBThumbnail";
 import { useFileManagerContext } from "@app/contexts/FileManagerContext";
@@ -108,16 +109,10 @@ const FileDetails: React.FC<FileDetailsProps> = ({ compact = false }) => {
 
       <Button
         size="md"
+        accent="neutral"
         onClick={onOpenFiles}
         disabled={!hasSelection && !canCloseAll}
         fullWidth
-        style={{
-          backgroundColor:
-            hasSelection || canCloseAll
-              ? "var(--btn-open-file)"
-              : "var(--mantine-color-gray-4)",
-          color: "white",
-        }}
       >
         {canCloseAll
           ? t("fileManager.closeAllFiles", "Close all files")
diff --git a/frontend/editor/src/core/components/fileManager/FileInfoCard.tsx b/frontend/editor/src/core/components/fileManager/FileInfoCard.tsx
index 594442aefb..f43df3d86c 100644
--- a/frontend/editor/src/core/components/fileManager/FileInfoCard.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileInfoCard.tsx
@@ -8,8 +8,8 @@ import {
   Group,
   Divider,
   ScrollArea,
-  Button,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { detectFileExtension, getFileSize } from "@app/utils/fileUtils";
 import { StirlingFileStub } from "@app/types/fileContext";
@@ -208,7 +208,7 @@ const FileInfoCard: React.FC<FileInfoCardProps> = ({
               <Divider />
               <Button
                 size="sm"
-                variant="light"
+                variant="secondary"
                 onClick={() => onMakeCopy(currentFile)}
                 fullWidth
               >
@@ -260,7 +260,7 @@ const FileInfoCard: React.FC<FileInfoCardProps> = ({
                   </Group>
                   <Button
                     size="sm"
-                    variant="light"
+                    variant="secondary"
                     onClick={() => setShowShareManageModal(true)}
                     fullWidth
                   >
diff --git a/frontend/editor/src/core/components/fileManager/FileListItem.tsx b/frontend/editor/src/core/components/fileManager/FileListItem.tsx
index ae22ced51f..ba1fe52bc9 100644
--- a/frontend/editor/src/core/components/fileManager/FileListItem.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileListItem.tsx
@@ -3,12 +3,12 @@ import {
   Group,
   Box,
   Text,
-  ActionIcon,
   Checkbox,
   Divider,
   Menu,
   Badge,
 } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 import DeleteIcon from "@mui/icons-material/Delete";
 import DownloadIcon from "@mui/icons-material/Download";
@@ -323,10 +323,11 @@ const FileListItem: React.FC<FileListItemProps> = ({
           >
             <Menu.Target>
               <ActionIcon
-                variant="subtle"
-                c="dimmed"
+                variant="tertiary"
+                accent="neutral"
                 size="md"
                 onClick={(e) => e.stopPropagation()}
+                aria-label={t("fileManager.moreOptions", "More options")}
                 style={{
                   opacity: shouldShowHovered ? 1 : 0,
                   transform: shouldShowHovered ? "scale(1)" : "scale(0.8)",
diff --git a/frontend/editor/src/core/components/fileManager/FileSourceButtons.tsx b/frontend/editor/src/core/components/fileManager/FileSourceButtons.tsx
index 6905f1bc75..6ac3e3c91e 100644
--- a/frontend/editor/src/core/components/fileManager/FileSourceButtons.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileSourceButtons.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Stack, Text, Button, Group } from "@mantine/core";
+import { Stack, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import HistoryIcon from "@mui/icons-material/History";
 import PhonelinkIcon from "@mui/icons-material/Phonelink";
 import { useTranslation } from "react-i18next";
@@ -65,86 +66,45 @@ const FileSourceButtons: React.FC<FileSourceButtonsProps> = ({
   // Determine visibility of Mobile QR Scanner button
   const shouldHideMobileQR =
     !isMobileUploadEnabled && config?.hideDisabledToolsMobileQRScanner;
-
-  const buttonProps = {
-    variant: (source: string) =>
-      activeSource === source ? "filled" : "subtle",
-    getColor: (source: string) =>
-      activeSource === source ? "var(--mantine-color-gray-2)" : undefined,
-    getStyles: (source: string) => ({
-      root: {
-        backgroundColor: activeSource === source ? undefined : "transparent",
-        color:
-          activeSource === source
-            ? "var(--mantine-color-gray-9)"
-            : "var(--mantine-color-gray-6)",
-        border: "none",
-        "&:hover": {
-          backgroundColor:
-            activeSource === source ? undefined : "var(--mantine-color-gray-0)",
-        },
-      },
-    }),
-  };
-
+  // Shared Button has no `xs`; map the old horizontal `xs` to `sm`.
+  const buttonSize = "sm" as const;
+  const buttonJustify = horizontal ? "center" : "start";
   const buttons = (
     <>
       <Button
+        variant={activeSource === "recent" ? "primary" : "tertiary"}
+        accent="neutral"
         leftSection={<HistoryIcon />}
-        justify={horizontal ? "center" : "flex-start"}
+        justify={buttonJustify}
         onClick={() => onSourceChange("recent")}
         fullWidth={!horizontal}
-        size={horizontal ? "xs" : "sm"}
-        color={buttonProps.getColor("recent")}
-        styles={buttonProps.getStyles("recent")}
+        size={buttonSize}
       >
-        {horizontal
-          ? t("fileManager.recent", "Recent")
-          : t("fileManager.recent", "Recent")}
+        {t("fileManager.recent", "Recent")}
       </Button>
 
       <Button
-        variant="subtle"
-        color="var(--mantine-color-gray-6)"
+        variant="tertiary"
+        accent="neutral"
         leftSection={<UploadIcon />}
-        justify={horizontal ? "center" : "flex-start"}
+        justify={buttonJustify}
         onClick={onLocalFileClick}
         fullWidth={!horizontal}
-        size={horizontal ? "xs" : "sm"}
-        styles={{
-          root: {
-            backgroundColor: "transparent",
-            border: "none",
-            "&:hover": {
-              backgroundColor: "var(--mantine-color-gray-0)",
-            },
-          },
-        }}
+        size={buttonSize}
       >
         {horizontal ? terminology.upload : terminology.uploadFiles}
       </Button>
 
       {!shouldHideGoogleDrive && (
         <Button
-          variant="subtle"
-          color="var(--mantine-color-gray-6)"
+          variant="tertiary"
+          accent="neutral"
           leftSection={<GoogleDriveIcon colored={isGoogleDriveEnabled} />}
-          justify={horizontal ? "center" : "flex-start"}
+          justify={buttonJustify}
           onClick={handleGoogleDriveClick}
           fullWidth={!horizontal}
-          size={horizontal ? "xs" : "sm"}
+          size={buttonSize}
           disabled={!isGoogleDriveEnabled}
-          styles={{
-            root: {
-              backgroundColor: "transparent",
-              border: "none",
-              "&:hover": {
-                backgroundColor: isGoogleDriveEnabled
-                  ? "var(--mantine-color-gray-0)"
-                  : "transparent",
-              },
-            },
-          }}
           title={
             !isGoogleDriveEnabled
               ? t(
@@ -162,25 +122,14 @@ const FileSourceButtons: React.FC<FileSourceButtonsProps> = ({
 
       {!shouldHideMobileQR && (
         <Button
-          variant="subtle"
-          color="var(--mantine-color-gray-6)"
+          variant="tertiary"
+          accent="neutral"
           leftSection={<PhonelinkIcon />}
-          justify={horizontal ? "center" : "flex-start"}
+          justify={buttonJustify}
           onClick={handleMobileUploadClick}
           fullWidth={!horizontal}
-          size={horizontal ? "xs" : "sm"}
+          size={buttonSize}
           disabled={!isMobileUploadEnabled}
-          styles={{
-            root: {
-              backgroundColor: "transparent",
-              border: "none",
-              "&:hover": {
-                backgroundColor: isMobileUploadEnabled
-                  ? "var(--mantine-color-gray-0)"
-                  : "transparent",
-              },
-            },
-          }}
           title={
             !isMobileUploadEnabled
               ? t(
diff --git a/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.tsx b/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.tsx
index 2eb57716f2..0261cf58dd 100644
--- a/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.tsx
+++ b/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.tsx
@@ -1,8 +1,10 @@
 import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Alert, Button, Group, Modal, Radio, Stack, Text } from "@mantine/core";
+import { Alert, Group, Modal, Radio, Stack, Text } from "@mantine/core";
 import ErrorOutlineIcon from "@mui/icons-material/ErrorOutlined";
 
+import { Button } from "@app/ui/Button";
+
 import type { StirlingFileStub } from "@app/types/fileContext";
 import type { DeleteScope } from "@app/services/serverStorageDelete";
 
@@ -164,11 +166,11 @@ export function DeleteFilesDialog({
         )}
 
         <Group justify="flex-end">
-          <Button variant="default" onClick={onClose} disabled={submitting}>
+          <Button variant="secondary" onClick={onClose} disabled={submitting}>
             {t("filesPage.cancel", "Cancel")}
           </Button>
           <Button
-            color="red"
+            accent="danger"
             loading={submitting}
             onClick={() => runConfirm(showChoice ? scope : fixedScope)}
           >
diff --git a/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.tsx b/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.tsx
index e2d7edc438..08811f0053 100644
--- a/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.tsx
+++ b/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.tsx
@@ -1,16 +1,9 @@
 import React, { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Alert,
-  Button,
-  Checkbox,
-  Group,
-  Modal,
-  Stack,
-  Text,
-} from "@mantine/core";
+import { Alert, Checkbox, Group, Modal, Stack, Text } from "@mantine/core";
 import ErrorOutlineIcon from "@mui/icons-material/ErrorOutlined";
 
+import { Button } from "@app/ui/Button";
 import { FolderRecord } from "@app/types/folder";
 
 interface DeleteFolderDialogProps {
@@ -95,11 +88,11 @@ export function DeleteFolderDialog({
           </Alert>
         )}
         <Group justify="flex-end">
-          <Button variant="default" onClick={onClose} disabled={submitting}>
+          <Button variant="secondary" onClick={onClose} disabled={submitting}>
             {t("filesPage.cancel", "Cancel")}
           </Button>
           <Button
-            color="red"
+            accent="danger"
             loading={submitting}
             onClick={async () => {
               setSubmitting(true);
diff --git a/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
index aaab5d3b08..e789167038 100644
--- a/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
@@ -1,6 +1,8 @@
 import React, { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ActionIcon, Badge, Button, Tooltip } from "@mantine/core";
+import { Badge, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
 import DriveFileMoveIcon from "@mui/icons-material/DriveFileMove";
@@ -143,7 +145,12 @@ export function FileDetailsPanel({
           label={t("filesPage.closeDetails", "Close details")}
           withinPortal
         >
-          <ActionIcon variant="subtle" size="sm" onClick={onClose}>
+          <ActionIcon
+            variant="tertiary"
+            size="sm"
+            onClick={onClose}
+            aria-label={t("filesPage.closeDetails", "Close details")}
+          >
             <CloseIcon fontSize="small" />
           </ActionIcon>
         </Tooltip>
@@ -181,25 +188,27 @@ export function FileDetailsPanel({
                 <span className="files-page-details-ext-tag">{ext}</span>
               )}
               {(single.versionNumber ?? 1) > 1 && (
-                <Badge size="sm" variant="filled" color="blue">
+                <Badge size="sm" color="blue">
                   v{single.versionNumber}
                 </Badge>
               )}
             </div>
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               className="files-page-details-collapse-toggle"
               onClick={() => setFieldsOpen((o) => !o)}
               aria-expanded={fieldsOpen}
+              rightSection={
+                <KeyboardArrowDownIcon
+                  className={`files-page-details-collapse-chevron${
+                    fieldsOpen ? " is-open" : ""
+                  }`}
+                  fontSize="small"
+                />
+              }
             >
               <span>{t("filesPage.fileInfo", "File info")}</span>
-              <KeyboardArrowDownIcon
-                className={`files-page-details-collapse-chevron${
-                  fieldsOpen ? " is-open" : ""
-                }`}
-                fontSize="small"
-              />
-            </button>
+            </Button>
             {fieldsOpen && (
               <div className="files-page-details-fieldlist">
                 <DetailField
@@ -256,7 +265,7 @@ export function FileDetailsPanel({
               (compactVersions && onOpenVersionHistory ? (
                 <Button
                   leftSection={<HistoryIcon fontSize="small" />}
-                  variant="default"
+                  variant="secondary"
                   onClick={onOpenVersionHistory}
                 >
                   {t(
@@ -291,7 +300,6 @@ export function FileDetailsPanel({
       <div className="files-page-details-actions">
         <Button
           leftSection={<OpenInNewIcon fontSize="small" />}
-          variant="filled"
           onClick={() => onAddToWorkspace(selectedFileIds)}
         >
           {files.length === 1
@@ -302,7 +310,7 @@ export function FileDetailsPanel({
         </Button>
         <Button
           leftSection={<DownloadIcon fontSize="small" />}
-          variant="default"
+          variant="secondary"
           onClick={handleDownload}
           loading={downloading}
         >
@@ -329,14 +337,12 @@ export function FileDetailsPanel({
           >
             <Button
               leftSection={<LinkIcon fontSize="small" />}
-              variant="default"
+              variant="secondary"
               disabled={!sharingEnabled}
               onClick={() => setShareModalOpen(true)}
-              styles={{
-                root: {
-                  // Keep tooltip hoverable while button is disabled.
-                  pointerEvents: sharingEnabled ? undefined : "auto",
-                },
+              style={{
+                // Keep tooltip hoverable while button is disabled.
+                pointerEvents: sharingEnabled ? undefined : "auto",
               }}
             >
               {t("filesPage.shareManage", "Manage sharing")}
@@ -345,7 +351,7 @@ export function FileDetailsPanel({
         )}
         <Button
           leftSection={<DriveFileMoveIcon fontSize="small" />}
-          variant="default"
+          variant="secondary"
           onClick={() => onMove(selectedFileIds)}
         >
           {t("filesPage.moveTo", "Move to…")}
@@ -363,16 +369,12 @@ export function FileDetailsPanel({
           >
             <Button
               leftSection={<CloudUploadIcon fontSize="small" />}
-              variant="default"
+              variant="secondary"
               disabled={Boolean(saveToServerDisabledReason)}
               onClick={() => onSaveToServer(localOnlyFiles)}
-              styles={{
-                root: {
-                  // Keep tooltip hoverable while button is disabled.
-                  pointerEvents: saveToServerDisabledReason
-                    ? "auto"
-                    : undefined,
-                },
+              style={{
+                // Keep tooltip hoverable while button is disabled.
+                pointerEvents: saveToServerDisabledReason ? "auto" : undefined,
               }}
             >
               {t("filesPage.saveToServer", "Save to server")}
@@ -381,8 +383,7 @@ export function FileDetailsPanel({
         )}
         <Button
           leftSection={<DeleteIcon fontSize="small" />}
-          color="red"
-          variant="light"
+          accent="danger"
           onClick={() => onRemove(selectedFileIds)}
         >
           {t("filesPage.remove", "Delete")}
diff --git a/frontend/editor/src/core/components/filesPage/FileGrid.tsx b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
index 01e9b9355a..4d18fccc80 100644
--- a/frontend/editor/src/core/components/filesPage/FileGrid.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
@@ -1,6 +1,8 @@
 import React, { useCallback, useMemo, useRef } from "react";
 import { useTranslation } from "react-i18next";
-import { ActionIcon, Button, Checkbox, Menu, Tooltip } from "@mantine/core";
+import { Checkbox, Menu, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import FolderIcon from "@mui/icons-material/Folder";
@@ -297,10 +299,10 @@ function EmptyState({
                 <span style={{ display: "inline-flex" }}>
                   <Button
                     size="md"
-                    variant="default"
+                    variant="secondary"
                     leftSection={<CreateNewFolderIcon fontSize="small" />}
                     disabled
-                    styles={{ root: { pointerEvents: "auto" } }}
+                    style={{ pointerEvents: "auto" }}
                   >
                     {t("filesPage.empty.newFolderCta", "Create folder")}
                   </Button>
@@ -309,7 +311,7 @@ function EmptyState({
             ) : (
               <Button
                 size="md"
-                variant="default"
+                variant="secondary"
                 leftSection={<CreateNewFolderIcon fontSize="small" />}
                 onClick={onCreateFolder}
               >
@@ -528,8 +530,6 @@ function FolderCard({
           <Menu.Target>
             <ActionIcon
               ref={kebabRef}
-              variant="filled"
-              color="gray"
               size="sm"
               onClick={(e) => e.stopPropagation()}
               aria-label={t("filesPage.folderMenu", "Folder actions")}
@@ -771,8 +771,6 @@ function FileCard({
           <Menu.Target>
             <ActionIcon
               ref={kebabRef}
-              variant="filled"
-              color="gray"
               size="sm"
               onClick={(e) => e.stopPropagation()}
               aria-label={t("filesPage.fileMenu", "File actions")}
@@ -1151,7 +1149,7 @@ function FolderRow({
         <Menu.Target>
           <ActionIcon
             ref={kebabRef}
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             onClick={(e) => e.stopPropagation()}
             aria-label={t("filesPage.folderMenu", "Folder actions")}
@@ -1370,7 +1368,7 @@ function FileRow({
         <Menu.Target>
           <ActionIcon
             ref={kebabRef}
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             onClick={(e) => e.stopPropagation()}
             aria-label={t("filesPage.fileMenu", "File actions")}
diff --git a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
index f88e6b7945..002d81ca00 100644
--- a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
@@ -7,19 +7,12 @@ import React, {
 } from "react";
 import { useTranslation } from "react-i18next";
 import { useLocation, useNavigate } from "react-router-dom";
-import {
-  ActionIcon,
-  Button,
-  Drawer,
-  Group,
-  MultiSelect,
-  SegmentedControl,
-  Select,
-  Tooltip,
-} from "@mantine/core";
+import { Drawer, Group, MultiSelect, Select, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useMediaQuery } from "@mantine/hooks";
 import SearchIcon from "@mui/icons-material/Search";
-import CloseIcon from "@mui/icons-material/Close";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
 import QrCode2Icon from "@mui/icons-material/QrCode2";
 import CreateNewFolderIcon from "@mui/icons-material/CreateNewFolder";
@@ -910,8 +903,8 @@ export default function FileManagerView() {
                   withinPortal
                 >
                   <ActionIcon
-                    variant="default"
-                    size="md"
+                    variant="secondary"
+                    size="sm"
                     loading={refreshing}
                     disabled={refreshing || Boolean(signInRequiredReason)}
                     aria-busy={refreshing}
@@ -930,11 +923,11 @@ export default function FileManagerView() {
                   >
                     <span style={{ display: "inline-flex" }}>
                       <Button
-                        variant="default"
+                        variant="secondary"
                         size="sm"
                         leftSection={<CreateNewFolderIcon fontSize="small" />}
                         disabled
-                        styles={{ root: { pointerEvents: "auto" } }}
+                        style={{ pointerEvents: "auto" }}
                       >
                         {t("filesPage.newFolder", "New folder")}
                       </Button>
@@ -942,7 +935,7 @@ export default function FileManagerView() {
                   </Tooltip>
                 ) : (
                   <Button
-                    variant="default"
+                    variant="secondary"
                     size="sm"
                     leftSection={<CreateNewFolderIcon fontSize="small" />}
                     onClick={() => openNewFolderDialog()}
@@ -966,9 +959,8 @@ export default function FileManagerView() {
                     withinPortal
                   >
                     <ActionIcon
-                      size="lg"
-                      variant="default"
-                      radius="md"
+                      size="sm"
+                      variant="secondary"
                       onClick={() => setMobileUploadModalOpen(true)}
                       aria-label={t(
                         "filesPage.uploadFromMobile",
@@ -1012,11 +1004,11 @@ export default function FileManagerView() {
           <span>{folders.error}</span>
           <ActionIcon
             size="sm"
-            variant="subtle"
+            variant="tertiary"
             aria-label={t("filesPage.dismissError", "Dismiss")}
             onClick={() => folders.setError(null)}
           >
-            <CloseIcon fontSize="small" />
+            &times;
           </ActionIcon>
         </div>
       )}
@@ -1147,8 +1139,8 @@ export default function FileManagerView() {
                   w={280}
                 >
                   <Button
-                    variant="subtle"
-                    size="xs"
+                    variant="tertiary"
+                    size="sm"
                     onClick={() => {
                       if (allSelected) {
                         setSelectedFileIds(new Set());
@@ -1210,19 +1202,17 @@ export default function FileManagerView() {
                         >
                           <Button
                             size="sm"
-                            variant="default"
+                            variant="secondary"
                             leftSection={<CloudUploadIcon fontSize="small" />}
                             disabled={Boolean(saveToServerDisabledReason)}
                             onClick={() =>
                               setSaveToServerTarget(localOnlySelectedStubs)
                             }
-                            styles={{
-                              root: {
-                                // Keep the tooltip hoverable while disabled.
-                                pointerEvents: saveToServerDisabledReason
-                                  ? "auto"
-                                  : undefined,
-                              },
+                            style={{
+                              // Keep the tooltip hoverable while disabled.
+                              pointerEvents: saveToServerDisabledReason
+                                ? "auto"
+                                : undefined,
                             }}
                             aria-label={t(
                               "filesPage.saveToServer",
@@ -1242,7 +1232,7 @@ export default function FileManagerView() {
                           >
                             <Button
                               size="sm"
-                              variant="default"
+                              variant="secondary"
                               leftSection={
                                 <InfoOutlinedIcon fontSize="small" />
                               }
@@ -1259,7 +1249,7 @@ export default function FileManagerView() {
                       <Tooltip label={moveLabel} withinPortal>
                         <Button
                           size="sm"
-                          variant="default"
+                          variant="secondary"
                           leftSection={<DriveFileMoveIcon fontSize="small" />}
                           onClick={() => promptMoveFiles(selectedFiles)}
                           aria-label={moveLabel}
@@ -1270,8 +1260,8 @@ export default function FileManagerView() {
                       <Tooltip label={removeLabel} withinPortal>
                         <Button
                           size="sm"
-                          color="red"
-                          variant="light"
+                          accent="danger"
+                          variant="secondary"
                           leftSection={<DeleteIcon fontSize="small" />}
                           onClick={() => handleRemoveFiles(selectedFiles)}
                           aria-label={removeLabel}
@@ -1284,7 +1274,7 @@ export default function FileManagerView() {
                         withinPortal
                       >
                         <ActionIcon
-                          variant="subtle"
+                          variant="tertiary"
                           size="md"
                           onClick={() => clearSelection()}
                           aria-label={t(
@@ -1292,7 +1282,7 @@ export default function FileManagerView() {
                             "Clear selection",
                           )}
                         >
-                          <CloseIcon fontSize="small" />
+                          &times;
                         </ActionIcon>
                       </Tooltip>
                     </Group>
@@ -1388,7 +1378,7 @@ export default function FileManagerView() {
               />
               <span className="files-page-toolbar-divider" aria-hidden="true" />
               <SegmentedControl
-                size="xs"
+                size="sm"
                 value={viewMode}
                 onChange={(v) => {
                   // Mantine only emits values declared in `data[].value`, but
@@ -1401,7 +1391,7 @@ export default function FileManagerView() {
                   setViewMode(v as (typeof FILES_PAGE_VIEW_MODES)[number]);
                 }}
                 aria-label={t("filesPage.viewMode.label", "View mode")}
-                data={[
+                options={[
                   {
                     value: "grid",
                     label: (
@@ -1686,12 +1676,12 @@ const SearchField = React.forwardRef<
       />
       {value && (
         <ActionIcon
-          variant="subtle"
-          size="xs"
+          variant="tertiary"
+          size="sm"
           onClick={() => onChange("")}
           aria-label={t("filesPage.clearSearch", "Clear search")}
         >
-          <CloseIcon fontSize="small" />
+          &times;
         </ActionIcon>
       )}
     </div>
@@ -1712,8 +1702,8 @@ function Breadcrumbs() {
         const isLast = idx === trail.length - 1;
         return (
           <React.Fragment key={entry.id ?? "root"}>
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               className={`files-page-breadcrumb${isLast ? " is-current" : ""}`}
               onClick={() => folders.setCurrentFolderId(entry.id)}
               onDragOver={(e) => {
@@ -1772,7 +1762,7 @@ function Breadcrumbs() {
               }}
             >
               {entry.name}
-            </button>
+            </Button>
             {!isLast && (
               <KeyboardArrowRightIcon
                 className="files-page-breadcrumb-sep"
diff --git a/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
index c5f3479038..3944489cb7 100644
--- a/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
+++ b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
@@ -13,6 +13,7 @@ import {
   FOLDER_ICONS,
   FolderIconOption,
 } from "@app/components/filesPage/folderIcons";
+import { Button } from "@app/ui/Button";
 
 interface FolderAppearancePickerProps {
   folder: FolderRecord;
@@ -50,9 +51,9 @@ export function FolderAppearancePicker({
           }}
         >
           {FOLDER_COLOR_PALETTE.map((c) => (
-            <button
+            <Button
               key={c}
-              type="button"
+              variant="secondary"
               disabled={disabled}
               aria-label={t(
                 "filesPage.appearance.useColour",
@@ -146,8 +147,8 @@ function IconButton({
 }) {
   return (
     <Tooltip label={icon.label} withinPortal>
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         disabled={disabled}
         aria-label={icon.label}
         onClick={(e) => {
@@ -172,7 +173,7 @@ function IconButton({
         }}
       >
         {icon.glyph || "-"}
-      </button>
+      </Button>
     </Tooltip>
   );
 }
diff --git a/frontend/editor/src/core/components/filesPage/FolderNameDialog.tsx b/frontend/editor/src/core/components/filesPage/FolderNameDialog.tsx
index 4197d652ed..62858076cd 100644
--- a/frontend/editor/src/core/components/filesPage/FolderNameDialog.tsx
+++ b/frontend/editor/src/core/components/filesPage/FolderNameDialog.tsx
@@ -1,8 +1,10 @@
 import React, { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Alert, Button, Group, Modal, Stack, TextInput } from "@mantine/core";
+import { Alert, Group, Modal, Stack, TextInput } from "@mantine/core";
 import ErrorOutlineIcon from "@mui/icons-material/ErrorOutlined";
 
+import { Button } from "@app/ui/Button";
+
 interface FolderNameDialogProps {
   opened: boolean;
   title: string;
@@ -94,7 +96,7 @@ export function FolderNameDialog({
           </Alert>
         )}
         <Group justify="flex-end">
-          <Button variant="default" onClick={onClose}>
+          <Button variant="secondary" onClick={onClose}>
             {t("filesPage.folderName.cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.tsx b/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.tsx
index 72bd4186ec..597b0782e8 100644
--- a/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.tsx
+++ b/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.tsx
@@ -1,6 +1,7 @@
 import React, { useCallback, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ActionIcon, Menu } from "@mantine/core";
+import { Menu } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import KeyboardArrowRightIcon from "@mui/icons-material/KeyboardArrowRight";
 import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
 import HomeIcon from "@mui/icons-material/Home";
@@ -409,8 +410,8 @@ function TreeNodeRow({
         >
           <Menu.Target>
             <ActionIcon
-              size="xs"
-              variant="subtle"
+              size="sm"
+              variant="tertiary"
               className="files-page-tree-kebab"
               aria-label={t(
                 "filesPage.treeMenu.actions",
diff --git a/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
index 8950f3f494..b6e098ea4d 100644
--- a/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
+++ b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
@@ -1,9 +1,7 @@
 import React, { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ActionIcon,
   Alert,
-  Button,
   Group,
   Modal,
   Stack,
@@ -15,9 +13,10 @@ import HomeIcon from "@mui/icons-material/Home";
 import FolderIcon from "@mui/icons-material/Folder";
 import FolderOpenIcon from "@mui/icons-material/FolderOpen";
 import CreateNewFolderIcon from "@mui/icons-material/CreateNewFolder";
-import CloseIcon from "@mui/icons-material/Close";
 import ErrorOutlineIcon from "@mui/icons-material/ErrorOutlined";
 
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { FolderId, FolderRecord, ROOT_FOLDER_ID } from "@app/types/folder";
 
 interface MoveToFolderDialogProps {
@@ -228,8 +227,7 @@ export function MoveToFolderDialog({
                   withinPortal
                 >
                   <ActionIcon
-                    variant="subtle"
-                    color="gray"
+                    variant="tertiary"
                     size="lg"
                     onClick={handleCancel}
                     disabled={creating}
@@ -238,20 +236,20 @@ export function MoveToFolderDialog({
                       "Discard",
                     )}
                   >
-                    <CloseIcon fontSize="small" />
+                    &times;
                   </ActionIcon>
                 </Tooltip>
               </Group>
             ) : (
               <Button
-                variant="subtle"
+                variant="tertiary"
                 size="sm"
                 leftSection={<CreateNewFolderIcon fontSize="small" />}
                 onClick={() => {
                   setCreatingFolder(true);
                   setNewFolderName("");
                 }}
-                styles={{ root: { alignSelf: "flex-start" } }}
+                style={{ alignSelf: "flex-start" }}
                 data-testid="move-dialog-create-folder-toggle"
               >
                 {t(
@@ -272,7 +270,7 @@ export function MoveToFolderDialog({
           </Alert>
         )}
         <Group justify="flex-end">
-          <Button variant="default" onClick={onClose} disabled={submitting}>
+          <Button variant="secondary" onClick={onClose} disabled={submitting}>
             {t("filesPage.moveDialog.cancel", "Cancel")}
           </Button>
           <Button
@@ -325,35 +323,35 @@ function FolderPick({
   onPick,
 }: FolderPickProps) {
   return (
-    <button
-      type="button"
+    <Button
+      variant="tertiary"
+      justify="start"
+      fullWidth
       onClick={onPick}
       disabled={disabled}
+      leftSection={
+        isRoot ? (
+          <HomeIcon fontSize="small" />
+        ) : isActive ? (
+          <FolderOpenIcon fontSize="small" style={{ color }} />
+        ) : (
+          <FolderIcon fontSize="small" style={{ color }} />
+        )
+      }
       style={{
-        all: "unset",
         cursor: disabled ? "not-allowed" : "pointer",
         opacity: disabled ? 0.45 : 1,
-        display: "flex",
-        alignItems: "center",
         gap: "0.5rem",
         padding: `0.4rem 0.75rem 0.4rem ${0.75 + depth * 0.85}rem`,
-        width: "100%",
         background: isActive ? "var(--hover-bg)" : "transparent",
         borderBottom: "1px solid var(--border-subtle)",
         boxSizing: "border-box",
         fontWeight: isActive ? 600 : 400,
       }}
     >
-      {isRoot ? (
-        <HomeIcon fontSize="small" />
-      ) : isActive ? (
-        <FolderOpenIcon fontSize="small" style={{ color }} />
-      ) : (
-        <FolderIcon fontSize="small" style={{ color }} />
-      )}
       <span style={{ overflow: "hidden", textOverflow: "ellipsis" }}>
         {label}
       </span>
-    </button>
+    </Button>
   );
 }
diff --git a/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx b/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
index 937db8c384..0b6a75878b 100644
--- a/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
+++ b/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
@@ -1,6 +1,8 @@
 import { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ActionIcon, Badge, Menu } from "@mantine/core";
+import { Badge, Menu } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
 import DeleteIcon from "@mui/icons-material/Delete";
 import DownloadIcon from "@mui/icons-material/Download";
@@ -144,8 +146,8 @@ export function VersionTimeline({
                     <span className="files-page-details-version-timeline-rail-line" />
                   )}
                 </div>
-                <button
-                  type="button"
+                <Button
+                  variant="tertiary"
                   className="files-page-details-version-timeline-ellipsis-btn"
                   onClick={() => setShowAllCollapsed(true)}
                 >
@@ -154,7 +156,7 @@ export function VersionTimeline({
                     "Show {{count}} earlier versions",
                     { count: row.hidden },
                   )}
-                </button>
+                </Button>
               </li>
             );
           }
@@ -181,24 +183,31 @@ export function VersionTimeline({
                 )}
               </div>
               <div className="files-page-details-version-timeline-body">
-                <button
-                  type="button"
+                <Button
+                  variant="tertiary"
                   className="files-page-details-version-timeline-summary"
                   onClick={() => toggleExpand(v.id)}
                   aria-expanded={isExpanded}
+                  leftSection={
+                    <Badge
+                      size="xs"
+                      variant={isActive ? "filled" : "outline"}
+                      color="blue"
+                    >
+                      v{v.versionNumber ?? 1}
+                    </Badge>
+                  }
+                  rightSection={
+                    <KeyboardArrowDownIcon
+                      className={`files-page-details-version-timeline-chevron${
+                        isExpanded ? " is-expanded" : ""
+                      }`}
+                      fontSize="small"
+                    />
+                  }
                 >
-                  <Badge
-                    size="xs"
-                    variant={isActive ? "filled" : "outline"}
-                    color="blue"
-                  >
-                    v{v.versionNumber ?? 1}
-                  </Badge>
                   {delta ? (
                     <span className="files-page-details-version-timeline-delta">
-                      <span className="files-page-details-version-timeline-delta-plus">
-                        +
-                      </span>
                       <ToolLabel toolId={delta.toolId} />
                     </span>
                   ) : (
@@ -206,14 +215,7 @@ export function VersionTimeline({
                       {t("filesPage.versionOrigin", "Original upload")}
                     </span>
                   )}
-                  <span className="files-page-details-version-timeline-spacer" />
-                  <KeyboardArrowDownIcon
-                    className={`files-page-details-version-timeline-chevron${
-                      isExpanded ? " is-expanded" : ""
-                    }`}
-                    fontSize="small"
-                  />
-                </button>
+                </Button>
                 <div className="files-page-details-version-timeline-meta-line">
                   <span>{formatFileSize(v.size)}</span>
                   {v.lastModified ? (
@@ -230,7 +232,7 @@ export function VersionTimeline({
                   <Menu position="bottom-end" withinPortal shadow="md">
                     <Menu.Target>
                       <ActionIcon
-                        variant="subtle"
+                        variant="tertiary"
                         size="sm"
                         aria-label={t(
                           "filesPage.versionActions",
@@ -303,13 +305,13 @@ export function VersionTimeline({
         })}
       </ol>
       {collapsible && showAllCollapsed && (
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           className="files-page-details-version-timeline-collapse-btn"
           onClick={() => setShowAllCollapsed(false)}
         >
           {t("filesPage.versionCollapse", "Collapse middle versions")}
-        </button>
+        </Button>
       )}
     </div>
   );
diff --git a/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx b/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx
index fc7914db55..86a087f325 100644
--- a/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx
+++ b/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/renderButtons.tsx
@@ -1,5 +1,7 @@
 import React from "react";
-import { Button, Group, ActionIcon } from "@mantine/core";
+import { Group } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import { useTranslation } from "react-i18next";
 import {
@@ -33,22 +35,6 @@ export function SlideButtons({
     (btn) => btn.group === "right",
   );
 
-  const buttonStyles = (variant: ButtonDefinition["variant"]) =>
-    variant === "primary"
-      ? {
-          root: {
-            background: "var(--onboarding-primary-button-bg)",
-            color: "var(--onboarding-primary-button-text)",
-          },
-        }
-      : {
-          root: {
-            background: "var(--onboarding-secondary-button-bg)",
-            border: "1px solid var(--onboarding-secondary-button-border)",
-            color: "var(--onboarding-secondary-button-text)",
-          },
-        };
-
   const resolveButtonLabel = (button: ButtonDefinition) => {
     // Special case: override "See Plans" with "Upgrade now" when over limit
     if (
@@ -77,20 +63,14 @@ export function SlideButtons({
         <ActionIcon
           key={button.key}
           onClick={() => onAction(button.action)}
-          radius="md"
-          size={40}
+          variant="secondary"
+          accent="neutral"
           disabled={disabled}
-          styles={{
-            root: {
-              background: "var(--onboarding-secondary-button-bg)",
-              border: "1px solid var(--onboarding-secondary-button-border)",
-              color: "var(--onboarding-secondary-button-text)",
-            },
-          }}
+          aria-label={t("onboarding.buttons.back", "Back")}
         >
-          {button.icon === "chevron-left" && (
+          {button.icon === "chevron-left" ? (
             <ChevronLeftIcon fontSize="small" />
-          )}
+          ) : null}
         </ActionIcon>
       );
     }
@@ -103,7 +83,10 @@ export function SlideButtons({
         key={button.key}
         onClick={() => onAction(button.action)}
         disabled={disabled}
-        styles={buttonStyles(variant)}
+        variant={variant === "primary" ? "primary" : "secondary"}
+        accent={
+          button.accent ?? (variant === "primary" ? "default" : "neutral")
+        }
       >
         {label}
       </Button>
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingModalSlide.tsx b/frontend/editor/src/core/components/onboarding/OnboardingModalSlide.tsx
index b1bc731d52..b8135739bd 100644
--- a/frontend/editor/src/core/components/onboarding/OnboardingModalSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/OnboardingModalSlide.tsx
@@ -6,9 +6,10 @@
  */
 
 import React from "react";
-import { Modal, Stack, ActionIcon } from "@mantine/core";
+import { Modal, Stack } from "@mantine/core";
+import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import DiamondOutlinedIcon from "@mui/icons-material/DiamondOutlined";
-import CloseIcon from "@mui/icons-material/Close";
 
 import type {
   SlideDefinition,
@@ -45,6 +46,7 @@ export default function OnboardingModalSlide({
   onAction,
   allowDismiss = true,
 }: OnboardingModalSlideProps) {
+  const { t } = useTranslation();
   const renderHero = () => {
     if (slideDefinition.hero.type === "dual-icon") {
       return (
@@ -139,8 +141,9 @@ export default function OnboardingModalSlide({
           {allowDismiss && (
             <ActionIcon
               onClick={onSkip}
-              radius="md"
-              size={36}
+              variant="tertiary"
+              size="lg"
+              aria-label={t("common.close", "Close")}
               style={{
                 position: "absolute",
                 top: 16,
@@ -150,15 +153,12 @@ export default function OnboardingModalSlide({
                 backdropFilter: "blur(4px)",
                 zIndex: 10,
               }}
-              styles={{
-                root: {
-                  "&:hover": {
-                    backgroundColor: "rgba(255, 255, 255, 0.3)",
-                  },
-                },
-              }}
             >
-              <CloseIcon fontSize="small" />
+              <LocalIcon
+                icon="close-rounded"
+                width="1.25rem"
+                height="1.25rem"
+              />
             </ActionIcon>
           )}
           <div className={styles.heroLogo} key={`logo-${slideContent.key}`}>
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingTour.tsx b/frontend/editor/src/core/components/onboarding/OnboardingTour.tsx
index 1f3ca67692..c38d9f952b 100644
--- a/frontend/editor/src/core/components/onboarding/OnboardingTour.tsx
+++ b/frontend/editor/src/core/components/onboarding/OnboardingTour.tsx
@@ -8,7 +8,7 @@
 
 import React from "react";
 import { TourProvider, useTour, type StepType } from "@reactour/tour";
-import { CloseButton, ActionIcon } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ArrowForwardIcon from "@mui/icons-material/ArrowForward";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import CheckIcon from "@mui/icons-material/Check";
@@ -137,7 +137,7 @@ export default function OnboardingTour({
                 setIsOpen,
               })
             }
-            variant="subtle"
+            variant="tertiary"
             size="lg"
             aria-label={
               isLast
@@ -151,11 +151,15 @@ export default function OnboardingTour({
       }}
       components={{
         Close: ({ onClick }) => (
-          <CloseButton
+          <ActionIcon
             onClick={onClick}
+            variant="tertiary"
             size="md"
+            aria-label={t("onboarding.close", "Close")}
             style={{ position: "absolute", top: "8px", right: "8px" }}
-          />
+          >
+            &times;
+          </ActionIcon>
         ),
         Content: ({ content }: { content: string }) => (
           <div
diff --git a/frontend/editor/src/core/components/onboarding/onboardingFlowConfig.ts b/frontend/editor/src/core/components/onboarding/onboardingFlowConfig.ts
index 5f5a9be408..6eb843f4a5 100644
--- a/frontend/editor/src/core/components/onboarding/onboardingFlowConfig.ts
+++ b/frontend/editor/src/core/components/onboarding/onboardingFlowConfig.ts
@@ -8,6 +8,7 @@ import TourOverviewSlide from "@app/components/onboarding/slides/TourOverviewSli
 import AnalyticsChoiceSlide from "@app/components/onboarding/slides/AnalyticsChoiceSlide";
 import MFASetupSlide from "@app/components/onboarding/slides/MFASetupSlide";
 import { SlideConfig, LicenseNotice } from "@app/types/types";
+import type { ButtonAccent } from "@app/ui/Button";
 
 export type SlideId =
   | "first-login"
@@ -83,6 +84,8 @@ export interface ButtonDefinition {
   label?: string;
   icon?: "chevron-left";
   variant?: "primary" | "secondary" | "default";
+  /** Accent for the shared Button; defaults to neutral. */
+  accent?: ButtonAccent;
   group: "left" | "right";
   action: ButtonAction;
   disabledWhen?: (state: FlowState) => boolean;
@@ -238,6 +241,7 @@ export const SLIDE_DEFINITIONS: Record<SlideId, SlideDefinition> = {
         type: "button",
         label: "onboarding.serverLicense.seePlans",
         variant: "primary",
+        accent: "premium",
         group: "right",
         action: "see-plans",
       },
diff --git a/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.tsx b/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.tsx
index 6960b88c27..23566a5527 100644
--- a/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.tsx
@@ -1,6 +1,6 @@
 import React from "react";
 import { Trans } from "react-i18next";
-import { Button } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
 import i18n from "@app/i18n";
 import { SlideConfig } from "@app/types/types";
@@ -36,7 +36,7 @@ export default function AnalyticsChoiceSlide({
         <br />
         <div style={{ textAlign: "right", marginTop: 0 }}>
           <Button
-            variant="default"
+            variant="secondary"
             size="sm"
             onClick={() =>
               window.open(
diff --git a/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
index 7362774017..97329db5d7 100644
--- a/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
@@ -1,6 +1,7 @@
 import React from "react";
 import { useTranslation } from "react-i18next";
-import { Menu, ActionIcon } from "@mantine/core";
+import { Menu } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ExpandMoreIcon from "@mui/icons-material/ExpandMore";
 
 export interface OSOption {
@@ -67,8 +68,12 @@ export const DesktopInstallTitle: React.FC<DesktopInstallTitleProps> = ({
       <Menu position="bottom" offset={5} zIndex={10000}>
         <Menu.Target>
           <ActionIcon
-            variant="transparent"
+            variant="tertiary"
             size="sm"
+            aria-label={t(
+              "onboarding.desktopInstall.selectOs",
+              "Select operating system",
+            )}
             style={{
               background: "transparent",
               border: "none",
diff --git a/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
index 6f0e0e587c..89de08e6e7 100644
--- a/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Stack, PasswordInput, Button, Alert, Text } from "@mantine/core";
+import { Stack, PasswordInput, Alert, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { SlideConfig } from "@app/types/types";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -199,8 +200,8 @@ function FirstLoginForm({
             />
 
             <Button
-              type="submit"
               fullWidth
+              type="submit"
               loading={loading}
               disabled={
                 !newPassword ||
@@ -209,7 +210,7 @@ function FirstLoginForm({
                 confirmPassword.length < 8
               }
               size="md"
-              mt="xs"
+              style={{ marginTop: "var(--mantine-spacing-xs)" }}
             >
               {t("firstLogin.changePassword", "Change Password")}
             </Button>
diff --git a/frontend/editor/src/core/components/onboarding/slides/MFASetupSlide.tsx b/frontend/editor/src/core/components/onboarding/slides/MFASetupSlide.tsx
index de76eadd6b..c018d69265 100644
--- a/frontend/editor/src/core/components/onboarding/slides/MFASetupSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/MFASetupSlide.tsx
@@ -8,13 +8,13 @@ import {
 import {
   Alert,
   Box,
-  Button,
   Group,
   Loader,
   Stack,
   Text,
   TextInput,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { QRCodeSVG } from "qrcode.react";
 import { useTranslation } from "react-i18next";
 import { SlideConfig } from "@app/types/types";
@@ -210,8 +210,8 @@ function MFASetupContent({ onMfaSetupComplete }: MFASetupSlideProps) {
 
               <Group justify="space-between" wrap="wrap">
                 <Button
+                  variant="secondary"
                   type="button"
-                  variant="light"
                   onClick={fetchMfaSetup}
                   disabled={mfaLoading || submitting || setupComplete}
                 >
@@ -226,7 +226,7 @@ function MFASetupContent({ onMfaSetupComplete }: MFASetupSlideProps) {
                 >
                   Enable MFA
                 </Button>
-                <Button type="button" variant="light" onClick={onLogout}>
+                <Button variant="secondary" type="button" onClick={onLogout}>
                   Logout
                 </Button>
               </Group>
diff --git a/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx b/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
index 93ff3c2ab9..472fc141d7 100644
--- a/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
+++ b/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
@@ -5,7 +5,9 @@ import React, {
   useMemo,
   useEffect,
 } from "react";
-import { ActionIcon, CheckboxIndicator } from "@mantine/core";
+import { CheckboxIndicator } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 import DeleteOutlineIcon from "@mui/icons-material/DeleteOutlined";
@@ -259,7 +261,7 @@ const FileThumbnail = ({
         {/* Kebab menu */}
         <ActionIcon
           aria-label={t("moreOptions", "More options")}
-          variant="subtle"
+          variant="tertiary"
           className={styles.kebab}
           onClick={(e) => {
             e.stopPropagation();
@@ -277,8 +279,18 @@ const FileThumbnail = ({
           style={{ width: actionsWidth }}
           onClick={(e) => e.stopPropagation()}
         >
-          <button
+          <Button
+            variant="tertiary"
+            justify="start"
+            fullWidth
             className={styles.actionRow}
+            leftSection={
+              isPinned ? (
+                <PushPinIcon fontSize="small" />
+              ) : (
+                <PushPinOutlinedIcon fontSize="small" />
+              )
+            }
             onClick={() => {
               if (actualFile) {
                 if (isPinned) {
@@ -292,38 +304,36 @@ const FileThumbnail = ({
               setShowActions(false);
             }}
           >
-            {isPinned ? (
-              <PushPinIcon fontSize="small" />
-            ) : (
-              <PushPinOutlinedIcon fontSize="small" />
-            )}
-            <span>{isPinned ? t("unpin", "Unpin") : t("pin", "Pin")}</span>
-          </button>
-
-          <button
+            {isPinned ? t("unpin", "Unpin") : t("pin", "Pin")}
+          </Button>
+          <Button
+            variant="tertiary"
+            justify="start"
+            fullWidth
             className={styles.actionRow}
+            leftSection={<DownloadOutlinedIcon fontSize="small" />}
             onClick={() => {
               downloadSelectedFile();
               setShowActions(false);
             }}
           >
-            <DownloadOutlinedIcon fontSize="small" />
-            <span>{terminology.download}</span>
-          </button>
-
+            {terminology.download}
+          </Button>
           <div className={styles.actionsDivider} />
-
-          <button
+          <Button
+            variant="tertiary"
+            justify="start"
+            fullWidth
             className={`${styles.actionRow} ${styles.actionDanger}`}
+            leftSection={<DeleteOutlineIcon fontSize="small" />}
             onClick={() => {
               onDeleteFile(file.id);
               onSetStatus(`Deleted ${file.name}`);
               setShowActions(false);
             }}
           >
-            <DeleteOutlineIcon fontSize="small" />
-            <span>{t("delete", "Delete")}</span>
-          </button>
+            {t("delete", "Delete")}
+          </Button>
         </div>
       )}
 
diff --git a/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx b/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
index 2e8653fa89..96762a9203 100644
--- a/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
+++ b/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
@@ -1,4 +1,5 @@
-import { Tooltip, ActionIcon } from "@mantine/core";
+import { Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import UndoIcon from "@mui/icons-material/Undo";
 import RedoIcon from "@mui/icons-material/Redo";
 import ContentCutIcon from "@mui/icons-material/ContentCut";
@@ -135,28 +136,22 @@ const PageEditorControls = ({
         {/* Undo/Redo */}
         <Tooltip label={t("pageEditor.toolbar.undo", "Undo")}>
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={onUndo}
             disabled={!canUndo}
-            variant="subtle"
-            style={{
-              color: canUndo ? "var(--text-secondary)" : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={t("pageEditor.toolbar.undo", "Undo")}
           >
             <UndoIcon />
           </ActionIcon>
         </Tooltip>
         <Tooltip label={t("pageEditor.toolbar.redo", "Redo")}>
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={onRedo}
             disabled={!canRedo}
-            variant="subtle"
-            style={{
-              color: canRedo ? "var(--text-secondary)" : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={t("pageEditor.toolbar.redo", "Redo")}
           >
             <RedoIcon />
           </ActionIcon>
@@ -176,17 +171,14 @@ const PageEditorControls = ({
           label={t("pageEditor.toolbar.rotateLeft", "Rotate Selected Left")}
         >
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={() => onRotate("left")}
             disabled={selectedPageIds.length === 0}
-            variant="subtle"
-            style={{
-              color:
-                selectedPageIds.length > 0
-                  ? "var(--text-secondary)"
-                  : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={t(
+              "pageEditor.toolbar.rotateLeft",
+              "Rotate Selected Left",
+            )}
           >
             <RotateLeftIcon />
           </ActionIcon>
@@ -195,68 +187,47 @@ const PageEditorControls = ({
           label={t("pageEditor.toolbar.rotateRight", "Rotate Selected Right")}
         >
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={() => onRotate("right")}
             disabled={selectedPageIds.length === 0}
-            variant="subtle"
-            style={{
-              color:
-                selectedPageIds.length > 0
-                  ? "var(--text-secondary)"
-                  : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={t(
+              "pageEditor.toolbar.rotateRight",
+              "Rotate Selected Right",
+            )}
           >
             <RotateRightIcon />
           </ActionIcon>
         </Tooltip>
         <Tooltip label={t("pageEditor.toolbar.delete", "Delete Selected")}>
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={onDelete}
             disabled={selectedPageIds.length === 0}
-            variant="subtle"
-            style={{
-              color:
-                selectedPageIds.length > 0
-                  ? "var(--text-secondary)"
-                  : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={t("pageEditor.toolbar.delete", "Delete Selected")}
           >
             <DeleteIcon />
           </ActionIcon>
         </Tooltip>
         <Tooltip label={getSplitTooltip()}>
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={onSplit}
             disabled={selectedPageIds.length === 0}
-            variant="subtle"
-            style={{
-              color:
-                selectedPageIds.length > 0
-                  ? "var(--text-secondary)"
-                  : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={getSplitTooltip()}
           >
             <ContentCutIcon />
           </ActionIcon>
         </Tooltip>
         <Tooltip label={getPageBreakTooltip()}>
           <ActionIcon
+            variant="tertiary"
+            size="lg"
             onClick={onPageBreak}
             disabled={selectedPageIds.length === 0}
-            variant="subtle"
-            style={{
-              color:
-                selectedPageIds.length > 0
-                  ? "var(--text-secondary)"
-                  : "var(--text-muted)",
-            }}
-            radius="md"
-            size="lg"
+            aria-label={getPageBreakTooltip()}
           >
             <InsertPageBreakIcon />
           </ActionIcon>
diff --git a/frontend/editor/src/core/components/pageEditor/PageSelectByNumberButton.tsx b/frontend/editor/src/core/components/pageEditor/PageSelectByNumberButton.tsx
index fff0b8ef8f..dc2032fa4a 100644
--- a/frontend/editor/src/core/components/pageEditor/PageSelectByNumberButton.tsx
+++ b/frontend/editor/src/core/components/pageEditor/PageSelectByNumberButton.tsx
@@ -1,4 +1,5 @@
-import { ActionIcon, Popover } from "@mantine/core";
+import { Popover } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import BulkSelectionPanel from "@app/components/pageEditor/BulkSelectionPanel";
@@ -37,8 +38,7 @@ export default function PageSelectByNumberButton({
           <Popover.Target>
             <div style={{ display: "inline-flex" }}>
               <ActionIcon
-                variant="subtle"
-                radius="md"
+                variant="tertiary"
                 disabled={disabled || totalPages === 0}
                 aria-label={label}
               >
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
index 71c07d26b3..d2ff79ad97 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
@@ -1,4 +1,5 @@
-import { Button, Text, Group, Divider } from "@mantine/core";
+import { Text, Group, Divider } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import classes from "@app/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css";
 import { LogicalOperator } from "@app/utils/bulkselection/selectionBuilders";
@@ -22,7 +23,7 @@ const OperatorsSection = ({
       <Group gap="sm" wrap="nowrap">
         <Button
           size="sm"
-          variant="outline"
+          variant="secondary"
           className={classes.operatorChip}
           onClick={() => onInsertOperator("and")}
           disabled={!csvInput.trim()}
@@ -37,7 +38,7 @@ const OperatorsSection = ({
         </Button>
         <Button
           size="sm"
-          variant="outline"
+          variant="secondary"
           className={classes.operatorChip}
           onClick={() => onInsertOperator("or")}
           disabled={!csvInput.trim()}
@@ -52,7 +53,7 @@ const OperatorsSection = ({
         </Button>
         <Button
           size="sm"
-          variant="outline"
+          variant="secondary"
           className={classes.operatorChip}
           onClick={() => onInsertOperator("not")}
           disabled={!csvInput.trim()}
@@ -70,7 +71,7 @@ const OperatorsSection = ({
       <Group gap="sm" wrap="nowrap">
         <Button
           size="sm"
-          variant="outline"
+          variant="secondary"
           className={classes.operatorChip}
           onClick={() => onInsertOperator("even")}
           title={t(
@@ -84,7 +85,7 @@ const OperatorsSection = ({
         </Button>
         <Button
           size="sm"
-          variant="outline"
+          variant="secondary"
           className={classes.operatorChip}
           onClick={() => onInsertOperator("odd")}
           title={t(
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
index 3a386f039d..2e5513a7c8 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
@@ -1,4 +1,5 @@
-import { TextInput, Button, Text, Flex, Switch } from "@mantine/core";
+import { TextInput, Text, Flex, Switch } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { Tooltip } from "@app/components/shared/Tooltip";
@@ -77,20 +78,15 @@ const PageSelectionInput = ({
         placeholder="1,3,5-10"
         rightSection={
           csvInput && (
-            <Button
-              variant="subtle"
-              size="xs"
+            <ActionIcon
+              variant="tertiary"
+              accent="neutral"
+              size="sm"
               onClick={onClear}
-              style={{
-                color: "var(--text-muted)",
-                minWidth: "auto",
-                width: "24px",
-                height: "24px",
-                padding: 0,
-              }}
+              aria-label={t("clear", "Clear")}
             >
-              ×
-            </Button>
+              &times;
+            </ActionIcon>
           )
         }
         onKeyDown={(e) => e.key === "Enter" && onUpdatePagesFromCSV()}
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
index 314ca282b6..5fc7341430 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
-import { Button, Text, NumberInput, Group } from "@mantine/core";
+import { Text, NumberInput, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import classes from "@app/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css";
 
 interface SelectPagesProps {
diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.tsx b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
index 365d42608a..264db178ac 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
@@ -5,7 +5,8 @@ import React, {
   useCallback,
   useRef,
 } from "react";
-import { Badge, Modal, Text, ActionIcon, Tooltip, Group } from "@mantine/core";
+import { Badge, Modal, Text, Tooltip, Group } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useNavigate, useLocation } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -365,7 +366,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
                 />
                 <ActionIcon
                   ref={closeButtonRef}
-                  variant="subtle"
+                  variant="tertiary"
                   onClick={handleClose}
                   aria-label={t("settings.close", "Close")}
                   data-autofocus
diff --git a/frontend/editor/src/core/components/shared/BulkShareModal.tsx b/frontend/editor/src/core/components/shared/BulkShareModal.tsx
index 978b321232..e210d2f201 100644
--- a/frontend/editor/src/core/components/shared/BulkShareModal.tsx
+++ b/frontend/editor/src/core/components/shared/BulkShareModal.tsx
@@ -3,13 +3,13 @@ import {
   Modal,
   Stack,
   Text,
-  Button,
   Group,
   Alert,
   TextInput,
   Paper,
   Select,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import LinkIcon from "@mui/icons-material/Link";
 import ContentCopyRoundedIcon from "@mui/icons-material/ContentCopyRounded";
 import { useTranslation } from "react-i18next";
@@ -243,8 +243,8 @@ const BulkShareModal: React.FC<BulkShareModalProps> = ({
                 label={t("storageShare.linkLabel", "Share link")}
                 rightSection={
                   <Button
-                    variant="subtle"
-                    size="xs"
+                    variant="tertiary"
+                    size="sm"
                     leftSection={
                       <ContentCopyRoundedIcon style={{ fontSize: 16 }} />
                     }
@@ -297,7 +297,7 @@ const BulkShareModal: React.FC<BulkShareModalProps> = ({
         </Paper>
 
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={onClose} disabled={isWorking}>
+          <Button variant="secondary" onClick={onClose} disabled={isWorking}>
             {t("cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/shared/BulkUploadToServerModal.tsx b/frontend/editor/src/core/components/shared/BulkUploadToServerModal.tsx
index 16cae6ef88..df594c4eac 100644
--- a/frontend/editor/src/core/components/shared/BulkUploadToServerModal.tsx
+++ b/frontend/editor/src/core/components/shared/BulkUploadToServerModal.tsx
@@ -1,5 +1,6 @@
 import React, { useCallback, useEffect, useMemo, useState } from "react";
-import { Modal, Stack, Text, Button, Group, Alert } from "@mantine/core";
+import { Modal, Stack, Text, Group, Alert } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
 import { useTranslation } from "react-i18next";
 
@@ -151,7 +152,7 @@ const BulkUploadToServerModal: React.FC<BulkUploadToServerModalProps> = ({
         )}
 
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={onClose} disabled={isUploading}>
+          <Button variant="secondary" onClick={onClose} disabled={isUploading}>
             {t("cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/shared/ButtonSelector.test.tsx b/frontend/editor/src/core/components/shared/ButtonSelector.test.tsx
index ab9fee8ef6..f13051b0ae 100644
--- a/frontend/editor/src/core/components/shared/ButtonSelector.test.tsx
+++ b/frontend/editor/src/core/components/shared/ButtonSelector.test.tsx
@@ -8,6 +8,14 @@ const TestWrapper = ({ children }: { children: React.ReactNode }) => (
   <MantineProvider>{children}</MantineProvider>
 );
 
+// The shared SegmentedControl renders each option as a radio <input> (inside a
+// <label>) whose `value` attribute matches the option value. Select by value
+// since it is stable regardless of how the label is wrapped (e.g. FitText).
+const getRadioByValue = (container: HTMLElement, value: string) =>
+  container.querySelector<HTMLInputElement>(
+    `input[type="radio"][value="${value}"]`,
+  );
+
 describe("ButtonSelector", () => {
   const mockOnChange = vi.fn();
 
@@ -15,7 +23,7 @@ describe("ButtonSelector", () => {
     vi.clearAllMocks();
   });
 
-  test("should render all options as buttons", () => {
+  test("should render all options as segments", () => {
     const options = [
       { value: "option1", label: "Option 1" },
       { value: "option2", label: "Option 2" },
@@ -37,13 +45,13 @@ describe("ButtonSelector", () => {
     expect(screen.getByText("Option 2")).toBeInTheDocument();
   });
 
-  test("should highlight selected button with filled variant", () => {
+  test("should mark selected option as checked", () => {
     const options = [
       { value: "option1", label: "Option 1" },
       { value: "option2", label: "Option 2" },
     ];
 
-    render(
+    const { container } = render(
       <TestWrapper>
         <ButtonSelector
           value="option1"
@@ -54,22 +62,22 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    const selectedButton = screen.getByRole("button", { name: "Option 1" });
-    const unselectedButton = screen.getByRole("button", { name: "Option 2" });
+    const selectedRadio = getRadioByValue(container, "option1");
+    const unselectedRadio = getRadioByValue(container, "option2");
 
-    // Check data-variant attribute for filled/outline
-    expect(selectedButton).toHaveAttribute("data-variant", "filled");
-    expect(unselectedButton).toHaveAttribute("data-variant", "outline");
+    // Selected option is marked via the radio's checked state.
+    expect(selectedRadio).toBeChecked();
+    expect(unselectedRadio).not.toBeChecked();
     expect(screen.getByText("Selection Label")).toBeInTheDocument();
   });
 
-  test("should call onChange when button is clicked", () => {
+  test("should call onChange when an option is clicked", () => {
     const options = [
       { value: "option1", label: "Option 1" },
       { value: "option2", label: "Option 2" },
     ];
 
-    render(
+    const { container } = render(
       <TestWrapper>
         <ButtonSelector
           value="option1"
@@ -79,7 +87,7 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    fireEvent.click(screen.getByRole("button", { name: "Option 2" }));
+    fireEvent.click(getRadioByValue(container, "option2")!);
 
     expect(mockOnChange).toHaveBeenCalledWith("option2");
   });
@@ -90,7 +98,7 @@ describe("ButtonSelector", () => {
       { value: "option2", label: "Option 2" },
     ];
 
-    render(
+    const { container } = render(
       <TestWrapper>
         <ButtonSelector
           value={undefined}
@@ -100,17 +108,17 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    // Both buttons should be outlined when no value is selected
-    const button1 = screen.getByRole("button", { name: "Option 1" });
-    const button2 = screen.getByRole("button", { name: "Option 2" });
+    // No option should be checked when no value is selected
+    const radio1 = getRadioByValue(container, "option1");
+    const radio2 = getRadioByValue(container, "option2");
 
-    expect(button1).toHaveAttribute("data-variant", "outline");
-    expect(button2).toHaveAttribute("data-variant", "outline");
+    expect(radio1).not.toBeChecked();
+    expect(radio2).not.toBeChecked();
   });
 
   test.each([
     {
-      description: "disable buttons when disabled prop is true",
+      description: "disable options when disabled prop is true",
       options: [
         { value: "option1", label: "Option 1" },
         { value: "option2", label: "Option 2" },
@@ -128,7 +136,7 @@ describe("ButtonSelector", () => {
       expectedStates: [false, true],
     },
   ])("should $description", ({ options, globalDisabled, expectedStates }) => {
-    render(
+    const { container } = render(
       <TestWrapper>
         <ButtonSelector
           value="option1"
@@ -140,18 +148,18 @@ describe("ButtonSelector", () => {
     );
 
     options.forEach((option, index) => {
-      const button = screen.getByRole("button", { name: option.label });
-      expect(button).toHaveProperty("disabled", expectedStates[index]);
+      const radio = getRadioByValue(container, String(option.value));
+      expect(radio).toHaveProperty("disabled", expectedStates[index]);
     });
   });
 
-  test("should not call onChange when disabled button is clicked", () => {
+  test("should not allow selecting a disabled option", () => {
     const options = [
       { value: "option1", label: "Option 1" },
       { value: "option2", label: "Option 2", disabled: true },
     ];
 
-    render(
+    const { container } = render(
       <TestWrapper>
         <ButtonSelector
           value="option1"
@@ -161,12 +169,16 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    fireEvent.click(screen.getByRole("button", { name: "Option 2" }));
-
+    // The disabled option's radio is disabled, so a real user cannot select it
+    // and onChange will not fire from genuine interaction. (jsdom does not
+    // replicate the browser's disabled-click blocking, so assert the disabled
+    // state — that is what prevents selection for real users.)
+    const disabledRadio = getRadioByValue(container, "option2");
+    expect(disabledRadio).toBeDisabled();
     expect(mockOnChange).not.toHaveBeenCalled();
   });
 
-  test("should not apply fullWidth styling when fullWidth is false", () => {
+  test("should render options when fullWidth is false", () => {
     const options = [
       { value: "option1", label: "Option 1" },
       { value: "option2", label: "Option 2" },
@@ -184,8 +196,7 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    const button = screen.getByRole("button", { name: "Option 1" });
-    expect(button).not.toHaveStyle({ flex: "1" });
+    expect(screen.getByText("Option 1")).toBeInTheDocument();
     expect(screen.getByText("Layout Label")).toBeInTheDocument();
   });
 
@@ -205,14 +216,14 @@ describe("ButtonSelector", () => {
       </TestWrapper>,
     );
 
-    // Should render buttons
+    // Should render the options
     expect(screen.getByText("Option 1")).toBeInTheDocument();
     expect(screen.getByText("Option 2")).toBeInTheDocument();
 
-    // Stack should only contain the Group (buttons), no Text element for label
+    // Stack should only contain the SegmentedControl, no label Text element
     const stackElement = container.querySelector(
       '[class*="mantine-Stack-root"]',
     );
-    expect(stackElement?.children).toHaveLength(1); // Only the Group, no label Text
+    expect(stackElement?.children).toHaveLength(1); // Only the SegmentedControl, no label Text
   });
 });
diff --git a/frontend/editor/src/core/components/shared/ButtonSelector.tsx b/frontend/editor/src/core/components/shared/ButtonSelector.tsx
index 73e18cac8a..f52256ba0a 100644
--- a/frontend/editor/src/core/components/shared/ButtonSelector.tsx
+++ b/frontend/editor/src/core/components/shared/ButtonSelector.tsx
@@ -1,5 +1,6 @@
-import { Button, Group, Stack, Text, Tooltip } from "@mantine/core";
+import { Stack, Text, Tooltip } from "@mantine/core";
 import FitText from "@app/components/shared/FitText";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 
 export interface ButtonOption<T> {
   value: T;
@@ -15,7 +16,6 @@ interface ButtonSelectorProps<T> {
   label?: string;
   disabled?: boolean;
   fullWidth?: boolean;
-  buttonClassName?: string;
   textClassName?: string;
 }
 
@@ -26,9 +26,43 @@ const ButtonSelector = <T extends string | number>({
   label = undefined,
   disabled = false,
   fullWidth = true,
-  buttonClassName,
   textClassName,
 }: ButtonSelectorProps<T>) => {
+  const selectedValue = value === undefined ? "" : String(value);
+
+  const segmentedOptions = options.map((option) => {
+    const isDisabled = disabled || option.disabled;
+    const fitText = (
+      <FitText
+        text={option.label}
+        lines={1}
+        minimumFontScale={0.5}
+        fontSize={10}
+        className={textClassName}
+      />
+    );
+
+    return {
+      value: String(option.value),
+      disabled: isDisabled,
+      label:
+        option.tooltip && isDisabled ? (
+          <Tooltip label={option.tooltip} position="top" withArrow>
+            <span>{fitText}</span>
+          </Tooltip>
+        ) : (
+          fitText
+        ),
+    };
+  });
+
+  const handleChange = (next: string) => {
+    const matched = options.find((option) => String(option.value) === next);
+    if (matched) {
+      onChange(matched.value);
+    }
+  };
+
   return (
     <Stack gap="var(--mantine-spacing-sm)">
       {/* Label (if it exists) */}
@@ -44,69 +78,12 @@ const ButtonSelector = <T extends string | number>({
         </Text>
       )}
 
-      {/* Buttons */}
-      <Group gap="4px">
-        {options.map((option) => {
-          const isDisabled = disabled || option.disabled;
-          const button = (
-            <Button
-              variant={value === option.value ? "filled" : "outline"}
-              color={
-                value === option.value
-                  ? "var(--color-primary-500)"
-                  : "var(--text-muted)"
-              }
-              onClick={() => onChange(option.value)}
-              disabled={isDisabled}
-              className={buttonClassName}
-              style={{
-                flex: fullWidth ? 1 : undefined,
-                height: "auto",
-                minHeight: "2.5rem",
-                fontSize: "var(--mantine-font-size-sm)",
-                lineHeight: "1.4",
-                paddingTop: "0.5rem",
-                paddingBottom: "0.5rem",
-              }}
-            >
-              <FitText
-                text={option.label}
-                lines={1}
-                minimumFontScale={0.5}
-                fontSize={10}
-                className={textClassName}
-              />
-            </Button>
-          );
-
-          // Wrap with tooltip if provided (useful for disabled state explanations)
-          if (option.tooltip && isDisabled) {
-            return (
-              <Tooltip
-                key={option.value}
-                label={option.tooltip}
-                position="top"
-                withArrow
-              >
-                <span
-                  style={{ flex: fullWidth ? 1 : undefined, display: "flex" }}
-                >
-                  {button}
-                </span>
-              </Tooltip>
-            );
-          }
-
-          return (
-            <span
-              key={option.value}
-              style={{ flex: fullWidth ? 1 : undefined, display: "flex" }}
-            >
-              {button}
-            </span>
-          );
-        })}
-      </Group>
+      <SegmentedControl
+        options={segmentedOptions}
+        value={selectedValue}
+        onChange={handleChange}
+        fullWidth={fullWidth}
+      />
     </Stack>
   );
 };
diff --git a/frontend/editor/src/core/components/shared/ButtonToggle.tsx b/frontend/editor/src/core/components/shared/ButtonToggle.tsx
index 5e02fb169b..9932c88062 100644
--- a/frontend/editor/src/core/components/shared/ButtonToggle.tsx
+++ b/frontend/editor/src/core/components/shared/ButtonToggle.tsx
@@ -1,5 +1,4 @@
-import { Button, Stack } from "@mantine/core";
-import React from "react";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 
 export interface ButtonToggleOption {
   value: string;
@@ -13,70 +12,49 @@ export interface ButtonToggleProps {
   value: string;
   onChange: (value: string) => void;
   disabled?: boolean;
-  orientation?: "vertical" | "horizontal";
   size?: "xs" | "sm" | "md" | "lg";
   fullWidth?: boolean;
 }
 
-export const ButtonToggle: React.FC<ButtonToggleProps> = ({
+export const ButtonToggle = ({
   options,
   value,
   onChange,
   disabled = false,
-  orientation = "vertical",
   size = "md",
   fullWidth = true,
-}) => {
-  const isVertical = orientation === "vertical";
+}: ButtonToggleProps) => {
+  const segmentedSize = size === "xs" || size === "sm" ? "sm" : "md";
 
-  const buttonStyle: React.CSSProperties = {
-    justifyContent: "flex-start",
-    height: isVertical ? "auto" : undefined,
-    minHeight: isVertical ? "50px" : undefined,
-    padding: isVertical ? "12px 16px" : undefined,
-    textAlign: "left",
-  };
-
-  const renderButton = (option: ButtonToggleOption) => {
-    const isSelected = value === option.value;
-    const isDisabled = disabled || option.disabled;
-
-    return (
-      <Button
-        key={option.value}
-        variant={isSelected ? "filled" : "outline"}
-        onClick={() => !isDisabled && onChange(option.value)}
-        disabled={isDisabled}
-        size={size}
-        fullWidth={fullWidth}
-        style={buttonStyle}
-      >
-        <div style={{ width: "100%" }}>
-          <div style={{ fontWeight: 600 }}>{option.label}</div>
-          {option.description && (
-            <div
-              style={{
-                fontSize: "0.85em",
-                opacity: 0.8,
-                marginTop: "4px",
-                fontWeight: 400,
-              }}
-            >
-              {option.description}
-            </div>
-          )}
-        </div>
-      </Button>
-    );
-  };
-
-  if (isVertical) {
-    return <Stack gap="xs">{options.map(renderButton)}</Stack>;
-  }
+  const segmentedOptions = options.map((option) => ({
+    value: option.value,
+    disabled: disabled || option.disabled,
+    label: (
+      <div>
+        <div style={{ fontWeight: 600 }}>{option.label}</div>
+        {option.description && (
+          <div
+            style={{
+              fontSize: "0.85em",
+              opacity: 0.8,
+              marginTop: 4,
+              fontWeight: 400,
+            }}
+          >
+            {option.description}
+          </div>
+        )}
+      </div>
+    ),
+  }));
 
   return (
-    <div style={{ display: "flex", gap: "8px", flexWrap: "wrap" }}>
-      {options.map(renderButton)}
-    </div>
+    <SegmentedControl
+      options={segmentedOptions}
+      value={value}
+      onChange={onChange}
+      size={segmentedSize}
+      fullWidth={fullWidth}
+    />
   );
 };
diff --git a/frontend/editor/src/core/components/shared/DismissAllErrorsButton.tsx b/frontend/editor/src/core/components/shared/DismissAllErrorsButton.tsx
index 3bcc53daf7..5f3f4ada2a 100644
--- a/frontend/editor/src/core/components/shared/DismissAllErrorsButton.tsx
+++ b/frontend/editor/src/core/components/shared/DismissAllErrorsButton.tsx
@@ -1,9 +1,9 @@
 import React from "react";
-import { Button, Group } from "@mantine/core";
+import { Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useFileState } from "@app/contexts/FileContext";
 import { useFileActions } from "@app/contexts/file/fileHooks";
-import CloseIcon from "@mui/icons-material/Close";
 import { Z_INDEX_TOAST } from "@app/styles/zIndex";
 
 interface DismissAllErrorsButtonProps {
@@ -32,10 +32,9 @@ const DismissAllErrorsButton: React.FC<DismissAllErrorsButtonProps> = ({
   return (
     <Group className={className}>
       <Button
-        variant="light"
-        color="red"
+        variant="secondary"
+        accent="danger"
         size="sm"
-        leftSection={<CloseIcon fontSize="small" />}
         onClick={handleDismissAllErrors}
         style={{
           position: "absolute",
diff --git a/frontend/editor/src/core/components/shared/DropdownListWithFooter.tsx b/frontend/editor/src/core/components/shared/DropdownListWithFooter.tsx
index c2f9ac6db2..8965c18af3 100644
--- a/frontend/editor/src/core/components/shared/DropdownListWithFooter.tsx
+++ b/frontend/editor/src/core/components/shared/DropdownListWithFooter.tsx
@@ -16,7 +16,7 @@ import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
 export interface DropdownItem {
   value: string;
   name: string;
-  leftIcon?: ReactNode;
+  leftSection?: ReactNode;
   disabled?: boolean;
 }
 
@@ -232,9 +232,9 @@ const DropdownListWithFooter: React.FC<DropdownListWithFooterProps> = ({
                     }}
                   >
                     <Group gap="sm" style={{ flex: 1 }}>
-                      {item.leftIcon && (
+                      {item.leftSection && (
                         <Box style={{ display: "flex", alignItems: "center" }}>
-                          {item.leftIcon}
+                          {item.leftSection}
                         </Box>
                       )}
                       <Text size="sm">{item.name}</Text>
diff --git a/frontend/editor/src/core/components/shared/EditableSecretField.tsx b/frontend/editor/src/core/components/shared/EditableSecretField.tsx
index 88ee8cad95..24e6d881c3 100644
--- a/frontend/editor/src/core/components/shared/EditableSecretField.tsx
+++ b/frontend/editor/src/core/components/shared/EditableSecretField.tsx
@@ -1,12 +1,7 @@
 import { useState, useRef, useEffect } from "react";
-import {
-  PasswordInput,
-  Group,
-  ActionIcon,
-  Tooltip,
-  TextInput,
-} from "@mantine/core";
+import { PasswordInput, Group, Tooltip, TextInput } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 
 interface EditableSecretFieldProps {
@@ -95,7 +90,7 @@ export default function EditableSecretField({
           <TextInput value="••••••••" disabled style={{ flex: 1 }} readOnly />
           <Tooltip label={t("editSecret")} withArrow>
             <ActionIcon
-              variant="light"
+              variant="secondary"
               onClick={handleEdit}
               disabled={disabled}
               title={t("editableSecretField.edit", "Edit")}
diff --git a/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.tsx b/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.tsx
index f713d1e526..f6aa3391d5 100644
--- a/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.tsx
+++ b/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.tsx
@@ -1,11 +1,5 @@
-import {
-  Modal,
-  Stack,
-  Text,
-  Button,
-  PasswordInput,
-  Group,
-} from "@mantine/core";
+import { Modal, Stack, Text, PasswordInput, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { type KeyboardEventHandler } from "react";
 import { Z_INDEX_OVER_FULLSCREEN_SURFACE } from "@app/styles/zIndex";
@@ -87,8 +81,8 @@ const EncryptedPdfUnlockModal = ({
 
         <Group justify="space-between">
           <Button
-            variant="light"
-            color="var(--mantine-color-gray-8)"
+            variant="secondary"
+            accent="neutral"
             onClick={onSkip}
             disabled={isProcessing}
           >
@@ -97,7 +91,7 @@ const EncryptedPdfUnlockModal = ({
           <Group gap="xs">
             {remainingCount > 0 && (
               <Button
-                variant="light"
+                variant="secondary"
                 onClick={onUnlockAll}
                 loading={isProcessing}
                 disabled={password.trim().length === 0}
diff --git a/frontend/editor/src/core/components/shared/ErrorBoundary.tsx b/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
index aa2f126287..a2003a7d61 100644
--- a/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
+++ b/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Text, Button, Stack } from "@mantine/core";
+import { Text, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 
 interface ErrorBoundaryState {
   hasError: boolean;
@@ -128,7 +129,11 @@ export default class ErrorBoundary extends React.Component<
               )}
             </>
           )}
-          <Button onClick={this.retry} variant="light" mt="md">
+          <Button
+            onClick={this.retry}
+            variant="secondary"
+            style={{ marginTop: "var(--mantine-spacing-md)" }}
+          >
             Try Again
           </Button>
         </Stack>
diff --git a/frontend/editor/src/core/components/shared/FileCard.tsx b/frontend/editor/src/core/components/shared/FileCard.tsx
index 5d53418d7f..c731092459 100644
--- a/frontend/editor/src/core/components/shared/FileCard.tsx
+++ b/frontend/editor/src/core/components/shared/FileCard.tsx
@@ -1,15 +1,7 @@
 import { useState } from "react";
-import {
-  Card,
-  Stack,
-  Text,
-  Group,
-  Badge,
-  Button,
-  Box,
-  ActionIcon,
-  Tooltip,
-} from "@mantine/core";
+import { Card, Stack, Text, Group, Badge, Box, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import StorageIcon from "@mui/icons-material/Storage";
 import VisibilityIcon from "@mui/icons-material/Visibility";
@@ -114,8 +106,8 @@ const FileCard = ({
                 <Tooltip label={t("fileCard.viewInViewer", "View in Viewer")}>
                   <ActionIcon
                     size="sm"
-                    variant="subtle"
-                    color="blue"
+                    variant="tertiary"
+                    aria-label={t("fileCard.viewInViewer", "View in Viewer")}
                     onClick={(e) => {
                       e.stopPropagation();
                       onView();
@@ -131,8 +123,12 @@ const FileCard = ({
                 >
                   <ActionIcon
                     size="sm"
-                    variant="subtle"
-                    color="orange"
+                    variant="tertiary"
+                    accent="warning"
+                    aria-label={t(
+                      "fileCard.openInFileEditor",
+                      "Open in File Editor",
+                    )}
                     onClick={(e) => {
                       e.stopPropagation();
                       onEdit();
@@ -182,14 +178,14 @@ const FileCard = ({
         </Group>
 
         <Button
-          color="red"
-          size="xs"
-          variant="light"
+          accent="danger"
+          size="sm"
+          variant="secondary"
           onClick={(e) => {
             e.stopPropagation();
             onRemove();
           }}
-          mt={4}
+          style={{ marginTop: 4 }}
         >
           {t("delete", "Remove")}
         </Button>
diff --git a/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx b/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
index 519366b9d6..735d633fee 100644
--- a/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
+++ b/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Menu, Loader, Group, Text, ActionIcon, Tooltip } from "@mantine/core";
+import { Menu, Loader, Group, Text, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import InsertDriveFileIcon from "@mui/icons-material/InsertDriveFile";
 import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
@@ -102,10 +103,14 @@ export const FileDropdownMenu: React.FC<FileDropdownMenuProps> = ({
                       withArrow
                     >
                       <ActionIcon
-                        component="div"
-                        size="xs"
-                        variant="subtle"
-                        color="red"
+                        as="span"
+                        size="sm"
+                        variant="tertiary"
+                        accent="danger"
+                        aria-label={t(
+                          "fileDropdownMenu.closeFile",
+                          "Close file",
+                        )}
                         onClick={(e) => {
                           e.stopPropagation();
                           onFileRemove(file.fileId as FileId);
diff --git a/frontend/editor/src/core/components/shared/FileGrid.tsx b/frontend/editor/src/core/components/shared/FileGrid.tsx
index 2ade54426f..c1e87ab18a 100644
--- a/frontend/editor/src/core/components/shared/FileGrid.tsx
+++ b/frontend/editor/src/core/components/shared/FileGrid.tsx
@@ -1,13 +1,6 @@
 import { useState } from "react";
-import {
-  Box,
-  Flex,
-  Group,
-  Text,
-  Button,
-  TextInput,
-  Select,
-} from "@mantine/core";
+import { Box, Flex, Group, Text, TextInput, Select } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import SearchIcon from "@mui/icons-material/Search";
 import SortIcon from "@mui/icons-material/Sort";
@@ -121,7 +114,7 @@ const FileGrid = ({
           </Group>
 
           {onDeleteAll && (
-            <Button color="red" size="sm" onClick={onDeleteAll}>
+            <Button accent="danger" size="sm" onClick={onDeleteAll}>
               {t("fileManager.deleteAll", "Delete All")}
             </Button>
           )}
@@ -179,7 +172,7 @@ const FileGrid = ({
       {/* Show All Button */}
       {hasMoreFiles && onShowAll && (
         <Group justify="center" mt="md">
-          <Button variant="light" onClick={onShowAll}>
+          <Button variant="secondary" onClick={onShowAll}>
             {t("fileManager.showAll", "Show All")} ({sortedFiles.length} files)
           </Button>
         </Group>
diff --git a/frontend/editor/src/core/components/shared/FilePickerModal.tsx b/frontend/editor/src/core/components/shared/FilePickerModal.tsx
index da1bb91b6c..5e077d3437 100644
--- a/frontend/editor/src/core/components/shared/FilePickerModal.tsx
+++ b/frontend/editor/src/core/components/shared/FilePickerModal.tsx
@@ -2,7 +2,6 @@ import { useState, useEffect } from "react";
 import {
   Modal,
   Text,
-  Button,
   Group,
   Stack,
   Checkbox,
@@ -11,6 +10,7 @@ import {
   Badge,
   SimpleGrid,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import DocumentThumbnail from "@app/components/shared/filePreview/DocumentThumbnail";
 import { FileId } from "@app/types/file";
@@ -151,10 +151,10 @@ const FilePickerModal = ({
                 )}
               </Text>
               <Group gap="xs">
-                <Button size="xs" variant="light" onClick={selectAll}>
+                <Button size="sm" variant="secondary" onClick={selectAll}>
                   {t("pageEdit.selectAll", "Select All")}
                 </Button>
-                <Button size="xs" variant="light" onClick={selectNone}>
+                <Button size="sm" variant="secondary" onClick={selectNone}>
                   {t("pageEdit.deselectAll", "Select None")}
                 </Button>
               </Group>
@@ -249,7 +249,7 @@ const FilePickerModal = ({
 
         {/* Action buttons */}
         <Group justify="flex-end" mt="md">
-          <Button variant="light" onClick={onClose}>
+          <Button variant="secondary" onClick={onClose}>
             {t("close", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx b/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
index feaa5f6b9f..8c8123bd7d 100644
--- a/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
+++ b/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
@@ -1,6 +1,7 @@
 import { useState, useEffect, useCallback, useMemo, useRef } from "react";
 import { createPortal } from "react-dom";
 import { Box, Popover, ScrollArea, Text, Loader } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import AddIcon from "@mui/icons-material/Add";
 import { useTranslation } from "react-i18next";
 import {
@@ -566,9 +567,10 @@ export function FileSelectorPicker({
                 const meta = buildMeta(stub);
                 const isItemLoading = loadingId === stub.id;
                 return (
-                  <button
+                  <Button
                     key={stub.id}
-                    type="button"
+                    variant="tertiary"
+                    hover={false}
                     className={styles.fileItem}
                     onClick={() => void loadAndSelect(stub)}
                     disabled={!!loadingId}
@@ -579,6 +581,9 @@ export function FileSelectorPicker({
                       })
                     }
                     onMouseLeave={() => setHoveredStub(null)}
+                    rightSection={
+                      isItemLoading ? <Loader size="xs" /> : undefined
+                    }
                   >
                     <div className={styles.fileItemContent}>
                       <span className={styles.fileName} title={stub.name}>
@@ -586,8 +591,7 @@ export function FileSelectorPicker({
                       </span>
                       {meta && <span className={styles.fileMeta}>{meta}</span>}
                     </div>
-                    {isItemLoading && <Loader size="xs" />}
-                  </button>
+                  </Button>
                 );
               })
             )}
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.tsx b/frontend/editor/src/core/components/shared/FileSidebar.tsx
index 1eb51b759b..db3820350e 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebar.tsx
@@ -7,6 +7,7 @@ import React, {
   forwardRef,
 } from "react";
 import { Loader, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import { useFileState, useFileActions } from "@app/contexts/file/fileHooks";
@@ -961,26 +962,31 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                   <span className="file-sidebar-section-label">
                     {t("fileSidebar.files", "Files")}
                   </span>
-                  <button
+                  <ActionIcon
+                    variant="quiet"
                     className="file-sidebar-section-btn file-sidebar-section-btn-external"
                     onClick={() => navigate("/files")}
                     title={t(
                       "fileSidebar.openFileManager",
                       "Browse all files & folders",
                     )}
-                    type="button"
+                    aria-label={t(
+                      "fileSidebar.openFileManager",
+                      "Browse all files & folders",
+                    )}
                     data-testid="open-files-page"
                   >
                     <OpenInNewIcon sx={{ fontSize: "1rem" }} />
-                  </button>
-                  <button
+                  </ActionIcon>
+                  <ActionIcon
+                    variant="quiet"
                     className="file-sidebar-section-btn file-sidebar-section-btn-add"
                     onClick={() => nativeFileInputRef.current?.click()}
                     title={t("fileSidebar.addFiles", "Add files")}
-                    type="button"
+                    aria-label={t("fileSidebar.addFiles", "Add files")}
                   >
                     <AddIcon sx={{ fontSize: "1rem" }} />
-                  </button>
+                  </ActionIcon>
                 </div>
 
                 {!stubsLoaded ? (
@@ -989,35 +995,6 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                   </div>
                 ) : filteredFileStubs.length > 0 ? (
                   <div className="file-sidebar-file-list">
-                    <button
-                      type="button"
-                      onClick={() => nativeFileInputRef.current?.click()}
-                      data-testid="add-files-row"
-                      style={{
-                        background: "transparent",
-                        border: "none",
-                        cursor: "pointer",
-                        color: "var(--text-muted)",
-                        padding: "4px 6px",
-                        marginBottom: 4,
-                        display: "flex",
-                        alignItems: "center",
-                        gap: 6,
-                        fontSize: 12,
-                        width: "100%",
-                        textAlign: "left",
-                        borderRadius: 4,
-                      }}
-                      onMouseEnter={(e) => {
-                        e.currentTarget.style.background = "var(--hover-bg)";
-                      }}
-                      onMouseLeave={(e) => {
-                        e.currentTarget.style.background = "transparent";
-                      }}
-                    >
-                      <AddIcon sx={{ fontSize: "0.9rem" }} />
-                      {t("fileSidebar.addFiles", "Add files")}
-                    </button>
                     {filteredFileStubs.map((stub) => {
                       const workbenchFileId = state.files.ids.find(
                         (id) => (id as string) === (stub.id as string),
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
index cab9f589f2..af6d9e06cc 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
@@ -91,7 +91,7 @@
   width: 20px;
   height: 20px;
   border-radius: 5px;
-  border: 1.5px solid var(--border-hover, #52525b);
+  border: 1.5px solid var(--border-hover, var(--border-strong));
 }
 
 .file-sidebar-file-item:hover .file-sidebar-file-checkbox-hover {
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
index 58a318e0d8..ff48a9704d 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
@@ -1,6 +1,7 @@
 import { useState, useCallback, useRef } from "react";
 import { createPortal } from "react-dom";
 import { Menu, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import VisibilityOutlinedIcon from "@mui/icons-material/VisibilityOutlined";
 import VisibilityOffOutlinedIcon from "@mui/icons-material/VisibilityOffOutlined";
@@ -369,14 +370,15 @@ export function FileItem({
             </span>
           )}
         </div>
-        <button
+        <ActionIcon
+          variant="tertiary"
+          size="sm"
           className="file-sidebar-eye-btn"
           onClick={(e) => {
             e.stopPropagation();
             onEyeClick(fileId, e);
           }}
           tabIndex={-1}
-          type="button"
           aria-label={
             isViewedInViewer
               ? t("fileSidebar.fileItem.closeViewer", "Close viewer")
@@ -391,25 +393,25 @@ export function FileItem({
             className="file-sidebar-eye-closed"
             sx={{ fontSize: "1.1rem" }}
           />
-        </button>
-
+        </ActionIcon>
         {(onDelete ||
           onSaveToCloud ||
           (hasVersionHistory && onVersionHistory)) && (
           <Menu position="bottom-end" withinPortal shadow="md" width={190}>
             <Menu.Target>
-              <button
+              <ActionIcon
+                variant="tertiary"
+                size="sm"
                 className="file-sidebar-kebab-btn"
                 onClick={(e) => e.stopPropagation()}
                 tabIndex={-1}
-                type="button"
                 aria-label={t(
                   "fileSidebar.fileItem.moreActions",
                   "More actions",
                 )}
               >
                 <MoreVertIcon sx={{ fontSize: "1.1rem" }} />
-              </button>
+              </ActionIcon>
             </Menu.Target>
             <Menu.Dropdown onClick={(e) => e.stopPropagation()}>
               {hasVersionHistory && onVersionHistory && (
diff --git a/frontend/editor/src/core/components/shared/FileUploadButton.tsx b/frontend/editor/src/core/components/shared/FileUploadButton.tsx
index 000639f09c..b07fbd0271 100644
--- a/frontend/editor/src/core/components/shared/FileUploadButton.tsx
+++ b/frontend/editor/src/core/components/shared/FileUploadButton.tsx
@@ -1,6 +1,32 @@
 import { useRef } from "react";
-import { FileButton, Button } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { FilePicker } from "@app/ui/FilePicker";
+import type { ButtonVariant } from "@app/ui/Button";
+
+// Accept both shared DS variants and the legacy Mantine variant names that
+// existing callers still pass, mapping the latter onto the DS equivalents.
+type LegacyVariant =
+  | "outline"
+  | "filled"
+  | "light"
+  | "default"
+  | "subtle"
+  | "gradient";
+
+const VARIANT_MAP: Record<LegacyVariant, ButtonVariant> = {
+  filled: "primary",
+  outline: "secondary",
+  default: "secondary",
+  light: "tertiary",
+  subtle: "tertiary",
+  gradient: "primary",
+};
+
+function resolveVariant(variant: ButtonVariant | LegacyVariant): ButtonVariant {
+  return variant in VARIANT_MAP
+    ? VARIANT_MAP[variant as LegacyVariant]
+    : (variant as ButtonVariant);
+}
 
 interface FileUploadButtonProps {
   file?: File;
@@ -8,7 +34,7 @@ interface FileUploadButtonProps {
   accept?: string;
   disabled?: boolean;
   placeholder?: string;
-  variant?: "outline" | "filled" | "light" | "default" | "subtle" | "gradient";
+  variant?: ButtonVariant | LegacyVariant;
   fullWidth?: boolean;
 }
 
@@ -18,7 +44,7 @@ const FileUploadButton = ({
   accept,
   disabled = false,
   placeholder,
-  variant = "outline",
+  variant = "secondary",
   fullWidth = true,
 }: FileUploadButtonProps) => {
   const { t } = useTranslation();
@@ -27,18 +53,16 @@ const FileUploadButton = ({
   const defaultPlaceholder = t("chooseFile", "Choose File");
 
   return (
-    <FileButton
+    <FilePicker
       resetRef={resetRef}
       onChange={onChange}
       accept={accept}
       disabled={disabled}
+      variant={resolveVariant(variant)}
+      fullWidth={fullWidth}
     >
-      {(props) => (
-        <Button {...props} variant={variant} fullWidth={fullWidth} color="blue">
-          {file ? file.name : placeholder || defaultPlaceholder}
-        </Button>
-      )}
-    </FileButton>
+      {file ? file.name : placeholder || defaultPlaceholder}
+    </FilePicker>
   );
 };
 
diff --git a/frontend/editor/src/core/components/shared/FirstLoginModal.tsx b/frontend/editor/src/core/components/shared/FirstLoginModal.tsx
index 4d7764f91d..be91ccc03d 100644
--- a/frontend/editor/src/core/components/shared/FirstLoginModal.tsx
+++ b/frontend/editor/src/core/components/shared/FirstLoginModal.tsx
@@ -1,12 +1,6 @@
 import { useState } from "react";
-import {
-  Modal,
-  Stack,
-  Text,
-  PasswordInput,
-  Button,
-  Alert,
-} from "@mantine/core";
+import { Modal, Stack, Text, PasswordInput, Alert } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { accountService } from "@app/services/accountService";
@@ -195,8 +189,8 @@ export default function FirstLoginModal({
           />
 
           <Button
-            type="submit"
             fullWidth
+            type="submit"
             loading={loading}
             disabled={
               !currentPassword ||
@@ -205,7 +199,7 @@ export default function FirstLoginModal({
               newPassword.length < 8 ||
               confirmPassword.length < 8
             }
-            mt="md"
+            style={{ marginTop: "var(--mantine-spacing-md)" }}
           >
             {t("firstLogin.changePassword", "Change Password")}
           </Button>
diff --git a/frontend/editor/src/core/components/shared/Footer.tsx b/frontend/editor/src/core/components/shared/Footer.tsx
index e73a48fd2a..2fb7312fba 100644
--- a/frontend/editor/src/core/components/shared/Footer.tsx
+++ b/frontend/editor/src/core/components/shared/Footer.tsx
@@ -2,6 +2,7 @@ import { Flex } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { useCookieConsent } from "@app/hooks/useCookieConsent";
 import { useFooterInfo } from "@app/hooks/useFooterInfo";
+import { Button } from "@app/ui/Button";
 
 interface FooterProps {
   privacyPolicy?: string;
@@ -53,8 +54,8 @@ export default function Footer({
     <div
       style={{
         height: "var(--footer-height)",
-        backgroundColor: "var(--mantine-color-gray-1)",
-        borderTop: "1px solid var(--mantine-color-gray-2)",
+        backgroundColor: "var(--bg-surface)",
+        borderTop: "1px solid var(--border-subtle)",
         display: "flex",
         flexDirection: "column",
         justifyContent: "center",
@@ -132,13 +133,14 @@ export default function Footer({
           </a>
         )}
         {finalAnalyticsEnabled && (
-          <button
+          <Button
+            variant="tertiary"
             className="footer-link px-3"
             id="cookieBanner"
             onClick={showCookiePreferences}
           >
             {t("legal.showCookieBanner", "Cookie Preferences")}
-          </button>
+          </Button>
         )}
       </Flex>
     </div>
diff --git a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
index fafebdf8f2..a6b827bb1f 100644
--- a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
+++ b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { ActionIcon, Tooltip } from "@mantine/core";
+import { Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import styles from "@app/components/shared/HoverActionMenu.module.css";
 import { Z_INDEX_HOVER_ACTION_MENU } from "@app/styles/zIndex";
 
@@ -60,10 +61,9 @@ const HoverActionMenu: React.FC<HoverActionMenuProps> = ({
         <Tooltip key={action.id} label={action.label}>
           <ActionIcon
             size="md"
-            variant="subtle"
+            variant="tertiary"
             disabled={action.disabled}
             onClick={action.onClick}
-            c={action.color}
             aria-label={action.label}
             style={{ color: action.color || "var(--text-secondary)" }}
             data-tour={action.dataTour}
diff --git a/frontend/editor/src/core/components/shared/InfoBanner.tsx b/frontend/editor/src/core/components/shared/InfoBanner.tsx
index c46d5cd665..6572022299 100644
--- a/frontend/editor/src/core/components/shared/InfoBanner.tsx
+++ b/frontend/editor/src/core/components/shared/InfoBanner.tsx
@@ -1,5 +1,7 @@
 import React, { ReactNode } from "react";
-import { Paper, Group, Text, Button, ActionIcon, Stack } from "@mantine/core";
+import { Paper, Group, Text, Stack } from "@mantine/core";
+import { Button, type ButtonVariant, type ButtonAccent } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 
@@ -31,6 +33,40 @@ const toneStyles: Record<
   },
 };
 
+function toSharedButtonVariant(
+  variant: "light" | "filled" | "white" | "outline" | "subtle",
+): ButtonVariant {
+  switch (variant) {
+    case "filled":
+      return "primary";
+    case "outline":
+      return "secondary";
+    case "subtle":
+      return "tertiary";
+    case "light":
+    case "white":
+    default:
+      return "secondary";
+  }
+}
+
+function toSharedButtonAccent(color: string | undefined): ButtonAccent {
+  // Mantine colours may carry a shade suffix (e.g. "orange.7"); use the hue.
+  const hue = (color ?? "").split(".")[0];
+  switch (hue) {
+    case "red":
+      return "danger";
+    case "green":
+      return "success";
+    case "yellow":
+    case "orange":
+      return "warning";
+    case "blue":
+    default:
+      return "default";
+  }
+}
+
 interface InfoBannerProps {
   /**
    * Either a LocalIcon name (string) for the standard sized icon slot, or a
@@ -98,7 +134,6 @@ export const InfoBanner: React.FC<InfoBannerProps> = ({
 
   const iconSize = compact ? "1rem" : "1.2rem";
   const textSize = compact ? "xs" : "sm";
-  const buttonSize = compact ? "xs" : "xs";
 
   return (
     <Paper
@@ -167,11 +202,13 @@ export const InfoBanner: React.FC<InfoBannerProps> = ({
         <Group gap="xs" align="center" wrap="nowrap">
           {buttonText && onButtonClick && (
             <Button
-              variant={buttonVariant}
-              color={buttonColor ?? toneStyle.buttonColor}
-              size={buttonSize}
-              onClick={onButtonClick}
+              variant={toSharedButtonVariant(buttonVariant)}
+              accent={toSharedButtonAccent(
+                buttonColor ?? toneStyle.buttonColor,
+              )}
+              size="sm"
               loading={loading}
+              onClick={onButtonClick}
               leftSection={
                 <LocalIcon
                   icon={buttonIcon}
@@ -179,19 +216,15 @@ export const InfoBanner: React.FC<InfoBannerProps> = ({
                   height={compact ? "0.75rem" : "0.9rem"}
                 />
               }
-              styles={
-                buttonTextColor
-                  ? { label: { color: buttonTextColor } }
-                  : undefined
-              }
+              style={buttonTextColor ? { color: buttonTextColor } : undefined}
             >
               {buttonText}
             </Button>
           )}
           {dismissible && (
             <ActionIcon
-              variant="subtle"
-              color={closeIconColor ? undefined : "gray"}
+              variant="tertiary"
+              accent="neutral"
               size="sm"
               onClick={handleDismiss}
               aria-label={t("infoBanner.dismiss", "Dismiss")}
diff --git a/frontend/editor/src/core/components/shared/LandingActions.tsx b/frontend/editor/src/core/components/shared/LandingActions.tsx
index 23faf275ce..3d801f82de 100644
--- a/frontend/editor/src/core/components/shared/LandingActions.tsx
+++ b/frontend/editor/src/core/components/shared/LandingActions.tsx
@@ -1,5 +1,7 @@
 import React from "react";
-import { Button, Group, Tooltip, ActionIcon } from "@mantine/core";
+import { Group, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { useFilesModalContext } from "@app/contexts/FilesModalContext";
 import { useFileActionTerminology } from "@app/hooks/useFileActionTerminology";
@@ -30,7 +32,7 @@ export function LandingActions({
     <>
       <Group gap="sm" justify="center" wrap="wrap" mb="xs">
         <Button
-          classNames={{ root: "landing-btn-primary" }}
+          className="landing-btn-primary"
           leftSection={
             <LocalIcon
               icon={icons.uploadIconName}
@@ -48,8 +50,8 @@ export function LandingActions({
         </Button>
 
         <Button
-          variant="default"
-          classNames={{ root: "landing-btn-secondary" }}
+          variant="secondary"
+          className="landing-btn-secondary"
           leftSection={
             <LocalIcon
               icon="add"
@@ -70,10 +72,9 @@ export function LandingActions({
           <Tooltip label={terminology.mobileUpload} position="bottom">
             <ActionIcon
               size="lg"
-              variant="default"
-              radius="md"
+              variant="secondary"
               aria-label={terminology.mobileUpload}
-              classNames={{ root: "landing-btn-secondary landing-btn-icon" }}
+              className="landing-btn-secondary landing-btn-icon"
               onClick={(e) => {
                 e.stopPropagation();
                 onMobileUploadClick();
diff --git a/frontend/editor/src/core/components/shared/LandingPage.css b/frontend/editor/src/core/components/shared/LandingPage.css
index 233b15cfee..a785418877 100644
--- a/frontend/editor/src/core/components/shared/LandingPage.css
+++ b/frontend/editor/src/core/components/shared/LandingPage.css
@@ -5,11 +5,12 @@
 
 /* ── Hero text ───────────────────────────────────────────── */
 .landing-title {
-  display: block;
-  margin: 1.75rem auto 0.5rem;
-  height: 3rem;
-  width: auto;
-  max-width: 100%;
+  margin: 1.75rem 0 0.5rem;
+  text-align: center;
+  font-size: 2rem;
+  font-weight: 700;
+  line-height: 1.25;
+  color: var(--text-primary);
 }
 
 .landing-subtitle {
diff --git a/frontend/editor/src/core/components/shared/LandingPage.tsx b/frontend/editor/src/core/components/shared/LandingPage.tsx
index 1f9f117f3e..efb54cd7b6 100644
--- a/frontend/editor/src/core/components/shared/LandingPage.tsx
+++ b/frontend/editor/src/core/components/shared/LandingPage.tsx
@@ -8,7 +8,6 @@ import MobileUploadModal from "@app/components/shared/MobileUploadModal";
 import { openFilesFromDisk } from "@app/services/openFilesFromDisk";
 import { LandingDocumentStack } from "@app/components/shared/LandingDocumentStack";
 import { LandingActions } from "@app/components/shared/LandingActions";
-import { Wordmark } from "@app/components/shared/Wordmark";
 import "@app/components/shared/LandingPage.css";
 
 const LandingPage = () => {
@@ -80,10 +79,9 @@ const LandingPage = () => {
       >
         <LandingDocumentStack />
 
-        <Wordmark
-          alt={t("landing.heroTitle", "Stirling PDF")}
-          className="landing-title"
-        />
+        <h3 className="landing-title">
+          {t("landing.workbenchEmptyStateHero", "Drop a PDF anywhere")}
+        </h3>
         <p className="landing-subtitle">
           {t(
             "landing.heroSubtitle",
diff --git a/frontend/editor/src/core/components/shared/LanguageSelector.tsx b/frontend/editor/src/core/components/shared/LanguageSelector.tsx
index d4ff7bbacb..aad6c714d7 100644
--- a/frontend/editor/src/core/components/shared/LanguageSelector.tsx
+++ b/frontend/editor/src/core/components/shared/LanguageSelector.tsx
@@ -1,5 +1,7 @@
 import React, { useState, useEffect } from "react";
-import { Menu, Button, ActionIcon } from "@mantine/core";
+import { Menu } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import { useTranslation } from "react-i18next";
 import { supportedLanguages, setUserLanguage } from "@app/i18n";
@@ -73,50 +75,26 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
       }}
     >
       <Button
-        variant="subtle"
+        variant="tertiary"
+        accent="neutral"
         size="sm"
         fullWidth
         onClick={disabled ? undefined : onClick}
         data-selected={isSelected}
         disabled={disabled}
-        styles={{
-          root: {
-            borderRadius: "4px",
-            minHeight: "32px",
-            padding: "4px 8px",
-            justifyContent: "flex-start",
-            position: "relative",
-            overflow: "hidden",
-            backgroundColor: isSelected
-              ? "light-dark(var(--mantine-color-blue-1), var(--mantine-color-blue-8))"
-              : "transparent",
-            color: disabled
-              ? "var(--text-muted)"
-              : isSelected
-                ? "light-dark(var(--mantine-color-blue-9), var(--mantine-color-blue-3))"
-                : "var(--text-primary)",
-            transition: "all 0.12s cubic-bezier(0.25, 0.46, 0.45, 0.94)",
-            cursor: disabled ? "not-allowed" : "pointer",
-            "&:hover": !disabled
-              ? {
-                  backgroundColor: isSelected
-                    ? "light-dark(var(--mantine-color-blue-2), var(--mantine-color-blue-7))"
-                    : "light-dark(var(--mantine-color-gray-1), var(--mantine-color-dark-5))",
-                  transform: "translateY(-1px)",
-                  boxShadow: "0 2px 8px rgba(0, 0, 0, 0.1)",
-                }
-              : {},
-          },
-          label: {
-            fontSize: "13px",
-            fontWeight: isSelected ? 600 : 400,
-            textAlign: "left",
-            overflow: "hidden",
-            textOverflow: "ellipsis",
-            whiteSpace: "nowrap",
-            position: "relative",
-            zIndex: 2,
-          },
+        style={{
+          justifyContent: "flex-start",
+          position: "relative",
+          overflow: "hidden",
+          fontWeight: isSelected ? 600 : 400,
+          backgroundColor: isSelected
+            ? "light-dark(var(--mantine-color-blue-1), var(--mantine-color-blue-8))"
+            : undefined,
+          color: disabled
+            ? "var(--text-muted)"
+            : isSelected
+              ? "light-dark(var(--mantine-color-blue-9), var(--mantine-color-blue-3))"
+              : "var(--text-primary)",
         }}
       >
         {label}
@@ -272,43 +250,23 @@ const LanguageSelector: React.FC<LanguageSelectorProps> = ({
         <Menu.Target>
           {compact ? (
             <ActionIcon
-              variant="subtle"
-              radius="md"
+              variant="tertiary"
+              accent="neutral"
               data-testid="language-selector-button"
               title={!opened && tooltip ? tooltip : undefined}
-              styles={{
-                root: {
-                  color: "var(--text-secondary)",
-                  "&:hover": {
-                    backgroundColor:
-                      "light-dark(var(--mantine-color-gray-1), var(--mantine-color-dark-5))",
-                  },
-                },
-              }}
+              aria-label={tooltip ?? currentLanguage}
             >
               <LocalIcon icon="language" width="1.5rem" height="1.5rem" />
             </ActionIcon>
           ) : (
             <Button
-              variant="subtle"
+              variant="tertiary"
+              accent="neutral"
               size="sm"
               data-testid="language-selector-button"
               leftSection={
                 <LocalIcon icon="language" width="1.5rem" height="1.5rem" />
               }
-              styles={{
-                root: {
-                  border: "none",
-                  color: "var(--text-primary)",
-                  transition:
-                    "background-color 0.2s cubic-bezier(0.25, 0.46, 0.45, 0.94)",
-                  "&:hover": {
-                    backgroundColor:
-                      "light-dark(var(--mantine-color-gray-1), var(--mantine-color-dark-5))",
-                  },
-                },
-                label: { fontSize: "12px", fontWeight: 500 },
-              }}
             >
               <span className={styles.languageText}>{currentLanguage}</span>
             </Button>
diff --git a/frontend/editor/src/core/components/shared/LoginAgreementModal.tsx b/frontend/editor/src/core/components/shared/LoginAgreementModal.tsx
index 8d419e7cc0..9fb7f7c925 100644
--- a/frontend/editor/src/core/components/shared/LoginAgreementModal.tsx
+++ b/frontend/editor/src/core/components/shared/LoginAgreementModal.tsx
@@ -2,7 +2,6 @@ import { useEffect, useRef, useState } from "react";
 import { useLocation } from "react-router-dom";
 import {
   Box,
-  Button,
   Divider,
   Group,
   Modal,
@@ -10,6 +9,7 @@ import {
   Stack,
   Text,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import Markdown, { type Components } from "react-markdown";
 import remarkGfm from "remark-gfm";
@@ -188,10 +188,10 @@ export default function LoginAgreementModal() {
             )}
           </Text>
           <Group gap="sm" wrap="nowrap">
-            <Button variant="default" onClick={handleDecline}>
+            <Button variant="secondary" onClick={handleDecline}>
               {t("loginAgreementDecline", "Decline")}
             </Button>
-            <Button onClick={handleAccept}>
+            <Button variant="primary" onClick={handleAccept}>
               {t("loginAgreementAccept", "Accept")}
             </Button>
           </Group>
diff --git a/frontend/editor/src/core/components/shared/MultiSelectControls.tsx b/frontend/editor/src/core/components/shared/MultiSelectControls.tsx
index 447662e9dd..160346dd1b 100644
--- a/frontend/editor/src/core/components/shared/MultiSelectControls.tsx
+++ b/frontend/editor/src/core/components/shared/MultiSelectControls.tsx
@@ -1,4 +1,5 @@
-import { Box, Group, Text, Button } from "@mantine/core";
+import { Box, Group, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 interface MultiSelectControlsProps {
@@ -36,20 +37,20 @@ const MultiSelectControls = ({
           {selectedCount} {t("fileManager.filesSelected", "files")}
         </Text>
         <Group>
-          <Button size="xs" variant="light" onClick={onClearSelection}>
+          <Button variant="secondary" size="sm" onClick={onClearSelection}>
             {t("fileManager.clearSelection", "Clear files")}
           </Button>
 
           {onAddToUpload && (
-            <Button size="xs" color="green" onClick={onAddToUpload}>
+            <Button accent="success" size="sm" onClick={onAddToUpload}>
               {t("fileManager.addToUpload", "Add to Upload")}
             </Button>
           )}
 
           {onOpenInFileEditor && (
             <Button
-              size="xs"
-              color="orange"
+              accent="warning"
+              size="sm"
               onClick={onOpenInFileEditor}
               disabled={selectedCount === 0}
             >
@@ -59,8 +60,7 @@ const MultiSelectControls = ({
 
           {onOpenInPageEditor && (
             <Button
-              size="xs"
-              color="blue"
+              size="sm"
               onClick={onOpenInPageEditor}
               disabled={selectedCount === 0}
             >
@@ -69,7 +69,7 @@ const MultiSelectControls = ({
           )}
 
           {onDeleteAll && (
-            <Button size="xs" color="red" onClick={onDeleteAll}>
+            <Button accent="danger" size="sm" onClick={onDeleteAll}>
               {t("fileManager.deleteAll", "Delete All")}
             </Button>
           )}
diff --git a/frontend/editor/src/core/components/shared/NavigationWarningModal.tsx b/frontend/editor/src/core/components/shared/NavigationWarningModal.tsx
index 9917f37ac5..7e3c675f3b 100644
--- a/frontend/editor/src/core/components/shared/NavigationWarningModal.tsx
+++ b/frontend/editor/src/core/components/shared/NavigationWarningModal.tsx
@@ -1,5 +1,6 @@
 import { useRef, useEffect } from "react";
-import { Modal, Text, Button, Group, Stack } from "@mantine/core";
+import { Modal, Text, Group, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useNavigationGuard } from "@app/contexts/NavigationContext";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
@@ -103,10 +104,12 @@ const NavigationWarningModal = () => {
         <Group justify="space-between" gap="xl" visibleFrom="md">
           <Group gap="sm">
             <Button
-              variant="light"
-              color="var(--mantine-color-gray-8)"
+              variant="secondary"
+              accent="neutral"
               onClick={handleKeepWorking}
-              w={BUTTON_WIDTH}
+              style={{
+                width: BUTTON_WIDTH,
+              }}
               leftSection={<ArrowBackIcon fontSize="small" />}
             >
               {t("keepWorking", "Keep Working")}
@@ -114,19 +117,19 @@ const NavigationWarningModal = () => {
           </Group>
           <Group gap="sm">
             <Button
-              variant="filled"
-              color="var(--mantine-color-red-9)"
+              accent="danger"
               onClick={handleDiscardChanges}
-              w={BUTTON_WIDTH}
+              style={{
+                width: BUTTON_WIDTH,
+              }}
               leftSection={<DeleteOutlineIcon fontSize="small" />}
             >
               {t("discardChanges", "Discard Changes")}
             </Button>
             {hasApply && (
               <Button
-                variant="filled"
                 onClick={handleApplyAndContinue}
-                w={BUTTON_WIDTH}
+                style={{ width: BUTTON_WIDTH }}
                 leftSection={<CheckCircleOutlineIcon fontSize="small" />}
               >
                 {t("applyAndContinue", "Apply & Leave")}
@@ -134,9 +137,8 @@ const NavigationWarningModal = () => {
             )}
             {hasExport && (
               <Button
-                variant="filled"
                 onClick={handleExportAndContinue}
-                w={BUTTON_WIDTH}
+                style={{ width: BUTTON_WIDTH }}
                 leftSection={<CheckCircleOutlineIcon fontSize="small" />}
               >
                 {t("exportAndContinue", "Export & Leave")}
@@ -148,28 +150,28 @@ const NavigationWarningModal = () => {
         {/* Mobile layout: centered stack of 4 buttons */}
         <Stack align="center" gap="sm" hiddenFrom="md">
           <Button
-            variant="light"
-            color="var(--mantine-color-gray-8)"
+            variant="secondary"
+            accent="neutral"
             onClick={handleKeepWorking}
-            w={BUTTON_WIDTH}
+            style={{ width: BUTTON_WIDTH }}
             leftSection={<ArrowBackIcon fontSize="small" />}
           >
             {t("keepWorking", "Keep Working")}
           </Button>
           <Button
-            variant="filled"
-            color="var(--mantine-color-red-9)"
+            accent="danger"
             onClick={handleDiscardChanges}
-            w={BUTTON_WIDTH}
+            style={{
+              width: BUTTON_WIDTH,
+            }}
             leftSection={<DeleteOutlineIcon fontSize="small" />}
           >
             {t("discardChanges", "Discard Changes")}
           </Button>
           {hasApply && (
             <Button
-              variant="filled"
               onClick={handleApplyAndContinue}
-              w={BUTTON_WIDTH}
+              style={{ width: BUTTON_WIDTH }}
               leftSection={<CheckCircleOutlineIcon fontSize="small" />}
             >
               {t("applyAndContinue", "Apply & Leave")}
@@ -177,9 +179,8 @@ const NavigationWarningModal = () => {
           )}
           {hasExport && (
             <Button
-              variant="filled"
               onClick={handleExportAndContinue}
-              w={BUTTON_WIDTH}
+              style={{ width: BUTTON_WIDTH }}
               leftSection={<CheckCircleOutlineIcon fontSize="small" />}
             >
               {t("exportAndContinue", "Export & Leave")}
diff --git a/frontend/editor/src/core/components/shared/ObscuredOverlay.tsx b/frontend/editor/src/core/components/shared/ObscuredOverlay.tsx
index ba8140d303..01f14e9be7 100644
--- a/frontend/editor/src/core/components/shared/ObscuredOverlay.tsx
+++ b/frontend/editor/src/core/components/shared/ObscuredOverlay.tsx
@@ -1,4 +1,5 @@
 import React from "react";
+import { Button } from "@app/ui/Button";
 import styles from "@app/components/shared/ObscuredOverlay/ObscuredOverlay.module.css";
 
 type ObscuredOverlayProps = {
@@ -34,13 +35,13 @@ export default function ObscuredOverlay({
               <div className={styles.overlayMessage}>{overlayMessage}</div>
             )}
             {buttonText && onButtonClick && (
-              <button
-                type="button"
+              <Button
+                variant="tertiary"
                 onClick={onButtonClick}
                 className={styles.overlayButton}
               >
                 {buttonText}
-              </button>
+              </Button>
             )}
           </div>
         </div>
diff --git a/frontend/editor/src/core/components/shared/ShareFileModal.tsx b/frontend/editor/src/core/components/shared/ShareFileModal.tsx
index 2f205326e3..1430f9df20 100644
--- a/frontend/editor/src/core/components/shared/ShareFileModal.tsx
+++ b/frontend/editor/src/core/components/shared/ShareFileModal.tsx
@@ -3,13 +3,13 @@ import {
   Modal,
   Stack,
   Text,
-  Button,
   Group,
   Alert,
   TextInput,
   Paper,
   Select,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import LinkIcon from "@mui/icons-material/Link";
 import ContentCopyRoundedIcon from "@mui/icons-material/ContentCopyRounded";
 import { useTranslation } from "react-i18next";
@@ -253,8 +253,8 @@ const ShareFileModal: React.FC<ShareFileModalProps> = ({
                 label={t("storageShare.linkLabel", "Share link")}
                 rightSection={
                   <Button
-                    variant="subtle"
-                    size="xs"
+                    variant="tertiary"
+                    size="sm"
                     leftSection={
                       <ContentCopyRoundedIcon style={{ fontSize: 16 }} />
                     }
@@ -307,7 +307,7 @@ const ShareFileModal: React.FC<ShareFileModalProps> = ({
         </Paper>
 
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={onClose} disabled={isWorking}>
+          <Button variant="secondary" onClick={onClose} disabled={isWorking}>
             {t("cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/shared/ShareManagementModal.tsx b/frontend/editor/src/core/components/shared/ShareManagementModal.tsx
index 2498f902cb..e0e5899f8d 100644
--- a/frontend/editor/src/core/components/shared/ShareManagementModal.tsx
+++ b/frontend/editor/src/core/components/shared/ShareManagementModal.tsx
@@ -3,7 +3,6 @@ import {
   Modal,
   Stack,
   Text,
-  Button,
   Group,
   Alert,
   TextInput,
@@ -13,6 +12,7 @@ import {
   ScrollArea,
   Select,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import ContentCopyRoundedIcon from "@mui/icons-material/ContentCopyRounded";
 import DeleteIcon from "@mui/icons-material/Delete";
 import HistoryIcon from "@mui/icons-material/History";
@@ -648,7 +648,7 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                       </Text>
                       <Group justify="flex-end" gap="sm">
                         <Button
-                          variant="default"
+                          variant="secondary"
                           onClick={() => setShowEmailWarning(false)}
                           disabled={isLoading}
                         >
@@ -731,9 +731,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                           {confirmRemoveUser === user.username ? (
                             <Group gap="xs">
                               <Button
-                                variant="filled"
-                                size="xs"
-                                color="red"
+                                accent="danger"
+                                size="sm"
                                 onClick={() => {
                                   void handleRemoveUser(user.username);
                                 }}
@@ -742,8 +741,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                                 {t("confirm", "Confirm")}
                               </Button>
                               <Button
-                                variant="default"
-                                size="xs"
+                                variant="secondary"
+                                size="sm"
                                 onClick={() => setConfirmRemoveUser(null)}
                               >
                                 {t("cancel", "Cancel")}
@@ -751,9 +750,9 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                             </Group>
                           ) : (
                             <Button
-                              variant="light"
-                              size="xs"
-                              color="red"
+                              variant="secondary"
+                              accent="danger"
+                              size="sm"
                               leftSection={
                                 <DeleteIcon style={{ fontSize: 16 }} />
                               }
@@ -813,8 +812,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                             label={t("storageShare.linkLabel", "Share link")}
                             rightSection={
                               <Button
-                                variant="subtle"
-                                size="xs"
+                                variant="tertiary"
+                                size="sm"
                                 leftSection={
                                   <ContentCopyRoundedIcon
                                     style={{ fontSize: 16 }}
@@ -874,8 +873,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                             </Stack>
                             <Group gap="xs">
                               <Button
-                                variant={isSelected ? "filled" : "light"}
-                                size="xs"
+                                variant={isSelected ? "secondary" : "primary"}
+                                size="sm"
                                 leftSection={
                                   <HistoryIcon style={{ fontSize: 16 }} />
                                 }
@@ -898,9 +897,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                               {confirmRevokeToken === link.token ? (
                                 <Group gap="xs">
                                   <Button
-                                    variant="filled"
-                                    size="xs"
-                                    color="red"
+                                    accent="danger"
+                                    size="sm"
                                     onClick={() => {
                                       void handleRevokeLink(link.token);
                                     }}
@@ -909,8 +907,8 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                                     {t("confirm", "Confirm")}
                                   </Button>
                                   <Button
-                                    variant="default"
-                                    size="xs"
+                                    variant="secondary"
+                                    size="sm"
                                     onClick={() => setConfirmRevokeToken(null)}
                                   >
                                     {t("cancel", "Cancel")}
@@ -918,9 +916,9 @@ const ShareManagementModal: React.FC<ShareManagementModalProps> = ({
                                 </Group>
                               ) : (
                                 <Button
-                                  variant="light"
-                                  size="xs"
-                                  color="red"
+                                  variant="secondary"
+                                  accent="danger"
+                                  size="sm"
                                   leftSection={
                                     <DeleteIcon style={{ fontSize: 16 }} />
                                   }
diff --git a/frontend/editor/src/core/components/shared/TextInput.tsx b/frontend/editor/src/core/components/shared/TextInput.tsx
index f6f4eb632d..06147fb99b 100644
--- a/frontend/editor/src/core/components/shared/TextInput.tsx
+++ b/frontend/editor/src/core/components/shared/TextInput.tsx
@@ -1,5 +1,6 @@
 import React, { forwardRef } from "react";
 import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import styles from "@app/components/shared/textInput/TextInput.module.css";
 
@@ -110,14 +111,14 @@ export const TextInput = forwardRef<HTMLInputElement, TextInputProps>(
           {...props}
         />
         {shouldShowClearButton && (
-          <button
-            type="button"
+          <ActionIcon
+            variant="tertiary"
             className={styles.clearButton}
             onClick={handleClear}
             aria-label={t("textInput.clear", "Clear input")}
           >
             <LocalIcon icon="close-rounded" width="1.25rem" height="1.25rem" />
-          </button>
+          </ActionIcon>
         )}
       </div>
     );
diff --git a/frontend/editor/src/core/components/shared/ToolPanelHeader.tsx b/frontend/editor/src/core/components/shared/ToolPanelHeader.tsx
index e34ca4c6c2..9d5f921bec 100644
--- a/frontend/editor/src/core/components/shared/ToolPanelHeader.tsx
+++ b/frontend/editor/src/core/components/shared/ToolPanelHeader.tsx
@@ -1,5 +1,5 @@
 import type { ReactNode } from "react";
-import { ActionIcon } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import "@app/components/shared/ToolPanelHeader.css";
 
@@ -38,12 +38,12 @@ export function ToolPanelHeader({
       {onClose && (
         <ActionIcon
           className="sui-panelhdr__close"
-          variant="subtle"
-          color="gray"
-          radius="xl"
+          variant="tertiary"
+          accent="neutral"
+          shape="circle"
           size="md"
           onClick={onClose}
-          aria-label={closeLabel}
+          aria-label={closeLabel ?? ""}
         >
           <CloseIcon sx={{ fontSize: 18 }} />
         </ActionIcon>
diff --git a/frontend/editor/src/core/components/shared/Tooltip.tsx b/frontend/editor/src/core/components/shared/Tooltip.tsx
index 12232effc1..9c94bc4726 100644
--- a/frontend/editor/src/core/components/shared/Tooltip.tsx
+++ b/frontend/editor/src/core/components/shared/Tooltip.tsx
@@ -7,6 +7,7 @@ import React, {
 } from "react";
 import { createPortal } from "react-dom";
 import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { addEventListenerWithCleanup } from "@app/utils/genericUtils";
 import { useTooltipPosition } from "@app/hooks/useTooltipPosition";
@@ -396,7 +397,8 @@ export const Tooltip: React.FC<TooltipProps> = ({
       }
     >
       {shouldShowCloseButton && (
-        <button
+        <ActionIcon
+          variant="tertiary"
           className={styles["tooltip-pin-button"]}
           onClick={(e) => {
             e.stopPropagation();
@@ -407,7 +409,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
           aria-label={t("tooltip.close", "Close tooltip")}
         >
           <LocalIcon icon="close-rounded" width="1.25rem" height="1.25rem" />
-        </button>
+        </ActionIcon>
       )}
       {arrow && !sidebarTooltip && (
         <div
diff --git a/frontend/editor/src/core/components/shared/TopControls.tsx b/frontend/editor/src/core/components/shared/TopControls.tsx
index 8fc61183a8..de0b4766d4 100644
--- a/frontend/editor/src/core/components/shared/TopControls.tsx
+++ b/frontend/editor/src/core/components/shared/TopControls.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useCallback, useMemo } from "react";
-import { SegmentedControl, Loader } from "@mantine/core";
+import { Loader } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import InsertDriveFileIcon from "@mui/icons-material/InsertDriveFile";
 import GridViewIcon from "@mui/icons-material/GridView";
 import FolderIcon from "@mui/icons-material/Folder";
@@ -205,46 +206,16 @@ const TopControls = ({
       <div className="flex justify-center">
         <SegmentedControl
           data-tour="view-switcher"
-          data={viewOptions}
+          options={viewOptions}
           value={currentView}
           onChange={handleViewChange}
-          color="blue"
+          variant="secondary"
           fullWidth
           style={{
             transition: "all 0.2s ease",
             opacity: switchingTo ? 0.8 : 1,
             pointerEvents: "auto",
           }}
-          styles={{
-            root: {
-              borderRadius: "0 0 16px 16px",
-              height: "1.8rem",
-              backgroundColor: "var(--bg-toolbar)",
-              border: "1px solid var(--border-default)",
-              borderTop: "none",
-              boxShadow: "0 2px 8px rgba(0,0,0,0.1)",
-              outline: "1px solid rgba(0, 0, 0, 0.1)",
-              outlineOffset: "-1px",
-              padding: "0 0",
-              gap: "0",
-            },
-            control: {
-              borderRadius: "0 0 16px 16px",
-              padding: "0",
-              border: "none",
-            },
-            indicator: {
-              borderRadius: "0 0 16px 16px",
-              height: "100%",
-              top: "0rem",
-              margin: "0",
-              border: "none",
-            },
-            label: {
-              paddingTop: "0",
-              paddingBottom: "0",
-            },
-          }}
         />
       </div>
     </div>
diff --git a/frontend/editor/src/core/components/shared/UpdateModal.tsx b/frontend/editor/src/core/components/shared/UpdateModal.tsx
index c18549360c..4a5e5b2404 100644
--- a/frontend/editor/src/core/components/shared/UpdateModal.tsx
+++ b/frontend/editor/src/core/components/shared/UpdateModal.tsx
@@ -4,7 +4,6 @@ import {
   Stack,
   Text,
   Badge,
-  Button,
   Group,
   Loader,
   Center,
@@ -13,9 +12,11 @@ import {
   Progress,
   Alert,
   Divider,
-  CloseButton,
   Anchor,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import LocalIcon from "@app/components/shared/LocalIcon";
 import { useTranslation } from "react-i18next";
 import {
   updateService,
@@ -271,12 +272,14 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
             </Box>
           </Group>
           {canClose && (
-            <CloseButton
+            <ActionIcon
               onClick={onClose}
               size="lg"
-              variant="subtle"
+              variant="tertiary"
               aria-label={t("update.closeModal", "Close update modal")}
-            />
+            >
+              <LocalIcon icon="close-rounded" width={20} height={20} />
+            </ActionIcon>
           )}
         </Group>
       </Box>
@@ -520,12 +523,12 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                           </Text>
                         </Group>
                         <Button
-                          component="a"
+                          as="a"
                           href={guide.url}
                           target="_blank"
                           onClick={handleExternalLink(guide.url)}
-                          variant="default"
-                          size="xs"
+                          variant="secondary"
+                          size="sm"
                           rightSection={
                             <OpenInNewIcon style={{ fontSize: 12 }} />
                           }
@@ -616,12 +619,11 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                         </Group>
                         <Group gap={4}>
                           <Button
-                            component="a"
+                            as="a"
                             href={`https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v${version.version}`}
                             target="_blank"
-                            variant="subtle"
-                            size="xs"
-                            px={6}
+                            variant="tertiary"
+                            size="sm"
                             onClick={handleExternalLink(
                               `https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v${version.version}`,
                             )}
@@ -689,7 +691,7 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                                 </Text>
                                 {version.compatibility.migration_guide_url && (
                                   <Button
-                                    component="a"
+                                    as="a"
                                     href={
                                       version.compatibility.migration_guide_url
                                     }
@@ -698,10 +700,12 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                                       version.compatibility
                                         .migration_guide_url ?? "",
                                     )}
-                                    variant="light"
-                                    color="orange"
-                                    size="xs"
-                                    mt="xs"
+                                    variant="secondary"
+                                    accent="warning"
+                                    size="sm"
+                                    style={{
+                                      marginTop: "var(--mantine-spacing-xs)",
+                                    }}
                                     rightSection={
                                       <OpenInNewIcon style={{ fontSize: 14 }} />
                                     }
@@ -724,8 +728,8 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
               {sortedVersions.length > 10 && (
                 <Center mt="sm">
                   <Button
-                    variant="subtle"
-                    size="xs"
+                    variant="tertiary"
+                    size="sm"
                     onClick={() => setShowAllVersions(!showAllVersions)}
                   >
                     {showAllVersions
@@ -837,10 +841,9 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
       >
         <Group justify="flex-end" gap="sm">
           <Button
-            variant="default"
+            variant="secondary"
             onClick={handleLater}
             disabled={!canClose}
-            radius="md"
             size="md"
           >
             {t("update.later", "Later")}
@@ -848,8 +851,6 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
           {desktopInstall ? (
             desktopInstall.state === "ready-to-restart" ? (
               <Button
-                color="blue"
-                radius="md"
                 size="md"
                 leftSection={<RestartAltIcon style={{ fontSize: 20 }} />}
                 onClick={() => void desktopInstall.actions.restartApp()}
@@ -866,12 +867,11 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                 {(installBlocked || desktopInstall.state === "error") &&
                   downloadUrl && (
                     <Button
-                      component="a"
+                      as="a"
                       href={downloadUrl}
                       target="_blank"
                       onClick={handleExternalLink(downloadUrl)}
-                      variant="default"
-                      radius="md"
+                      variant="secondary"
                       size="md"
                       leftSection={<DownloadIcon style={{ fontSize: 16 }} />}
                     >
@@ -879,16 +879,10 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                     </Button>
                   )}
                 <Button
-                  color="blue"
-                  radius="md"
-                  size="lg"
+                  size="md"
                   leftSection={<DownloadIcon style={{ fontSize: 20 }} />}
                   onClick={() => void desktopInstall.actions.startInstall()}
                   disabled={installBlocked}
-                  styles={{
-                    root: { paddingLeft: 16, paddingRight: 20 },
-                    inner: { gap: 10 },
-                  }}
                 >
                   <Box>
                     <Text size="sm" fw={700} lh={1.2}>
@@ -907,13 +901,11 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
             // unreachable, the pubkey is wrong, signatures don't match, etc.
             downloadUrl && (
               <Button
-                component="a"
+                as="a"
                 href={downloadUrl}
                 target="_blank"
                 onClick={handleExternalLink(downloadUrl)}
-                color="blue"
-                radius="md"
-                size="lg"
+                size="md"
                 leftSection={<DownloadIcon style={{ fontSize: 20 }} />}
               >
                 {t("update.downloadLatest", "Download Latest")}
diff --git a/frontend/editor/src/core/components/shared/UploadToServerModal.tsx b/frontend/editor/src/core/components/shared/UploadToServerModal.tsx
index 10cfc57dd8..55c4b61c4f 100644
--- a/frontend/editor/src/core/components/shared/UploadToServerModal.tsx
+++ b/frontend/editor/src/core/components/shared/UploadToServerModal.tsx
@@ -1,5 +1,6 @@
 import React, { useCallback, useEffect, useState } from "react";
-import { Modal, Stack, Text, Button, Group, Alert } from "@mantine/core";
+import { Modal, Stack, Text, Group, Alert } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
 import { useTranslation } from "react-i18next";
 
@@ -120,7 +121,7 @@ const UploadToServerModal: React.FC<UploadToServerModalProps> = ({
         )}
 
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={onClose} disabled={isUploading}>
+          <Button variant="secondary" onClick={onClose} disabled={isUploading}>
             {t("cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/shared/UserSelector.tsx b/frontend/editor/src/core/components/shared/UserSelector.tsx
index 956da0cff5..57d2a0dd76 100644
--- a/frontend/editor/src/core/components/shared/UserSelector.tsx
+++ b/frontend/editor/src/core/components/shared/UserSelector.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { MultiSelect, Loader, Text, Button, Stack } from "@mantine/core";
+import { MultiSelect, Loader, Text, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useNavigate } from "react-router-dom";
 import { alert } from "@app/components/toast";
 import { UserSummary } from "@app/types/signingSession";
@@ -117,8 +118,8 @@ const UserSelector = ({
           {t("certSign.collab.userSelector.noUsers", "No other users found.")}
         </Text>
         <Button
-          size="xs"
-          variant="light"
+          size="sm"
+          variant="secondary"
           onClick={() => navigate("/settings/people")}
         >
           {t("certSign.collab.userSelector.inviteUsers", "Add Users")}
diff --git a/frontend/editor/src/core/components/shared/ViewerInlineControls.tsx b/frontend/editor/src/core/components/shared/ViewerInlineControls.tsx
index 9535926c02..bdaf4c6ade 100644
--- a/frontend/editor/src/core/components/shared/ViewerInlineControls.tsx
+++ b/frontend/editor/src/core/components/shared/ViewerInlineControls.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useEffect } from "react";
-import { ActionIcon, Slider } from "@mantine/core";
+import { Slider } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useNavigationState } from "@app/contexts/NavigationContext";
@@ -37,8 +38,7 @@ export function ViewerInlineControls() {
 
       {/* Zoom controls */}
       <ActionIcon
-        variant="subtle"
-        radius="md"
+        variant="tertiary"
         className="workbench-bar-action-icon"
         onClick={() => viewer.zoomActions.zoomOut()}
         aria-label={t("viewer.zoomOut", "Zoom out")}
@@ -66,8 +66,7 @@ export function ViewerInlineControls() {
       </div>
 
       <ActionIcon
-        variant="subtle"
-        radius="md"
+        variant="tertiary"
         className="workbench-bar-action-icon"
         onClick={() => viewer.zoomActions.zoomIn()}
         aria-label={t("viewer.zoomIn", "Zoom in")}
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.css b/frontend/editor/src/core/components/shared/WorkbenchBar.css
index 76490fd2b5..2a61e8099c 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.css
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.css
@@ -77,6 +77,14 @@
   line-height: 1;
 }
 
+/* Segmented view switcher: size the icons to the pre-consolidation 16px
+ * (centering + gap come from the shared SegmentedControl innerLabel). */
+.workbench-bar-views .mantine-SegmentedControl-label svg {
+  font-size: 16px;
+  width: 16px;
+  height: 16px;
+}
+
 /* ---- Center: tool buttons ---- */
 
 /* Single-row: center sits between views and globals */
@@ -126,11 +134,17 @@
   margin-left: auto;
 }
 
-/* Shared action icon style - applies to both center and global buttons */
+/* Shared action icon style - applies to both center and global buttons.
+ * Tight 24px hit-box and no hover background: these are quiet toolbar icons —
+ * hover feedback comes from the icon colour darkening, not a bg tint. */
 .workbench-bar-action-icon {
   color: var(--text-secondary) !important;
-  width: 28px !important;
-  height: 28px !important;
+  /* min-* too: Mantine's ActionIcon sets min-width/min-height from --ai-size
+   * (36px), which floors the width and defeats the 24px clamp. */
+  width: 24px !important;
+  height: 24px !important;
+  min-width: 24px !important;
+  min-height: 24px !important;
   background: transparent !important;
 }
 
@@ -142,7 +156,6 @@
 
 .workbench-bar-action-icon:hover {
   color: var(--text-primary) !important;
-  background-color: var(--hover-bg) !important;
 }
 
 .workbench-bar-action-icon[data-variant="filled"] {
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
index edfbdeba85..87e80a16c5 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
@@ -5,7 +5,9 @@ import React, {
   useRef,
   useSyncExternalStore,
 } from "react";
-import { ActionIcon } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
@@ -40,8 +42,8 @@ import {
   WorkbenchBarRenderContext,
   WorkbenchBarSection,
 } from "@app/types/workbenchBar";
-import InsertDriveFileIcon from "@mui/icons-material/InsertDriveFile";
-import FolderIcon from "@mui/icons-material/Folder";
+import InsertDriveFileOutlinedIcon from "@mui/icons-material/InsertDriveFileOutlined";
+import FolderOutlinedIcon from "@mui/icons-material/FolderOutlined";
 import CloseIcon from "@mui/icons-material/Close";
 import PrintIcon from "@mui/icons-material/Print";
 import "@app/components/shared/WorkbenchBar.css";
@@ -316,17 +318,16 @@ export default function WorkbenchBar({
 
       const ariaLabel =
         btn.ariaLabel ||
-        (typeof btn.tooltip === "string" ? (btn.tooltip as string) : undefined);
+        (typeof btn.tooltip === "string" ? (btn.tooltip as string) : btn.id);
       const buttonNode = (
         <ActionIcon
-          variant={isActive ? "filled" : "subtle"}
-          color={isActive ? "blue" : undefined}
-          radius="md"
+          variant={isActive ? "primary" : "quiet"}
           className="workbench-bar-action-icon"
           onClick={triggerAction}
           disabled={disabled}
           aria-label={ariaLabel}
           aria-pressed={isActive ? true : undefined}
+          hover={isActive ? true : false}
         >
           {btn.icon}
         </ActionIcon>
@@ -341,12 +342,12 @@ export default function WorkbenchBar({
     {
       value: "viewer",
       label: t("workbenchBar.viewer", "Viewer"),
-      icon: <InsertDriveFileIcon fontSize="small" />,
+      icon: <InsertDriveFileOutlinedIcon fontSize="small" />,
     },
     {
       value: "fileEditor",
       label: t("workbenchBar.activeFiles", "Active Files"),
-      icon: <FolderIcon fontSize="small" />,
+      icon: <FolderOutlinedIcon fontSize="small" />,
     },
     ...(selectedTool === "multiTool"
       ? [
@@ -368,7 +369,7 @@ export default function WorkbenchBar({
       .map((v) => ({
         value: v.workbenchId,
         label: v.label,
-        icon: v.icon ?? <InsertDriveFileIcon fontSize="small" />,
+        icon: v.icon ?? <InsertDriveFileOutlinedIcon fontSize="small" />,
       })),
   ];
 
@@ -415,8 +416,8 @@ export default function WorkbenchBar({
       <div className="workbench-bar-views" data-tour="view-switcher">
         {returnRoute && hasFiles && (
           <>
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               className="workbench-bar-view-btn workbench-bar-back-btn"
               onClick={handleBackToFiles}
               aria-label={t(
@@ -428,8 +429,8 @@ export default function WorkbenchBar({
                   : "Back to My Files",
                 { folder: returnRoute.label ?? "" },
               )}
+              leftSection={<ArrowBackIcon style={{ fontSize: "1.1rem" }} />}
             >
-              <ArrowBackIcon style={{ fontSize: "1.1rem" }} />
               <span className="workbench-bar-view-label">
                 {returnRoute.label
                   ? t("filesPage.backToFolder", "Back to {{folder}}", {
@@ -437,23 +438,28 @@ export default function WorkbenchBar({
                     })
                   : t("filesPage.backToMyFiles", "Back to My Files")}
               </span>
-            </button>
+            </Button>
             <div className="workbench-bar-divider" />
           </>
         )}
-        {(hasFiles || isCustomView) &&
-          viewOptions.map((opt) => (
-            <button
-              key={opt.value}
-              className={`workbench-bar-view-btn${currentView === opt.value ? " active" : ""}`}
-              onClick={() => setCurrentView(opt.value)}
-              aria-pressed={currentView === opt.value}
-              type="button"
-            >
-              {opt.icon}
-              <span className="workbench-bar-view-label">{opt.label}</span>
-            </button>
-          ))}
+        {(hasFiles || isCustomView) && (
+          <SegmentedControl<WorkbenchType>
+            className="workbench-bar-views"
+            size="sm"
+            value={currentView}
+            onChange={setCurrentView}
+            variant="secondary"
+            options={viewOptions.map((opt) => ({
+              value: opt.value,
+              label: (
+                <>
+                  {opt.icon}
+                  <span className="workbench-bar-view-label">{opt.label}</span>
+                </>
+              ),
+            }))}
+          />
+        )}
       </div>
 
       {/* Tool buttons - second row, only rendered when buttons exist */}
@@ -493,8 +499,8 @@ export default function WorkbenchBar({
         {currentView === "viewer" &&
           renderWithTooltip(
             <ActionIcon
-              variant="subtle"
-              radius="md"
+              variant="tertiary"
+              hover={false}
               className="workbench-bar-action-icon"
               onClick={handlePrint}
               disabled={
@@ -511,13 +517,14 @@ export default function WorkbenchBar({
         {!isCustomView &&
           renderWithTooltip(
             <ActionIcon
-              variant="subtle"
-              radius="md"
+              variant="tertiary"
+              hover={false}
               className="workbench-bar-action-icon"
               onClick={() => handleExportAll()}
               disabled={
                 disableForFullscreen || totalItems === 0 || allButtonsDisabled
               }
+              aria-label={downloadTooltip}
             >
               <LocalIcon
                 icon={icons.downloadIconName}
@@ -533,13 +540,14 @@ export default function WorkbenchBar({
           icons.saveAsIconName &&
           renderWithTooltip(
             <ActionIcon
-              variant="subtle"
-              radius="md"
+              variant="tertiary"
+              hover={false}
               className="workbench-bar-action-icon"
               onClick={() => handleExportAll(true)}
               disabled={
                 disableForFullscreen || totalItems === 0 || allButtonsDisabled
               }
+              aria-label={t("workbenchBar.saveAs", "Save As")}
             >
               <LocalIcon
                 icon={icons.saveAsIconName}
@@ -559,8 +567,8 @@ export default function WorkbenchBar({
         {!isCustomView &&
           renderWithTooltip(
             <ActionIcon
-              variant="subtle"
-              radius="md"
+              variant="tertiary"
+              hover={false}
               className="workbench-bar-action-icon"
               onClick={handleClose}
               disabled={
diff --git a/frontend/editor/src/core/components/shared/ZipWarningModal.tsx b/frontend/editor/src/core/components/shared/ZipWarningModal.tsx
index 3e52a534fc..31c47f0ed7 100644
--- a/frontend/editor/src/core/components/shared/ZipWarningModal.tsx
+++ b/frontend/editor/src/core/components/shared/ZipWarningModal.tsx
@@ -1,4 +1,5 @@
-import { Modal, Text, Button, Group, Stack } from "@mantine/core";
+import { Modal, Text, Group, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import WarningAmberIcon from "@mui/icons-material/WarningAmber";
 import CheckCircleOutlineIcon from "@mui/icons-material/CheckCircleOutlined";
@@ -55,20 +56,22 @@ const ZipWarningModal = ({
       {/* Desktop layout: centered buttons */}
       <Group justify="center" gap="sm" visibleFrom="md">
         <Button
-          variant="light"
-          color="var(--mantine-color-gray-8)"
+          variant="secondary"
+          accent="neutral"
           onClick={onCancel}
           leftSection={<CancelIcon fontSize="small" />}
-          w="10rem"
+          style={{
+            width: "10rem",
+          }}
         >
           {t("zipWarning.cancel", "Cancel")}
         </Button>
         <Button
-          variant="filled"
-          color="var(--mantine-color-blue-9)"
           onClick={onConfirm}
           leftSection={<CheckCircleOutlineIcon fontSize="small" />}
-          w="10rem"
+          style={{
+            width: "10rem",
+          }}
         >
           {t("zipWarning.confirm", "Extract")}
         </Button>
@@ -77,20 +80,22 @@ const ZipWarningModal = ({
       {/* Mobile layout: vertical stack */}
       <Stack align="center" gap="sm" hiddenFrom="md">
         <Button
-          variant="light"
-          color="var(--mantine-color-gray-8)"
+          variant="secondary"
+          accent="neutral"
           onClick={onCancel}
           leftSection={<CancelIcon fontSize="small" />}
-          w="10rem"
+          style={{
+            width: "10rem",
+          }}
         >
           {t("zipWarning.cancel", "Cancel")}
         </Button>
         <Button
-          variant="filled"
-          color="var(--mantine-color-blue-9)"
           onClick={onConfirm}
           leftSection={<CheckCircleOutlineIcon fontSize="small" />}
-          w="10rem"
+          style={{
+            width: "10rem",
+          }}
         >
           {t("zipWarning.confirm", "Extract")}
         </Button>
diff --git a/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.tsx b/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.tsx
index af96918154..f4e9c47b0a 100644
--- a/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.tsx
+++ b/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.tsx
@@ -1,4 +1,5 @@
-import { Modal, Text, Group, Button, Stack } from "@mantine/core";
+import { Modal, Text, Group, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import RefreshIcon from "@mui/icons-material/Refresh";
 import ScheduleIcon from "@mui/icons-material/Schedule";
@@ -48,14 +49,13 @@ export default function RestartConfirmationModal({
 
         <Group justify="flex-end" gap="sm">
           <Button
-            variant="default"
+            variant="secondary"
             leftSection={<ScheduleIcon style={{ fontSize: 16 }} />}
             onClick={onClose}
           >
             {t("admin.settings.restart.later", "Restart Later")}
           </Button>
           <Button
-            color="blue"
             leftSection={<RefreshIcon style={{ fontSize: 16 }} />}
             onClick={onRestart}
           >
diff --git a/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.tsx b/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.tsx
index a640bb1a22..f3a204b011 100644
--- a/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.tsx
+++ b/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.tsx
@@ -1,4 +1,5 @@
-import { Button, Group, Text } from "@mantine/core";
+import { Group, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 interface SettingsStickyFooterProps {
@@ -29,7 +30,7 @@ export function SettingsStickyFooter({
           {t("admin.settings.unsavedChanges.hint", "You have unsaved changes")}
         </Text>
         <Group gap="sm">
-          <Button variant="default" onClick={onDiscard} size="sm">
+          <Button variant="secondary" onClick={onDiscard} size="sm">
             {t("admin.settings.discard", "Discard")}
           </Button>
           <Button onClick={onSave} loading={saving} size="sm">
diff --git a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
index 598b705347..2ec530a2d5 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
@@ -6,15 +6,15 @@ import {
   Text,
   Tooltip,
   NumberInput,
-  SegmentedControl,
   Select,
   Code,
   Group,
   Anchor,
-  ActionIcon,
-  Button,
   Badge,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import { usePreferences } from "@app/contexts/PreferencesContext";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
@@ -195,8 +195,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
           }}
         >
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            variant="tertiary"
             size="sm"
             style={{ position: "absolute", top: "0.5rem", right: "0.5rem" }}
             onClick={handleDismissBanner}
@@ -346,7 +345,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
               <Group gap="sm">
                 <Button
                   size="sm"
-                  variant="default"
+                  variant="secondary"
                   onClick={checkForUpdate}
                   loading={checkingUpdate}
                   disabled={!currentVersion}
@@ -366,8 +365,10 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
                 {updateSummary && (
                   <Button
                     size="sm"
-                    color={
-                      updateSummary.max_priority === "urgent" ? "red" : "blue"
+                    accent={
+                      updateSummary.max_priority === "urgent"
+                        ? "danger"
+                        : "default"
                     }
                     onClick={() => setUpdateModalOpened(true)}
                     leftSection={
@@ -488,7 +489,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             <SegmentedControl
               value={themeMode}
               onChange={(val) => setTheme(val as ThemeMode)}
-              data={[
+              options={[
                 {
                   label: t("settings.general.themeLight", "Light"),
                   value: "light",
@@ -555,7 +556,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
               onChange={(val: string) =>
                 updatePreference("defaultToolPanelMode", val as ToolPanelMode)
               }
-              data={[
+              options={[
                 {
                   label: t("settings.general.mode.sidebar", "Sidebar"),
                   value: "sidebar",
@@ -593,7 +594,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
               onChange={(val: string) =>
                 updatePreference("defaultStartupView", val as StartupView)
               }
-              data={[
+              options={[
                 {
                   label: t("settings.general.startupView.tools", "Tools"),
                   value: "tools",
diff --git a/frontend/editor/src/core/components/shared/config/configSections/HelpSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/HelpSection.tsx
index 89299fe3d0..013db92d45 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/HelpSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/HelpSection.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Button, Group, Paper, Stack, Text } from "@mantine/core";
+import { Group, Paper, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { requestStartTour } from "@app/constants/events";
@@ -37,7 +38,7 @@ const HelpSection: React.FC<HelpSectionProps> = ({
               </Text>
             </div>
             <Button
-              variant="default"
+              variant="secondary"
               size="sm"
               leftSection={
                 <LocalIcon
@@ -66,7 +67,7 @@ const HelpSection: React.FC<HelpSectionProps> = ({
                 </Text>
               </div>
               <Button
-                variant="default"
+                variant="secondary"
                 size="sm"
                 leftSection={
                   <LocalIcon icon="person-rounded" width="1rem" height="1rem" />
diff --git a/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
index e7e15c9e89..563cd286f1 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
@@ -3,7 +3,6 @@ import {
   Alert,
   Badge,
   Box,
-  Button,
   Divider,
   Group,
   Paper,
@@ -11,6 +10,7 @@ import {
   Text,
   TextInput,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { useHotkeys } from "@app/contexts/HotkeyContext";
@@ -215,9 +215,8 @@ const HotkeysSection: React.FC = () => {
 
                       <Group gap="xs">
                         <Button
-                          size="xs"
-                          variant={isEditing ? "filled" : "default"}
-                          color={isEditing ? "blue" : undefined}
+                          size="sm"
+                          variant={isEditing ? "primary" : "secondary"}
                           onClick={() => handleStartCapture(toolId)}
                         >
                           {isEditing
@@ -228,8 +227,8 @@ const HotkeysSection: React.FC = () => {
                             : t("settings.hotkeys.change", "Change shortcut")}
                         </Button>
                         <Button
-                          size="xs"
-                          variant="subtle"
+                          size="sm"
+                          variant="tertiary"
                           disabled={bindingEquals(
                             currentBinding,
                             defaultBinding,
diff --git a/frontend/editor/src/core/components/shared/config/configSections/LegalSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/LegalSection.tsx
index 9106930e27..40945f6fc7 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/LegalSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/LegalSection.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Anchor, Button, Group, Paper, Stack, Text } from "@mantine/core";
+import { Anchor, Group, Paper, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
@@ -126,7 +127,7 @@ const LegalSection: React.FC = () => {
               </Text>
             </div>
             <Button
-              variant="default"
+              variant="secondary"
               size="sm"
               id="cookieBanner"
               onClick={showCookiePreferences}
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
index bb157558ec..93999ce438 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
@@ -3,7 +3,6 @@ import {
   Paper,
   Group,
   Text,
-  Button,
   Collapse,
   Stack,
   TextInput,
@@ -13,6 +12,7 @@ import {
   TagsInput,
   Anchor,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import EditableSecretField from "@app/components/shared/EditableSecretField";
@@ -225,8 +225,8 @@ export default function ProviderCard({
 
           <Group gap="xs" wrap="nowrap">
             <Button
-              variant={isConfigured ? "subtle" : "filled"}
-              size="xs"
+              variant={isConfigured ? "tertiary" : "primary"}
+              size="sm"
               onClick={
                 isConfigured
                   ? () => setExpanded(!expanded)
@@ -280,8 +280,8 @@ export default function ProviderCard({
               <Group justify="flex-end" mt="sm">
                 {onDisconnect && (
                   <Button
-                    variant="outline"
-                    color="red"
+                    variant="secondary"
+                    accent="danger"
                     size="sm"
                     onClick={onDisconnect}
                     disabled={disabled}
diff --git a/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.tsx b/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.tsx
index f8b416f275..28a537fd3f 100644
--- a/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.tsx
+++ b/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.tsx
@@ -1,5 +1,7 @@
 import React from "react";
-import { Box, ActionIcon } from "@mantine/core";
+import { Box } from "@mantine/core";
+import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import ChevronRightIcon from "@mui/icons-material/ChevronRight";
 
@@ -16,6 +18,7 @@ const NavigationArrows: React.FC<NavigationArrowsProps> = ({
   disabled = false,
   children,
 }) => {
+  const { t } = useTranslation();
   const navigationArrowStyle = {
     position: "absolute" as const,
     top: "50%",
@@ -27,11 +30,11 @@ const NavigationArrows: React.FC<NavigationArrowsProps> = ({
     <Box style={{ position: "relative", width: "100%", height: "100%" }}>
       {/* Left Navigation Arrow */}
       <ActionIcon
-        variant="light"
+        variant="secondary"
         size="sm"
         onClick={onPrevious}
-        color="blue"
         disabled={disabled}
+        aria-label={t("common.previous", "Previous")}
         style={{
           ...navigationArrowStyle,
           left: "0",
@@ -55,11 +58,11 @@ const NavigationArrows: React.FC<NavigationArrowsProps> = ({
 
       {/* Right Navigation Arrow */}
       <ActionIcon
-        variant="light"
+        variant="secondary"
         size="sm"
         onClick={onNext}
-        color="blue"
         disabled={disabled}
+        aria-label={t("common.next", "Next")}
         style={{
           ...navigationArrowStyle,
           right: "0",
diff --git a/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.tsx b/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.tsx
index a047190783..9677d65618 100644
--- a/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.tsx
+++ b/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.tsx
@@ -1,5 +1,5 @@
 import React from "react";
-import { ActionIcon } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import FitText from "@app/components/shared/FitText";
 
 interface QuickAccessButtonProps {
@@ -48,7 +48,7 @@ const QuickAccessButton: React.FC<QuickAccessButtonProps> = ({
   const actionIconProps =
     component === "a" && href
       ? {
-          component: "a" as const,
+          as: "a" as const,
           href,
           onClick,
           "aria-label": ariaLabel,
@@ -63,7 +63,7 @@ const QuickAccessButton: React.FC<QuickAccessButtonProps> = ({
       <ActionIcon
         {...actionIconProps}
         size={buttonSize}
-        variant="subtle"
+        variant="tertiary"
         disabled={disabled}
         style={{
           backgroundColor: bgColor,
diff --git a/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.tsx b/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.tsx
index c8415b3127..a40313da37 100644
--- a/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.tsx
+++ b/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.tsx
@@ -1,4 +1,5 @@
-import { Badge, Button, Stack, Text } from "@mantine/core";
+import { Badge, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import GroupAddOutlinedIcon from "@mui/icons-material/GroupAddOutlined";
 import { useGroupSigningEnabled } from "@app/hooks/useGroupSigningEnabled";
@@ -35,7 +36,7 @@ export default function SharedSigningLauncher() {
       </Text>
       <Button
         fullWidth
-        variant="light"
+        variant="tertiary"
         leftSection={<GroupAddOutlinedIcon sx={{ fontSize: "1.1rem" }} />}
         rightSection={
           pendingCount > 0 ? (
diff --git a/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.tsx b/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.tsx
index 901ae80732..d6685f6248 100644
--- a/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.tsx
+++ b/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text, Group, Paper } from "@mantine/core";
+import { Stack, Text, Group, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import SignatureSettingsInput, {
@@ -72,7 +73,7 @@ export const ConfigureSignatureDefaultsStep: React.FC<
 
       <Group gap="sm">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
diff --git a/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.tsx b/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.tsx
index 66eeee0689..5e229ab9b3 100644
--- a/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.tsx
+++ b/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text, Group, Divider, TextInput } from "@mantine/core";
+import { Stack, Text, Group, Divider, TextInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import PeopleIcon from "@mui/icons-material/People";
@@ -170,7 +171,7 @@ export const ReviewSessionStep: React.FC<ReviewSessionStepProps> = ({
 
       <Group gap="sm" mt="md">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
@@ -179,18 +180,9 @@ export const ReviewSessionStep: React.FC<ReviewSessionStepProps> = ({
         <Button
           onClick={onSubmit}
           disabled={disabled}
-          h="auto"
           style={{ flex: 1 }}
           leftSection={<SendIcon sx={{ fontSize: 16 }} />}
-          color="green"
-          styles={{
-            root: { paddingTop: 6, paddingBottom: 6 },
-            label: {
-              whiteSpace: "normal",
-              textAlign: "center",
-              lineHeight: 1.2,
-            },
-          }}
+          accent="success"
         >
           {t("groupSigning.steps.review.send", "Send Signing Requests")}
         </Button>
diff --git a/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.tsx b/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.tsx
index aaedc076d3..14bd56f75c 100644
--- a/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.tsx
+++ b/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text } from "@mantine/core";
+import { Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import type { FileState } from "@app/types/file";
diff --git a/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.tsx b/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.tsx
index 3baa15b7ba..99c0801519 100644
--- a/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.tsx
+++ b/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text, Group } from "@mantine/core";
+import { Stack, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import UserSelector from "@app/components/shared/UserSelector";
@@ -53,7 +54,7 @@ export const SelectParticipantsStep: React.FC<SelectParticipantsStepProps> = ({
 
       <Group gap="sm">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
diff --git a/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.tsx b/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.tsx
index d316dd521a..ef1cb54aa4 100644
--- a/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.tsx
+++ b/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.tsx
@@ -1,5 +1,6 @@
 import { useRef, useEffect, useState } from "react";
-import { Stack, Button, Group, ColorPicker, Slider, Text } from "@mantine/core";
+import { Stack, Group, ColorPicker, Slider, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import DeleteIcon from "@mui/icons-material/Delete";
 
@@ -153,8 +154,8 @@ export const DrawSignatureCanvas: React.FC<DrawSignatureCanvasProps> = ({
       </Group>
 
       <Button
-        variant="light"
-        color="red"
+        variant="secondary"
+        accent="danger"
         leftSection={<DeleteIcon sx={{ fontSize: 16 }} />}
         onClick={clearCanvas}
         disabled={disabled || !signature}
diff --git a/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.tsx b/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.tsx
index a0875aa7ae..7b4950f4aa 100644
--- a/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.tsx
+++ b/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.tsx
@@ -1,4 +1,4 @@
-import { SegmentedControl } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 
 export type SignatureType = "draw" | "upload" | "type";
@@ -20,11 +20,11 @@ export const SignatureTypeSelector: React.FC<SignatureTypeSelectorProps> = ({
     <SegmentedControl
       value={value}
       onChange={(val) => onChange(val as SignatureType)}
-      disabled={disabled}
-      data={[
+      options={[
         {
           value: "draw",
           label: t("certSign.collab.signRequest.signatureType.draw", "Draw"),
+          disabled,
         },
         {
           value: "upload",
@@ -32,10 +32,12 @@ export const SignatureTypeSelector: React.FC<SignatureTypeSelectorProps> = ({
             "certSign.collab.signRequest.signatureType.upload",
             "Upload",
           ),
+          disabled,
         },
         {
           value: "type",
           label: t("certSign.collab.signRequest.signatureType.type", "Type"),
+          disabled,
         },
       ]}
       fullWidth
diff --git a/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.tsx b/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.tsx
index 49d4c22ca4..2318b14cd1 100644
--- a/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.tsx
+++ b/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.tsx
@@ -1,5 +1,6 @@
 import { useState, useRef } from "react";
-import { Stack, Button, Text, Image } from "@mantine/core";
+import { Stack, Text, Image } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -100,8 +101,8 @@ export const UploadSignatureImage: React.FC<UploadSignatureImageProps> = ({
           </div>
 
           <Button
-            variant="light"
-            color="red"
+            variant="secondary"
+            accent="danger"
             leftSection={<DeleteIcon sx={{ fontSize: 16 }} />}
             onClick={handleClear}
             disabled={disabled}
@@ -112,7 +113,7 @@ export const UploadSignatureImage: React.FC<UploadSignatureImageProps> = ({
         </Stack>
       ) : (
         <Button
-          variant="outline"
+          variant="secondary"
           leftSection={<UploadFileIcon sx={{ fontSize: 16 }} />}
           onClick={handleUploadClick}
           disabled={disabled}
diff --git a/frontend/editor/src/core/components/toast/ToastRenderer.tsx b/frontend/editor/src/core/components/toast/ToastRenderer.tsx
index c13010e279..df2a871a5a 100644
--- a/frontend/editor/src/core/components/toast/ToastRenderer.tsx
+++ b/frontend/editor/src/core/components/toast/ToastRenderer.tsx
@@ -3,6 +3,8 @@ import { useTranslation } from "react-i18next";
 import { useToast } from "@app/components/toast/ToastContext";
 import { ToastInstance, ToastLocation } from "@app/components/toast/types";
 import { LocalIcon } from "@app/components/shared/LocalIcon";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
 import "@app/components/toast/ToastRenderer.css";
 
 const locationToClass: Record<ToastLocation, string> = {
@@ -99,7 +101,8 @@ export default function ToastRenderer() {
                   {/* Controls */}
                   <div className="toast-controls">
                     {t.expandable && (
-                      <button
+                      <ActionIcon
+                        variant="tertiary"
                         aria-label={translate(
                           "toast.toggleDetails",
                           "Toggle details",
@@ -113,15 +116,16 @@ export default function ToastRenderer() {
                         className={`toast-button toast-expand-button ${t.isExpanded ? "toast-expand-button--expanded" : ""}`}
                       >
                         <LocalIcon icon="expand-more-rounded" />
-                      </button>
+                      </ActionIcon>
                     )}
-                    <button
+                    <ActionIcon
+                      variant="tertiary"
                       aria-label={translate("toast.dismiss", "Dismiss")}
                       onClick={() => dismiss(t.id)}
                       className="toast-button"
                     >
-                      <LocalIcon icon="close" width={20} height={20} />
-                    </button>
+                      &times;
+                    </ActionIcon>
                   </div>
                 </div>
                 {/* Progress bar - always show when present */}
@@ -142,12 +146,12 @@ export default function ToastRenderer() {
                 {/* Button - always show when present, positioned below body */}
                 {t.buttonText && t.buttonCallback && (
                   <div className="toast-action-container">
-                    <button
+                    <Button
                       onClick={t.buttonCallback}
                       className={getActionButtonClass(t)}
                     >
                       {t.buttonText}
-                    </button>
+                    </Button>
                   </div>
                 )}
               </div>
diff --git a/frontend/editor/src/core/components/tools/RightSidebar.tsx b/frontend/editor/src/core/components/tools/RightSidebar.tsx
index 7e3aa04629..4333e263f1 100644
--- a/frontend/editor/src/core/components/tools/RightSidebar.tsx
+++ b/frontend/editor/src/core/components/tools/RightSidebar.tsx
@@ -1,5 +1,4 @@
 import { useMemo, useState } from "react";
-import { ActionIcon } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { useSidebarContext } from "@app/contexts/SidebarContext";
@@ -21,6 +20,7 @@ import type { SubcategoryGroup } from "@app/hooks/useToolSections";
 import { ToolIcon } from "@app/components/shared/ToolIcon";
 import { ToolPanelHeader } from "@app/components/shared/ToolPanelHeader";
 import { Tooltip as AppTooltip } from "@app/components/shared/Tooltip";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { withViewTransition } from "@app/utils/viewTransition";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import ChevronRightIcon from "@mui/icons-material/ChevronRight";
@@ -224,13 +224,13 @@ export default function RightSidebar() {
         <div className="tool-panel__collapsed-strip">
           <div className="tool-panel__collapsed-top">
             <ActionIcon
-              variant="outline"
-              color="gray.4"
-              radius="xl"
+              aria-label={t("toolPanel.expand", "Expand panel")}
+              variant="secondary"
+              accent="neutral"
               size="md"
+              shape="circle"
               className="tool-panel__expand-btn tool-panel__toggle-vt"
               onClick={handleExpand}
-              aria-label={t("toolPanel.expand", "Expand panel")}
             >
               <ChevronLeftIcon sx={{ fontSize: "1.1rem" }} />
             </ActionIcon>
@@ -248,18 +248,18 @@ export default function RightSidebar() {
                 arrow
                 delay={300}
               >
-                <button
-                  type="button"
+                <ActionIcon
+                  aria-label={tool.name}
+                  variant="tertiary"
                   className="tool-panel__collapsed-tool-btn"
                   data-selected={selectedToolKey === id}
                   onClick={() => {
                     handleExpand();
                     handleToolSelectWithTransition(id);
                   }}
-                  aria-label={tool.name}
                 >
                   <ToolIcon icon={tool.icon} marginRight="0" />
-                </button>
+                </ActionIcon>
               </AppTooltip>
             ))}
           </div>
@@ -322,10 +322,9 @@ export default function RightSidebar() {
                     ) : null}
                     {showCloseButton ? (
                       <ActionIcon
-                        variant="subtle"
-                        color="gray"
-                        radius="xl"
+                        variant="tertiary"
                         size="md"
+                        shape="circle"
                         onClick={handleHeaderBack}
                         aria-label={
                           inToolView
@@ -338,9 +337,9 @@ export default function RightSidebar() {
                       </ActionIcon>
                     ) : (
                       <ActionIcon
-                        variant="outline"
-                        radius="xl"
+                        variant="secondary"
                         size="md"
+                        shape="circle"
                         onClick={handleCollapse}
                         aria-label={t("toolPanel.collapse", "Collapse panel")}
                         className="tool-panel__expand-btn tool-panel__toggle-vt"
@@ -355,11 +354,11 @@ export default function RightSidebar() {
                 <PoliciesSection
                   leadingControl={
                     <ActionIcon
-                      variant="outline"
-                      radius="xl"
-                      size="md"
-                      onClick={handleCollapse}
                       aria-label={t("toolPanel.collapse", "Collapse panel")}
+                      variant="secondary"
+                      size="md"
+                      shape="circle"
+                      onClick={handleCollapse}
                       className="tool-panel__expand-btn tool-panel__toggle-vt"
                     >
                       <ChevronRightIcon sx={{ fontSize: "1.1rem" }} />
diff --git a/frontend/editor/src/core/components/tools/ToolPanel.css b/frontend/editor/src/core/components/tools/ToolPanel.css
index e5949e365a..a8ad41588f 100644
--- a/frontend/editor/src/core/components/tools/ToolPanel.css
+++ b/frontend/editor/src/core/components/tools/ToolPanel.css
@@ -130,6 +130,7 @@
     width 0.3s ease,
     max-width 0.3s ease;
   view-transition-name: tool-rail;
+  user-select: none;
 }
 
 .tool-panel__collapsed-strip {
diff --git a/frontend/editor/src/core/components/tools/ToolPanelModePrompt.tsx b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.tsx
index 3e3f072b69..f7f69ad2e7 100644
--- a/frontend/editor/src/core/components/tools/ToolPanelModePrompt.tsx
+++ b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useState } from "react";
-import { Badge, Button, Card, Group, Modal, Stack, Text } from "@mantine/core";
+import { Badge, Card, Group, Modal, Stack, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { usePreferences } from "@app/contexts/PreferencesContext";
 import "@app/components/tools/ToolPanelModePrompt.css";
@@ -122,9 +123,6 @@ const ToolPanelModePrompt = ({
                 </div>
               </div>
               <Button
-                variant={toolPanelMode === "sidebar" ? "filled" : "light"}
-                color="blue"
-                radius="md"
                 className="tool-panel-mode-prompt__action"
                 onClick={() => handleSelect("sidebar")}
               >
@@ -174,9 +172,6 @@ const ToolPanelModePrompt = ({
                 </div>
               </div>
               <Button
-                variant={toolPanelMode === "fullscreen" ? "filled" : "outline"}
-                color="blue"
-                radius="md"
                 className="tool-panel-mode-prompt__action"
                 onClick={() => handleSelect("fullscreen")}
               >
@@ -189,9 +184,7 @@ const ToolPanelModePrompt = ({
           </Card>
         </div>
         <Button
-          variant="subtle"
-          color="gray"
-          radius="md"
+          variant="tertiary"
           className="tool-panel-mode-prompt__maybe-later"
           onClick={handleDismiss}
         >
diff --git a/frontend/editor/src/core/components/tools/ToolPanelViewerBar.tsx b/frontend/editor/src/core/components/tools/ToolPanelViewerBar.tsx
index 5e01b4f711..f67499aed5 100644
--- a/frontend/editor/src/core/components/tools/ToolPanelViewerBar.tsx
+++ b/frontend/editor/src/core/components/tools/ToolPanelViewerBar.tsx
@@ -1,5 +1,5 @@
 import React, { useCallback } from "react";
-import { ActionIcon } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useWorkbenchBar } from "@app/contexts/WorkbenchBarContext";
 import { useNavigationState } from "@app/contexts/NavigationContext";
 import { Tooltip } from "@app/components/shared/Tooltip";
@@ -49,13 +49,11 @@ export function ToolPanelViewerBar() {
         (typeof btn.tooltip === "string" ? btn.tooltip : undefined);
       const buttonNode = (
         <ActionIcon
-          variant={isActive ? "filled" : "subtle"}
-          color={isActive ? "blue" : undefined}
-          radius="md"
+          variant={isActive ? "primary" : "tertiary"}
           className="workbench-bar-action-icon"
           onClick={triggerAction}
           disabled={disabled}
-          aria-label={ariaLabel}
+          aria-label={ariaLabel ?? ""}
           aria-pressed={isActive || undefined}
         >
           {btn.icon}
diff --git a/frontend/editor/src/core/components/tools/ToolPicker.tsx b/frontend/editor/src/core/components/tools/ToolPicker.tsx
index af50c8ceab..27b0caf7d5 100644
--- a/frontend/editor/src/core/components/tools/ToolPicker.tsx
+++ b/frontend/editor/src/core/components/tools/ToolPicker.tsx
@@ -1,6 +1,7 @@
 import React, { useMemo, useRef } from "react";
-import { Box, Button, Stack } from "@mantine/core";
+import { Box, Stack } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import { ToolRegistryEntry } from "@app/data/toolsTaxonomy";
 import "@app/components/tools/toolPicker/ToolPicker.css";
 import { useToolSections } from "@app/hooks/useToolSections";
@@ -33,7 +34,7 @@ const EMPTY_FILTERED_TOOLS: ToolPickerProps["filteredTools"] = [];
 const HEADER_TEXT_STYLE: React.CSSProperties = {
   fontSize: "0.68rem",
   fontWeight: 600,
-  padding: "1rem 0 0.35rem 0.5rem",
+  padding: "0.25rem 0 0.35rem 0.5rem",
   textTransform: "uppercase",
   letterSpacing: "0.06em",
   color: "var(--text-muted)",
@@ -182,7 +183,7 @@ const ToolPicker = ({
             )}
             {onShowAllTools && (
               <Button
-                variant="subtle"
+                variant="tertiary"
                 size="sm"
                 fullWidth
                 onClick={onShowAllTools}
diff --git a/frontend/editor/src/core/components/tools/addAttachments/AddAttachmentsSettings.tsx b/frontend/editor/src/core/components/tools/addAttachments/AddAttachmentsSettings.tsx
index 4eaca5caa6..73b42bd446 100644
--- a/frontend/editor/src/core/components/tools/addAttachments/AddAttachmentsSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addAttachments/AddAttachmentsSettings.tsx
@@ -3,21 +3,12 @@
  *
  * Allows selecting files to attach to PDFs with optional PDF/A-3b conversion support.
  */
-
-import {
-  Stack,
-  Text,
-  Group,
-  ActionIcon,
-  ScrollArea,
-  Button,
-  Checkbox,
-} from "@mantine/core";
+import { Stack, Text, Group, ScrollArea, Checkbox } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { AddAttachmentsParameters } from "@app/hooks/tools/addAttachments/useAddAttachmentsParameters";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { Tooltip } from "@app/components/shared/Tooltip";
-
+import { Button as DSButton } from "@app/ui/Button";
 interface AddAttachmentsSettingsProps {
   parameters: AddAttachmentsParameters;
   onParameterChange: <K extends keyof AddAttachmentsParameters>(
@@ -55,10 +46,9 @@ const AddAttachmentsSettings = ({
           style={{ display: "none" }}
           id="attachments-input"
         />
-        <Button
-          size="xs"
-          color="blue"
-          component="label"
+        <DSButton
+          size="sm"
+          as="label"
           htmlFor="attachments-input"
           disabled={disabled}
           leftSection={<LocalIcon icon="add" width="14" height="14" />}
@@ -66,7 +56,7 @@ const AddAttachmentsSettings = ({
           {parameters.attachments?.length > 0
             ? t("AddAttachmentsRequest.addMoreFiles", "Add more files...")
             : t("AddAttachmentsRequest.placeholder", "Choose files...")}
-        </Button>
+        </DSButton>
       </Stack>
 
       {parameters.attachments?.length > 0 && (
@@ -120,10 +110,17 @@ const AddAttachmentsSettings = ({
                       ({(file.size / 1024).toFixed(1)} KB)
                     </Text>
                   </Group>
-                  <ActionIcon
+                  <DSButton
+                    leftSection={
+                      <LocalIcon icon="close-rounded" width="14" height="14" />
+                    }
+                    aria-label={t(
+                      "AddAttachmentsRequest.removeFile",
+                      "Remove file",
+                    )}
                     size="sm"
-                    variant="subtle"
-                    color="red"
+                    variant="tertiary"
+                    accent="danger"
                     style={{ flexShrink: 0 }}
                     onClick={() => {
                       const newAttachments = (
@@ -132,9 +129,7 @@ const AddAttachmentsSettings = ({
                       onParameterChange("attachments", newAttachments);
                     }}
                     disabled={disabled}
-                  >
-                    <LocalIcon icon="close-rounded" width="14" height="14" />
-                  </ActionIcon>
+                  />
                 </Group>
               ))}
             </Stack>
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
index 37247c863f..fe92d1ff42 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
@@ -5,6 +5,7 @@ import { pdfWorkerManager } from "@app/services/pdfWorkerManager";
 import { useThumbnailGeneration } from "@app/hooks/useThumbnailGeneration";
 import styles from "@app/components/tools/addPageNumbers/PageNumberPreview.module.css";
 import { PrivateContent } from "@app/components/shared/PrivateContent";
+import { Button } from "@app/ui/Button";
 
 // Simple utilities for page numbers (adapted from stamp)
 const A4_ASPECT_RATIO = 0.707;
@@ -256,9 +257,9 @@ export default function PageNumberPreview({
               const idx = (i + 1) as 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
               const selected = parameters.position === idx;
               return (
-                <button
+                <Button
+                  variant="tertiary"
                   key={idx}
-                  type="button"
                   className={`${styles.gridTile} ${selected || hoverTile === idx ? styles.gridTileSelected : ""} ${hoverTile === idx ? styles.gridTileHovered : ""}`}
                   onClick={() =>
                     onParameterChange(
@@ -277,7 +278,7 @@ export default function PageNumberPreview({
                   }}
                 >
                   {idx}
-                </button>
+                </Button>
               );
             })}
           </div>
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampPositionFormattingSettings.tsx b/frontend/editor/src/core/components/tools/addStamp/StampPositionFormattingSettings.tsx
index 7912cd0bcd..76f8be4109 100644
--- a/frontend/editor/src/core/components/tools/addStamp/StampPositionFormattingSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addStamp/StampPositionFormattingSettings.tsx
@@ -4,7 +4,6 @@ import {
   Select,
   Stack,
   ColorInput,
-  Button,
   Slider,
   Text,
   NumberInput,
@@ -13,6 +12,8 @@ import { AddStampParameters } from "@app/components/tools/addStamp/useAddStampPa
 import LocalIcon from "@app/components/shared/LocalIcon";
 import styles from "@app/components/tools/addStamp/StampPreview.module.css";
 import { Tooltip } from "@app/components/shared/Tooltip";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
 
 interface StampPositionFormattingSettingsProps {
@@ -55,7 +56,7 @@ const StampPositionFormattingSettings = ({
               return (
                 <Button
                   key={idx}
-                  variant={selected ? "filled" : "outline"}
+                  variant={selected ? "primary" : "secondary"}
                   onClick={() => {
                     onParameterChange("position", idx);
                     // Ensure we're using grid positioning, not custom overrides
@@ -63,11 +64,9 @@ const StampPositionFormattingSettings = ({
                     onParameterChange("overrideY", -1 as any);
                   }}
                   disabled={disabled}
-                  styles={{
-                    root: {
-                      height: "50px",
-                      padding: "0",
-                    },
+                  style={{
+                    height: "50px",
+                    padding: 0,
                   }}
                 >
                   {idx}
@@ -83,9 +82,10 @@ const StampPositionFormattingSettings = ({
           content={t("AddStampRequest.rotation", "Rotation")}
           position="top"
         >
-          <Button
+          <ActionIcon
+            aria-label={t("AddStampRequest.rotation", "Rotation")}
             variant={
-              parameters._activePill === "rotation" ? "filled" : "outline"
+              parameters._activePill === "rotation" ? "primary" : "secondary"
             }
             className="flex-1"
             onClick={() => onParameterChange("_activePill", "rotation")}
@@ -95,21 +95,22 @@ const StampPositionFormattingSettings = ({
               width="1.1rem"
               height="1.1rem"
             />
-          </Button>
+          </ActionIcon>
         </Tooltip>
         <Tooltip
           content={t("AddStampRequest.opacity", "Opacity")}
           position="top"
         >
-          <Button
+          <ActionIcon
+            aria-label={t("AddStampRequest.opacity", "Opacity")}
             variant={
-              parameters._activePill === "opacity" ? "filled" : "outline"
+              parameters._activePill === "opacity" ? "primary" : "secondary"
             }
             className="flex-1"
             onClick={() => onParameterChange("_activePill", "opacity")}
           >
             <LocalIcon icon="opacity" width="1.1rem" height="1.1rem" />
-          </Button>
+          </ActionIcon>
         </Tooltip>
         <Tooltip
           content={
@@ -119,9 +120,14 @@ const StampPositionFormattingSettings = ({
           }
           position="top"
         >
-          <Button
+          <ActionIcon
+            aria-label={
+              parameters.stampType === "image"
+                ? t("AddStampRequest.imageSize", "Image Size")
+                : t("AddStampRequest.fontSize", "Font Size")
+            }
             variant={
-              parameters._activePill === "fontSize" ? "filled" : "outline"
+              parameters._activePill === "fontSize" ? "primary" : "secondary"
             }
             className="flex-1"
             onClick={() => onParameterChange("_activePill", "fontSize")}
@@ -131,7 +137,7 @@ const StampPositionFormattingSettings = ({
               width="1.1rem"
               height="1.1rem"
             />
-          </Button>
+          </ActionIcon>
         </Tooltip>
       </div>
 
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampPreview.tsx b/frontend/editor/src/core/components/tools/addStamp/StampPreview.tsx
index 9659c4317a..88f2d72f6c 100644
--- a/frontend/editor/src/core/components/tools/addStamp/StampPreview.tsx
+++ b/frontend/editor/src/core/components/tools/addStamp/StampPreview.tsx
@@ -11,6 +11,7 @@ import {
 } from "@app/components/tools/addStamp/StampPreviewUtils";
 import styles from "@app/components/tools/addStamp/StampPreview.module.css";
 import { PrivateContent } from "@app/components/shared/PrivateContent";
+import { Button } from "@app/ui/Button";
 
 type Props = {
   parameters: AddStampParameters;
@@ -429,9 +430,9 @@ export default function StampPreview({
                 parameters.position === idx &&
                 (parameters.overrideX < 0 || parameters.overrideY < 0);
               return (
-                <button
+                <Button
+                  variant="tertiary"
                   key={idx}
-                  type="button"
                   className={`${styles.gridTile} ${selected || hoverTile === idx ? styles.gridTileSelected : ""} ${hoverTile === idx ? styles.gridTileHovered : ""}`}
                   onClick={() => {
                     // Clear overrides to use grid positioning and set position
@@ -443,7 +444,7 @@ export default function StampPreview({
                   onMouseLeave={() => setHoverTile(null)}
                 >
                   {idx}
-                </button>
+                </Button>
               );
             })}
           </div>
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.tsx b/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.tsx
index 1625affa59..4c7ee96c5b 100644
--- a/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.tsx
@@ -5,7 +5,6 @@ import {
   Textarea,
   TextInput,
   Select,
-  Button,
   Text,
   Divider,
   Accordion,
@@ -15,6 +14,7 @@ import {
   Box,
   Paper,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { AddStampParameters } from "@app/components/tools/addStamp/useAddStampParameters";
 import ButtonSelector from "@app/components/shared/ButtonSelector";
 import styles from "@app/components/tools/addStamp/StampPreview.module.css";
@@ -236,7 +236,6 @@ const StampSetupSettings = ({
             { value: "image", label: t("watermark.type.2", "Image") },
           ]}
           disabled={disabled}
-          buttonClassName={styles.modeToggleButton}
           textClassName={styles.modeToggleButtonText}
         />
       </div>
@@ -673,8 +672,8 @@ const StampSetupSettings = ({
             id="stamp-image-input"
           />
           <Button
-            size="xs"
-            component="label"
+            size="sm"
+            as="label"
             htmlFor="stamp-image-input"
             disabled={disabled}
           >
diff --git a/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.tsx b/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.tsx
index 4012909f2a..aeb874b58e 100644
--- a/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.tsx
+++ b/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.tsx
@@ -1,4 +1,8 @@
-import { Stack, NumberInput, Select, SegmentedControl } from "@mantine/core";
+import { Stack, NumberInput, Select } from "@mantine/core";
+import {
+  SegmentedControl,
+  type SegmentedOption,
+} from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import {
   AdjustPageScaleParameters,
@@ -47,14 +51,17 @@ const AdjustPageScaleSettings = ({
     },
   ];
 
-  const orientationOptions = [
+  const orientationDisabled = disabled || isKeepSelected;
+  const orientationOptions: SegmentedOption<Orientation>[] = [
     {
       value: "PORTRAIT",
       label: t("adjustPageScale.orientation.portrait", "Portrait"),
+      disabled: orientationDisabled,
     },
     {
       value: "LANDSCAPE",
       label: t("adjustPageScale.orientation.landscape", "Landscape"),
+      disabled: orientationDisabled,
     },
   ];
 
@@ -99,8 +106,7 @@ const AdjustPageScaleSettings = ({
         onChange={(value) =>
           onParameterChange("orientation", value as Orientation)
         }
-        data={orientationOptions}
-        disabled={disabled || isKeepSelected}
+        options={orientationOptions}
         fullWidth
       />
     </Stack>
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationCreation.tsx b/frontend/editor/src/core/components/tools/automate/AutomationCreation.tsx
index 69116e3a43..65c50a3481 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationCreation.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationCreation.tsx
@@ -1,7 +1,6 @@
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  Button,
   Text,
   Stack,
   Group,
@@ -10,6 +9,7 @@ import {
   Divider,
   Modal,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { Z_INDEX_AUTOMATE_MODAL } from "@app/styles/zIndex";
 import CheckIcon from "@mui/icons-material/Check";
 import DownloadIcon from "@mui/icons-material/Download";
@@ -302,16 +302,17 @@ export default function AutomationCreation({
 
               <Group gap="sm" grow>
                 <Button
+                  variant="secondary"
                   leftSection={<DownloadIcon />}
                   onClick={() => {
                     downloadAutomationConfig(buildExportableAutomation());
                   }}
                   disabled={!canSaveAutomation()}
-                  variant="light"
                 >
                   {t("automate.creation.export", "Export")}
                 </Button>
                 <Button
+                  variant="secondary"
                   leftSection={<DownloadIcon />}
                   onClick={() => {
                     downloadFolderScanningConfig(
@@ -320,7 +321,6 @@ export default function AutomationCreation({
                     );
                   }}
                   disabled={!canSaveAutomation()}
-                  variant="light"
                 >
                   {t(
                     "automate.creation.exportForFolderScanning",
@@ -360,10 +360,10 @@ export default function AutomationCreation({
             )}
           </Text>
           <Group gap="md" justify="flex-end">
-            <Button variant="outline" onClick={handleCancelBack}>
+            <Button variant="secondary" onClick={handleCancelBack}>
               {t("automate.creation.unsavedChanges.cancel", "Cancel")}
             </Button>
-            <Button color="red" onClick={handleConfirmBack}>
+            <Button accent="danger" onClick={handleConfirmBack}>
               {t("automate.creation.unsavedChanges.confirm", "Go Back")}
             </Button>
           </Group>
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx b/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
index de8c82d449..322d2d87fc 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
@@ -1,6 +1,7 @@
 import React, { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Group, Text, ActionIcon, Menu, Button, Box } from "@mantine/core";
+import { Group, Text, Menu, Box } from "@mantine/core";
+import { Button as SharedButton } from "@app/ui/Button";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 import EditIcon from "@mui/icons-material/Edit";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -181,31 +182,24 @@ export default function AutomationEntry({
       onMouseEnter={() => setIsHovered(true)}
       onMouseLeave={() => setIsHovered(false)}
     >
-      <Button
-        variant="subtle"
+      <SharedButton
+        variant="tertiary"
         onClick={onClick}
         size="sm"
-        radius="md"
         fullWidth
-        justify="flex-start"
+        justify="start"
         className="tool-button"
-        styles={{
-          root: {
-            borderRadius: 0,
-            color: "var(--tools-text-and-icon-color)",
-            overflow: "visible",
-            backgroundColor: shouldShowMenu
-              ? "var(--automation-entry-hover-bg)"
-              : undefined,
-            "&:hover": {
-              backgroundColor: "var(--automation-entry-hover-bg)",
-            },
-          },
-          label: { overflow: "visible" },
+        style={{
+          borderRadius: 0,
+          color: "var(--tools-text-and-icon-color)",
+          overflow: "visible",
+          backgroundColor: shouldShowMenu
+            ? "var(--automation-entry-hover-bg)"
+            : undefined,
         }}
       >
         {buttonContent}
-      </Button>
+      </SharedButton>
       {showMenu && (
         <Menu
           position="bottom-end"
@@ -214,9 +208,10 @@ export default function AutomationEntry({
           onClose={() => setIsMenuOpen(false)}
         >
           <Menu.Target>
-            <ActionIcon
-              variant="subtle"
-              c="dimmed"
+            <SharedButton
+              leftSection={<MoreVertIcon style={{ fontSize: 20 }} />}
+              variant="tertiary"
+              accent="neutral"
               size="md"
               aria-label={t(
                 "automate.entryMenu.label",
@@ -234,9 +229,7 @@ export default function AutomationEntry({
                 transition: "opacity 0.2s ease",
                 pointerEvents: shouldShowMenu ? "auto" : "none",
               }}
-            >
-              <MoreVertIcon style={{ fontSize: 20 }} />
-            </ActionIcon>
+            />
           </Menu.Target>
 
           <Menu.Dropdown>
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationImportModal.tsx b/frontend/editor/src/core/components/tools/automate/AutomationImportModal.tsx
index 95e85e8026..c8c20cf607 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationImportModal.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationImportModal.tsx
@@ -3,13 +3,13 @@ import { useTranslation } from "react-i18next";
 import {
   Alert,
   Badge,
-  Button,
   Group,
   Modal,
   Stack,
   Text,
   Textarea,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { Dropzone } from "@mantine/dropzone";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
 import { Z_INDEX_AUTOMATE_MODAL } from "@app/styles/zIndex";
@@ -218,7 +218,7 @@ export default function AutomationImportModal({
         )}
 
         <Group gap="sm" justify="flex-end">
-          <Button variant="subtle" onClick={onCancel} disabled={submitting}>
+          <Button variant="tertiary" onClick={onCancel} disabled={submitting}>
             {t("automate.importModal.cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx b/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
index 3e3a4c0756..e59996ab8f 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
@@ -1,14 +1,7 @@
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Button,
-  Text,
-  Stack,
-  Group,
-  Card,
-  Progress,
-  Loader,
-} from "@mantine/core";
+import { Text, Stack, Group, Card, Progress, Loader } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import PlayArrowIcon from "@mui/icons-material/PlayArrow";
 import CheckIcon from "@mui/icons-material/Check";
 import { useViewScopedFiles } from "@app/hooks/tools/shared/useViewScopedFiles";
@@ -248,7 +241,7 @@ export default function AutomationRun({
           </Button>
 
           {hasResults && (
-            <Button variant="light" onClick={onComplete}>
+            <Button variant="secondary" onClick={onComplete}>
               {t("automate.sequence.finish", "Finish")}
             </Button>
           )}
diff --git a/frontend/editor/src/core/components/tools/automate/IconSelector.tsx b/frontend/editor/src/core/components/tools/automate/IconSelector.tsx
index cd67d1487f..1b0909cbc0 100644
--- a/frontend/editor/src/core/components/tools/automate/IconSelector.tsx
+++ b/frontend/editor/src/core/components/tools/automate/IconSelector.tsx
@@ -1,14 +1,7 @@
 import React, { useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Box,
-  Text,
-  Stack,
-  Button,
-  SimpleGrid,
-  Tooltip,
-  Popover,
-} from "@mantine/core";
+import { Box, Text, Stack, SimpleGrid, Tooltip, Popover } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
 import { iconMap, iconOptions } from "@app/components/tools/automate/iconMap";
 import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
@@ -58,12 +51,13 @@ export default function IconSelector({
         zIndex={Z_INDEX_AUTOMATE_DROPDOWN}
       >
         <Popover.Target>
-          <Button
-            variant="outline"
+          <ActionIcon
+            variant="secondary"
             size={size}
+            aria-label={t("automate.creation.icon.label", "Icon")}
             onClick={() => setIsDropdownOpen(!isDropdownOpen)}
             style={{
-              width: size === "sm" ? "3.75rem" : "4.375rem",
+              width: size === "sm" ? "2.5rem" : "3rem",
               position: "relative",
               display: "flex",
               justifyContent: "flex-start",
@@ -84,7 +78,7 @@ export default function IconSelector({
                 transform: "translateY(-50%)",
               }}
             />
-          </Button>
+          </ActionIcon>
         </Popover.Target>
 
         <Popover.Dropdown>
diff --git a/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.tsx b/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.tsx
index b70f6b925e..93631e087c 100644
--- a/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.tsx
+++ b/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.tsx
@@ -1,15 +1,7 @@
 import { Suspense, useState, useEffect } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Modal,
-  Title,
-  Button,
-  Group,
-  Stack,
-  Text,
-  Alert,
-  Loader,
-} from "@mantine/core";
+import { Modal, Title, Group, Stack, Text, Alert, Loader } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { Z_INDEX_AUTOMATE_MODAL } from "@app/styles/zIndex";
 import SettingsIcon from "@mui/icons-material/Settings";
 import CheckIcon from "@mui/icons-material/Check";
@@ -125,7 +117,7 @@ export default function ToolConfigurationModal({
 
         <Group justify="flex-end" gap="sm">
           <Button
-            variant="light"
+            variant="secondary"
             leftSection={<CloseIcon />}
             onClick={onCancel}
           >
diff --git a/frontend/editor/src/core/components/tools/automate/ToolList.tsx b/frontend/editor/src/core/components/tools/automate/ToolList.tsx
index e57e96daa3..ad67ed4aa9 100644
--- a/frontend/editor/src/core/components/tools/automate/ToolList.tsx
+++ b/frontend/editor/src/core/components/tools/automate/ToolList.tsx
@@ -1,6 +1,7 @@
 import React from "react";
 import { useTranslation } from "react-i18next";
-import { Text, Stack, Group, ActionIcon } from "@mantine/core";
+import { Text, Stack, Group } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import SettingsIcon from "@mui/icons-material/Settings";
 import CloseIcon from "@mui/icons-material/Close";
 import AddCircleOutline from "@mui/icons-material/AddCircleOutlined";
@@ -75,17 +76,23 @@ export default function ToolList({
                   tool.operation && !tool.configured ? "0" : "1px",
               }}
             >
-              {/* Delete X in top right - only show for tools after the first 2 */}
+              {/* Delete X - centered vertically, anchored right */}
               {index > 1 && (
                 <ActionIcon
-                  variant="subtle"
-                  size="xs"
+                  variant="tertiary"
+                  size="sm"
+                  hover={false}
                   onClick={() => onToolRemove(index)}
+                  aria-label={t(
+                    "automate.creation.tools.remove",
+                    "Remove tool",
+                  )}
                   title={t("automate.creation.tools.remove", "Remove tool")}
                   style={{
                     position: "absolute",
-                    top: "4px",
-                    right: "4px",
+                    top: "50%",
+                    right: "8px",
+                    transform: "translateY(-50%)",
                     zIndex: 1,
                     color: "var(--mantine-color-gray-6)",
                   }}
@@ -94,7 +101,7 @@ export default function ToolList({
                 </ActionIcon>
               )}
 
-              <div style={{ paddingRight: "1.25rem" }}>
+              <div>
                 {/* Tool Selection Dropdown with inline settings cog */}
                 <Group gap="xs" align="center" wrap="nowrap">
                   <div style={{ flex: 1, minWidth: 0 }}>
@@ -113,9 +120,13 @@ export default function ToolList({
                   {/* Settings cog - only show if tool is selected, aligned right */}
                   {tool.operation && (
                     <ActionIcon
-                      variant="subtle"
+                      variant="tertiary"
                       size="sm"
                       onClick={() => onToolConfigure(index)}
+                      aria-label={t(
+                        "automate.creation.tools.configure",
+                        "Configure tool",
+                      )}
                       title={t(
                         "automate.creation.tools.configure",
                         "Configure tool",
diff --git a/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.tsx b/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.tsx
index 5c2c5059d3..fab1f3ff5e 100644
--- a/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.tsx
+++ b/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.tsx
@@ -5,10 +5,10 @@ import {
   Text,
   Divider,
   Collapse,
-  Button,
   NumberInput,
   Checkbox,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { BookletImpositionParameters } from "@app/hooks/tools/bookletImposition/useBookletImpositionParameters";
 import ButtonSelector from "@app/components/shared/ButtonSelector";
 
@@ -117,7 +117,7 @@ const BookletImpositionSettings = ({
       {/* Advanced Options */}
       <Stack gap="sm">
         <Button
-          variant="subtle"
+          variant="tertiary"
           onClick={() => setAdvancedOpen(!advancedOpen)}
           disabled={disabled}
         >
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.tsx
index 135d564537..5be808b492 100644
--- a/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.tsx
@@ -1,4 +1,5 @@
-import { Stack, Button } from "@mantine/core";
+import { Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { CertSignParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
 
 interface CertificateFormatSettingsProps {
@@ -18,10 +19,7 @@ const CertificateFormatSettings = ({
         {/* First row - PKCS#12 and PFX */}
         <div style={{ display: "flex", gap: "4px" }}>
           <Button
-            variant={parameters.certType === "PKCS12" ? "filled" : "outline"}
-            color={
-              parameters.certType === "PKCS12" ? "blue" : "var(--text-muted)"
-            }
+            variant={parameters.certType === "PKCS12" ? "primary" : "secondary"}
             onClick={() => onParameterChange("certType", "PKCS12")}
             disabled={disabled}
             style={{
@@ -42,8 +40,7 @@ const CertificateFormatSettings = ({
             </div>
           </Button>
           <Button
-            variant={parameters.certType === "PFX" ? "filled" : "outline"}
-            color={parameters.certType === "PFX" ? "blue" : "var(--text-muted)"}
+            variant={parameters.certType === "PFX" ? "primary" : "secondary"}
             onClick={() => onParameterChange("certType", "PFX")}
             disabled={disabled}
             style={{
@@ -67,8 +64,7 @@ const CertificateFormatSettings = ({
         {/* Second row - PEM and JKS */}
         <div style={{ display: "flex", gap: "4px" }}>
           <Button
-            variant={parameters.certType === "PEM" ? "filled" : "outline"}
-            color={parameters.certType === "PEM" ? "blue" : "var(--text-muted)"}
+            variant={parameters.certType === "PEM" ? "primary" : "secondary"}
             onClick={() => onParameterChange("certType", "PEM")}
             disabled={disabled}
             style={{
@@ -89,8 +85,7 @@ const CertificateFormatSettings = ({
             </div>
           </Button>
           <Button
-            variant={parameters.certType === "JKS" ? "filled" : "outline"}
-            color={parameters.certType === "JKS" ? "blue" : "var(--text-muted)"}
+            variant={parameters.certType === "JKS" ? "primary" : "secondary"}
             onClick={() => onParameterChange("certType", "JKS")}
             disabled={disabled}
             style={{
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateSelector.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateSelector.tsx
index be2f1d6102..0c09b8c5e6 100644
--- a/frontend/editor/src/core/components/tools/certSign/CertificateSelector.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateSelector.tsx
@@ -1,12 +1,5 @@
-import {
-  Stack,
-  Radio,
-  Divider,
-  TextInput,
-  Text,
-  Group,
-  Button,
-} from "@mantine/core";
+import { Stack, Radio, Divider, TextInput, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useEffect } from "react";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
@@ -158,8 +151,8 @@ export const CertificateSelector: React.FC<CertificateSelectorProps> = ({
             {(["PKCS12", "PFX", "PEM", "JKS"] as UploadFormat[]).map((fmt) => (
               <Button
                 key={fmt}
-                size="xs"
-                variant={uploadFormat === fmt ? "filled" : "light"}
+                size="sm"
+                variant={uploadFormat === fmt ? "primary" : "secondary"}
                 onClick={() => handleFormatChange(fmt)}
                 disabled={disabled}
               >
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
index a64474b7b8..4311c5f6ca 100644
--- a/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
@@ -1,5 +1,6 @@
+import { Button } from "@app/ui/Button";
 import { useEffect } from "react";
-import { Stack, Button } from "@mantine/core";
+import { Stack } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { CertSignParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
@@ -17,11 +18,6 @@ const sourceButtonStyle = {
   fontSize: "11px",
 } as const;
 
-// Let labels wrap instead of clipping ("This device" was truncating to "This devi").
-const sourceButtonStyles = {
-  label: { whiteSpace: "normal" as const, lineHeight: 1.15 },
-} as const;
-
 const CertificateTypeSettings = ({
   parameters,
   onParameterChange,
@@ -73,45 +69,52 @@ const CertificateTypeSettings = ({
     onParameterChange("alias", undefined);
   };
 
+  const hasAlternativeSources =
+    isServerCertificateEnabled || isHardwareAvailable;
+
+  if (!hasAlternativeSources) {
+    return (
+      <Stack gap="md">
+        <div style={{ color: "var(--text-muted)", fontSize: "11px" }}>
+          {t(
+            "certSign.source.noOtherSources",
+            "No other certificate sources are available.",
+          )}
+        </div>
+      </Stack>
+    );
+  }
+
   return (
     <Stack gap="md">
       <div style={{ display: "flex", gap: "4px" }}>
         <Button
-          variant={parameters.signMode === "MANUAL" ? "filled" : "outline"}
-          color={
-            parameters.signMode === "MANUAL" ? "blue" : "var(--text-muted)"
-          }
+          variant={parameters.signMode === "MANUAL" ? "primary" : "secondary"}
+          accent={parameters.signMode === "MANUAL" ? "default" : "neutral"}
           onClick={selectUpload}
           disabled={disabled}
           style={sourceButtonStyle}
-          styles={sourceButtonStyles}
         >
           {t("certSign.source.upload", "Upload")}
         </Button>
         {isServerCertificateEnabled && (
           <Button
-            variant={parameters.signMode === "AUTO" ? "filled" : "outline"}
-            color={
-              parameters.signMode === "AUTO" ? "green" : "var(--text-muted)"
-            }
+            variant={parameters.signMode === "AUTO" ? "primary" : "secondary"}
+            accent={parameters.signMode === "AUTO" ? "default" : "neutral"}
             onClick={selectServer}
             disabled={disabled}
             style={sourceButtonStyle}
-            styles={sourceButtonStyles}
           >
             {t("certSign.source.server", "Server")}
           </Button>
         )}
         {isHardwareAvailable && (
           <Button
-            variant={parameters.signMode === "DEVICE" ? "filled" : "outline"}
-            color={
-              parameters.signMode === "DEVICE" ? "teal" : "var(--text-muted)"
-            }
+            variant={parameters.signMode === "DEVICE" ? "primary" : "secondary"}
+            accent={parameters.signMode === "DEVICE" ? "default" : "neutral"}
             onClick={selectDevice}
             disabled={disabled}
             style={sourceButtonStyle}
-            styles={sourceButtonStyles}
           >
             {t("certSign.source.device", "This device")}
           </Button>
diff --git a/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.tsx b/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.tsx
index 820636af35..b384ce8d5c 100644
--- a/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.tsx
@@ -1,7 +1,6 @@
 import { useCallback, useEffect, useState } from "react";
 import {
   Alert,
-  Button,
   Group,
   Loader,
   NumberInput,
@@ -10,6 +9,7 @@ import {
   Text,
   TextInput,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { CertSignParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
 import {
@@ -284,22 +284,34 @@ const HardwareCertificateSettings = ({
       {supported.windows && supported.pkcs11 && (
         <div style={{ display: "flex", gap: "4px" }}>
           <Button
-            variant={isWindowsStore ? "filled" : "outline"}
-            color={isWindowsStore ? "teal" : "var(--text-muted)"}
+            variant={isWindowsStore ? "primary" : "secondary"}
+            accent={isWindowsStore ? "success" : "default"}
             onClick={() => selectKind("WINDOWS_STORE")}
             disabled={disabled || loading}
-            style={{ flex: 1, fontSize: "11px", minHeight: 40, height: "auto" }}
-            styles={{ label: { whiteSpace: "normal", lineHeight: 1.15 } }}
+            style={{
+              flex: 1,
+              fontSize: "11px",
+              minHeight: 40,
+              height: "auto",
+              whiteSpace: "normal",
+              lineHeight: 1.15,
+            }}
           >
             {t("certSign.format.windowsStore", "Windows certificate store")}
           </Button>
           <Button
-            variant={!isWindowsStore ? "filled" : "outline"}
-            color={!isWindowsStore ? "teal" : "var(--text-muted)"}
+            variant={!isWindowsStore ? "primary" : "secondary"}
+            accent={!isWindowsStore ? "success" : "default"}
             onClick={() => selectKind("PKCS11")}
             disabled={disabled || loading}
-            style={{ flex: 1, fontSize: "11px", minHeight: 40, height: "auto" }}
-            styles={{ label: { whiteSpace: "normal", lineHeight: 1.15 } }}
+            style={{
+              flex: 1,
+              fontSize: "11px",
+              minHeight: 40,
+              height: "auto",
+              whiteSpace: "normal",
+              lineHeight: 1.15,
+            }}
           >
             {t("certSign.format.pkcs11", "USB Token")}
           </Button>
@@ -332,7 +344,7 @@ const HardwareCertificateSettings = ({
               )}
             />
             <Button
-              variant="default"
+              variant="secondary"
               onClick={loadWindowsCerts}
               disabled={disabled || loading}
             >
@@ -408,7 +420,7 @@ const HardwareCertificateSettings = ({
             />
           </Group>
           <Button
-            variant="default"
+            variant="secondary"
             onClick={loadPkcs11Certs}
             disabled={
               disabled ||
diff --git a/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.tsx b/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.tsx
index 07387613b5..75998b1c88 100644
--- a/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.tsx
@@ -1,4 +1,5 @@
-import { Stack, Text, Button, TextInput, NumberInput } from "@mantine/core";
+import { Stack, Text, TextInput, NumberInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { CertSignParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
 
@@ -21,8 +22,8 @@ const SignatureAppearanceSettings = ({
       <Stack gap="sm">
         <div style={{ display: "flex", gap: "4px" }}>
           <Button
-            variant={!parameters.showSignature ? "filled" : "outline"}
-            color={!parameters.showSignature ? "blue" : "var(--text-muted)"}
+            accent={!parameters.showSignature ? "default" : "neutral"}
+            variant={!parameters.showSignature ? "primary" : "secondary"}
             onClick={() => onParameterChange("showSignature", false)}
             disabled={disabled}
             style={{
@@ -43,8 +44,8 @@ const SignatureAppearanceSettings = ({
             </div>
           </Button>
           <Button
-            variant={parameters.showSignature ? "filled" : "outline"}
-            color={parameters.showSignature ? "blue" : "var(--text-muted)"}
+            accent={parameters.showSignature ? "default" : "neutral"}
+            variant={parameters.showSignature ? "primary" : "secondary"}
             onClick={() => onParameterChange("showSignature", true)}
             disabled={disabled}
             style={{
@@ -110,8 +111,8 @@ const SignatureAppearanceSettings = ({
             </Text>
             <div style={{ display: "flex", gap: "4px" }}>
               <Button
-                variant={!parameters.showLogo ? "filled" : "outline"}
-                color={!parameters.showLogo ? "blue" : "var(--text-muted)"}
+                accent={!parameters.showLogo ? "default" : "neutral"}
+                variant={!parameters.showLogo ? "primary" : "secondary"}
                 onClick={() => onParameterChange("showLogo", false)}
                 disabled={disabled}
                 style={{
@@ -132,8 +133,8 @@ const SignatureAppearanceSettings = ({
                 </div>
               </Button>
               <Button
-                variant={parameters.showLogo ? "filled" : "outline"}
-                color={parameters.showLogo ? "blue" : "var(--text-muted)"}
+                accent={parameters.showLogo ? "default" : "neutral"}
+                variant={parameters.showLogo ? "primary" : "secondary"}
                 onClick={() => onParameterChange("showLogo", true)}
                 disabled={disabled}
                 style={{
diff --git a/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.tsx b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.tsx
index 812d34749c..d0e7a69d2f 100644
--- a/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.tsx
@@ -1,11 +1,5 @@
-import {
-  Stack,
-  Text,
-  Button,
-  TextInput,
-  NumberInput,
-  Switch,
-} from "@mantine/core";
+import { Stack, Text, TextInput, NumberInput, Switch } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 export interface SignatureSettings {
@@ -49,8 +43,8 @@ const SignatureSettingsInput = ({
       {/* Signature Visibility */}
       <div style={{ display: "flex", gap: "4px" }}>
         <Button
-          variant={!value.showSignature ? "filled" : "outline"}
-          color={!value.showSignature ? "blue" : "var(--text-muted)"}
+          accent={!value.showSignature ? "default" : "neutral"}
+          variant={!value.showSignature ? "primary" : "secondary"}
           onClick={() => handleChange("showSignature", false)}
           disabled={disabled}
           style={{
@@ -67,8 +61,8 @@ const SignatureSettingsInput = ({
           </div>
         </Button>
         <Button
-          variant={value.showSignature ? "filled" : "outline"}
-          color={value.showSignature ? "blue" : "var(--text-muted)"}
+          accent={value.showSignature ? "default" : "neutral"}
+          variant={value.showSignature ? "primary" : "secondary"}
           onClick={() => handleChange("showSignature", true)}
           disabled={disabled}
           style={{
diff --git a/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.tsx b/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.tsx
index 57c0ec27ff..f87fda19fe 100644
--- a/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.tsx
@@ -2,13 +2,13 @@ import { useState, useCallback, useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Stack,
-  SegmentedControl,
   Text,
   Radio,
   FileInput,
   PasswordInput,
   Divider,
 } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { DrawingCanvas } from "@app/components/annotation/shared/DrawingCanvas";
 import { ImageUploader } from "@app/components/annotation/shared/ImageUploader";
 import { TextInputWithFont } from "@app/components/annotation/shared/TextInputWithFont";
@@ -241,12 +241,11 @@ const WetSignatureInput = ({
           onChange={(value) =>
             handleSignatureTypeChange(value as SignatureType)
           }
-          data={[
-            { label: t("sign.type.canvas", "Draw"), value: "canvas" },
-            { label: t("sign.type.image", "Upload"), value: "image" },
-            { label: t("sign.type.text", "Type"), value: "text" },
+          options={[
+            { label: t("sign.type.canvas", "Draw"), value: "canvas", disabled },
+            { label: t("sign.type.image", "Upload"), value: "image", disabled },
+            { label: t("sign.type.text", "Type"), value: "text", disabled },
           ]}
-          disabled={disabled}
         />
       </Stack>
 
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.tsx b/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.tsx
index f9be2f9787..b7e514d1aa 100644
--- a/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
-import { Modal, Stack, TextInput, Button, Group } from "@mantine/core";
+import { Modal, Stack, TextInput, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import AddIcon from "@mui/icons-material/Add";
 import UserSelector from "@app/components/shared/UserSelector";
@@ -74,15 +75,15 @@ export const AddParticipantsFlow: React.FC<AddParticipantsFlowProps> = ({
         />
 
         <Group justify="flex-end">
-          <Button variant="default" onClick={handleClose}>
+          <Button variant="secondary" onClick={handleClose}>
             {t("common.cancel", "Cancel")}
           </Button>
           <Button
+            accent="success"
             onClick={handleSubmit}
             loading={submitting}
             disabled={selectedUserIds.length === 0}
             leftSection={<AddIcon sx={{ fontSize: 16 }} />}
-            color="green"
           >
             {t(
               "certSign.collab.addParticipants.add",
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.tsx b/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.tsx
index 0032f186e2..f11e24596c 100644
--- a/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.tsx
@@ -2,12 +2,12 @@ import {
   Modal,
   Stack,
   Group,
-  Button,
   Text,
   Collapse,
   TextInput,
   Loader,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useState, useEffect, useRef } from "react";
 import CheckCircleIcon from "@mui/icons-material/CheckCircle";
@@ -286,8 +286,8 @@ export const CertificateConfigModal: React.FC<CertificateConfigModalProps> = ({
         {/* Advanced Settings - Optional */}
         <div>
           <Button
-            variant="subtle"
-            size="xs"
+            variant="tertiary"
+            size="sm"
             onClick={() => setShowAdvanced(!showAdvanced)}
             disabled={disabled || signing}
             style={{ marginBottom: "8px" }}
@@ -331,7 +331,7 @@ export const CertificateConfigModal: React.FC<CertificateConfigModalProps> = ({
         </div>
 
         <Group justify="space-between" wrap="wrap" mt="md">
-          <Button variant="default" onClick={onClose} disabled={signing}>
+          <Button variant="secondary" onClick={onClose} disabled={signing}>
             {t("cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.tsx b/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.tsx
index f14e3a31e5..c12c1e5a42 100644
--- a/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.tsx
@@ -1,13 +1,6 @@
-import {
-  Modal,
-  Stack,
-  Button,
-  Text,
-  Group,
-  Box,
-  ActionIcon,
-  UnstyledButton,
-} from "@mantine/core";
+import { Modal, Stack, Text, Group, Box } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import {
   useSavedSignatures,
@@ -136,7 +129,9 @@ export const SelectSignatureModal: React.FC<SelectSignatureModalProps> = ({
                     overflow: "hidden",
                   }}
                 >
-                  <UnstyledButton
+                  <Button
+                    variant="tertiary"
+                    hover={false}
                     onClick={() => {
                       onSignatureSelected(sig);
                       onClose();
@@ -144,10 +139,10 @@ export const SelectSignatureModal: React.FC<SelectSignatureModalProps> = ({
                     style={{ flex: 1, padding: "12px" }}
                   >
                     {renderSignaturePreview(sig)}
-                  </UnstyledButton>
+                  </Button>
                   <ActionIcon
-                    color="red"
-                    variant="subtle"
+                    variant="tertiary"
+                    accent="danger"
                     size="sm"
                     onClick={() => removeSignature(sig.id)}
                     aria-label={t(
@@ -177,7 +172,7 @@ export const SelectSignatureModal: React.FC<SelectSignatureModalProps> = ({
 
         <Group grow>
           <Button
-            variant="outline"
+            variant="secondary"
             leftSection={<DrawIcon />}
             onClick={() => {
               onCreateNew("canvas");
@@ -187,7 +182,7 @@ export const SelectSignatureModal: React.FC<SelectSignatureModalProps> = ({
             {t("certSign.collab.signRequest.modeTabs.draw", "Draw")}
           </Button>
           <Button
-            variant="outline"
+            variant="secondary"
             leftSection={<TextFieldsIcon />}
             onClick={() => {
               onCreateNew("text");
@@ -197,7 +192,7 @@ export const SelectSignatureModal: React.FC<SelectSignatureModalProps> = ({
             {t("certSign.collab.signRequest.modeTabs.text", "Type")}
           </Button>
           <Button
-            variant="outline"
+            variant="secondary"
             leftSection={<ImageIcon />}
             onClick={() => {
               onCreateNew("image");
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.tsx
index 47c6ac008f..5045a0544e 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.tsx
@@ -1,4 +1,5 @@
-import { Stack, Text, List, Group, Badge, ActionIcon } from "@mantine/core";
+import { Stack, Text, List, Group, Badge } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import CheckCircleIcon from "@mui/icons-material/CheckCircle";
 import PendingIcon from "@mui/icons-material/Pending";
@@ -84,13 +85,17 @@ export const ParticipantListPanel: React.FC<ParticipantListPanelProps> = ({
                 {!finalized && !isSigned && !isDeclined && (
                   <ActionIcon
                     size="sm"
-                    variant="subtle"
-                    color="red"
+                    variant="tertiary"
+                    accent="danger"
                     onClick={() => onRemove(participant.id)}
                     title={t(
                       "certSign.collab.sessionDetail.removeParticipant",
                       "Remove",
                     )}
+                    aria-label={t(
+                      "certSign.collab.sessionDetail.removeParticipant",
+                      "Remove",
+                    )}
                   >
                     <DeleteIcon sx={{ fontSize: "1rem" }} />
                   </ActionIcon>
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.tsx
index 51601cfaaf..7b98bf868b 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.tsx
@@ -1,4 +1,5 @@
-import { Stack, Text, Button, Divider, Paper } from "@mantine/core";
+import { Stack, Text, Divider, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import CheckCircleIcon from "@mui/icons-material/CheckCircle";
 import AddIcon from "@mui/icons-material/Add";
@@ -57,9 +58,9 @@ export const SessionActionsPanel: React.FC<SessionActionsPanelProps> = ({
         <>
           <Divider />
           <Button
+            variant="secondary"
             leftSection={<AddIcon />}
             onClick={onAddParticipants}
-            variant="light"
             fullWidth
           >
             {t(
@@ -72,7 +73,7 @@ export const SessionActionsPanel: React.FC<SessionActionsPanelProps> = ({
 
           <Button
             leftSection={<CheckCircleIcon />}
-            color={allSigned ? "green.6" : "orange"}
+            accent={allSigned ? "success" : "warning"}
             fullWidth
             onClick={onFinalize}
             loading={finalizing}
@@ -94,7 +95,6 @@ export const SessionActionsPanel: React.FC<SessionActionsPanelProps> = ({
         <>
           <Button
             leftSection={<CheckCircleIcon />}
-            color="blue"
             fullWidth
             onClick={onLoadSignedPdf}
             loading={loadingPdf}
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.tsx
index 04539d39b5..3ec2a9114e 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.tsx
@@ -1,14 +1,7 @@
 import { useState, useEffect } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Stack,
-  Text,
-  Group,
-  Badge,
-  Button,
-  Divider,
-  Modal,
-} from "@mantine/core";
+import { Stack, Text, Group, Badge, Divider, Modal } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { alert } from "@app/components/toast";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -159,11 +152,10 @@ export const SessionDetailPanel = ({ data }: SessionDetailPanelProps) => {
     <Stack gap="md" p="md" h="100%" style={{ minHeight: 0 }}>
       <Button
         leftSection={<ArrowBackIcon fontSize="small" />}
-        variant="subtle"
+        variant="tertiary"
         size="sm"
         onClick={onBack}
-        justify="flex-start"
-        px={6}
+        justify="start"
         style={{ alignSelf: "flex-start" }}
       >
         {t("certSign.collab.sessionDetail.backToList", "Back to Sessions")}
@@ -220,8 +212,8 @@ export const SessionDetailPanel = ({ data }: SessionDetailPanelProps) => {
       {!session.finalized && (
         <Button
           leftSection={<DeleteIcon fontSize="small" />}
-          color="red"
-          variant="light"
+          accent="danger"
+          variant="tertiary"
           fullWidth
           onClick={() => setDeleteModalOpen(true)}
         >
@@ -253,10 +245,13 @@ export const SessionDetailPanel = ({ data }: SessionDetailPanelProps) => {
             )}
           </Text>
           <Group justify="flex-end">
-            <Button variant="subtle" onClick={() => setDeleteModalOpen(false)}>
+            <Button
+              variant="tertiary"
+              onClick={() => setDeleteModalOpen(false)}
+            >
               {t("cancel", "Cancel")}
             </Button>
-            <Button color="red" onClick={handleDelete} loading={deleting}>
+            <Button accent="danger" onClick={handleDelete} loading={deleting}>
               {t("delete", "Delete")}
             </Button>
           </Group>
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.tsx
index 7945c697f4..15fe50eb90 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.tsx
@@ -1,15 +1,8 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import {
-  ActionIcon,
-  Box,
-  Button,
-  Group,
-  Menu,
-  Modal,
-  SegmentedControl,
-  Stack,
-  Text,
-} from "@mantine/core";
+import { Box, Group, Menu, Modal, Stack, Text } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import DrawIcon from "@mui/icons-material/Draw";
 import OpenWithIcon from "@mui/icons-material/OpenWith";
@@ -363,11 +356,10 @@ export default function SignControlsPanel({
       <Menu withinPortal position="bottom" shadow="md" width="target">
         <Menu.Target>
           <Button
-            variant="default"
+            variant="secondary"
             fullWidth
-            justify="space-between"
+            justify="between"
             rightSection={<KeyboardArrowDownIcon sx={{ fontSize: "1.1rem" }} />}
-            styles={{ label: { flex: 1, overflow: "hidden" } }}
             aria-label={t(
               "certSign.collab.signRequest.changeSignature",
               "Change signature",
@@ -396,10 +388,10 @@ export default function SignControlsPanel({
                 <Group gap="sm" wrap="nowrap" justify="space-between">
                   {renderSavedSignaturePreview(sig)}
                   <ActionIcon
-                    component="div"
-                    size="xs"
-                    color="red"
-                    variant="subtle"
+                    as="div"
+                    size="sm"
+                    accent="danger"
+                    variant="tertiary"
                     onClick={(e) => {
                       e.stopPropagation();
                       removeSignature(sig.id);
@@ -441,7 +433,7 @@ export default function SignControlsPanel({
         fullWidth
         value={placementMode ? "place" : "move"}
         onChange={(value) => onPlacementModeChange(value === "place")}
-        data={[
+        options={[
           {
             value: "place",
             label: (
@@ -466,16 +458,15 @@ export default function SignControlsPanel({
           },
         ]}
         size="xs"
-        radius="xl"
-        aria-label={t(
+        ariaLabel={t(
           "certSign.collab.signRequest.mode.title",
           "Sign or move mode",
         )}
       />
 
       <Button
-        variant="light"
-        color="red"
+        variant="tertiary"
+        accent="danger"
         leftSection={<DeleteOutlineIcon sx={{ fontSize: "1.1rem" }} />}
         onClick={onDeleteSelected}
         disabled={!hasSelectedAnnotation}
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
index 7a5c021de8..2b128ebd11 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
@@ -1,6 +1,7 @@
 import { useState, useRef, useEffect, useCallback } from "react";
 import { useTranslation } from "react-i18next";
-import { Stack, Button, Text, Divider } from "@mantine/core";
+import { Stack, Text, Divider } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import CancelIcon from "@mui/icons-material/Cancel";
 import FolderOpenIcon from "@mui/icons-material/FolderOpen";
@@ -272,11 +273,10 @@ const SignRequestPanel = ({ data }: SignRequestPanelProps) => {
     <Stack gap="md" p="md">
       <Button
         leftSection={<ArrowBackIcon fontSize="small" />}
-        variant="subtle"
+        variant="tertiary"
         size="sm"
         onClick={onBack}
-        justify="flex-start"
-        px={6}
+        justify="start"
         style={{ alignSelf: "flex-start" }}
       >
         {t("certSign.collab.signRequest.backToList", "Back to Sign Requests")}
@@ -312,7 +312,7 @@ const SignRequestPanel = ({ data }: SignRequestPanelProps) => {
       )}
 
       <Button
-        variant="light"
+        variant="tertiary"
         leftSection={<FolderOpenIcon fontSize="small" />}
         onClick={handleAddToActiveFiles}
         fullWidth
@@ -328,8 +328,8 @@ const SignRequestPanel = ({ data }: SignRequestPanelProps) => {
       {signRequest.myStatus !== "SIGNED" &&
         signRequest.myStatus !== "DECLINED" && (
           <Button
-            variant="light"
-            color="red"
+            variant="tertiary"
+            accent="danger"
             leftSection={<CancelIcon fontSize="small" />}
             onClick={handleDecline}
             loading={declining}
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.tsx b/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.tsx
index e08ff2361d..bde8102d19 100644
--- a/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
-import { Button, Stack, Text, Paper } from "@mantine/core";
+import { Stack, Text, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import AddIcon from "@mui/icons-material/Add";
 import CancelIcon from "@mui/icons-material/Cancel";
@@ -118,11 +119,11 @@ export const AddSignaturesStep: React.FC<AddSignaturesStepProps> = ({
             </Button>
           ) : (
             <Button
+              variant="secondary"
+              accent="danger"
               leftSection={<CancelIcon />}
               onClick={onCancelPlacement}
               disabled={disabled}
-              variant="light"
-              color="red"
             >
               {t(
                 "certSign.collab.signRequest.steps.cancelPlacement",
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.tsx b/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.tsx
index 6df5368339..1566e20334 100644
--- a/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Group } from "@mantine/core";
+import { Stack, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import {
@@ -78,7 +79,7 @@ export const CertificateSelectionStep: React.FC<
 
       <Group gap="sm">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.tsx b/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.tsx
index d46c780309..8d654a8896 100644
--- a/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text, Group, Divider, Paper } from "@mantine/core";
+import { Stack, Text, Group, Divider, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import DrawIcon from "@mui/icons-material/Draw";
@@ -167,15 +168,15 @@ export const ReviewSignatureStep: React.FC<ReviewSignatureStepProps> = ({
       {/* Action Buttons */}
       <Group gap="sm" mt="md">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
           {t("certSign.collab.signRequest.steps.back", "Back")}
         </Button>
         <Button
-          variant="light"
-          color="red"
+          variant="secondary"
+          accent="danger"
           onClick={onDecline}
           disabled={disabled}
           leftSection={<CancelIcon sx={{ fontSize: 16 }} />}
@@ -183,10 +184,10 @@ export const ReviewSignatureStep: React.FC<ReviewSignatureStepProps> = ({
           {t("certSign.collab.signRequest.declineButton", "Decline")}
         </Button>
         <Button
+          accent="success"
           onClick={onSign}
           disabled={disabled}
           style={{ flex: 1 }}
-          color="green"
           leftSection={<CheckCircleIcon sx={{ fontSize: 16 }} />}
         >
           {t("certSign.collab.signRequest.signButton", "Sign Document")}
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.tsx b/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.tsx
index 7f1ed24125..c24fa1241b 100644
--- a/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack } from "@mantine/core";
+import { Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import {
   SignatureTypeSelector,
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.tsx b/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.tsx
index c6010f27b3..a9dfb0cf03 100644
--- a/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.tsx
@@ -1,4 +1,5 @@
-import { Button, Stack, Text, Group } from "@mantine/core";
+import { Stack, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 
@@ -41,7 +42,7 @@ export const SignaturePlacementStep: React.FC<SignaturePlacementStepProps> = ({
 
       <Group gap="sm">
         <Button
-          variant="default"
+          variant="secondary"
           onClick={onBack}
           leftSection={<ArrowBackIcon sx={{ fontSize: 16 }} />}
         >
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.tsx
index ea6e85833a..66a608b4ee 100644
--- a/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.tsx
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.tsx
@@ -1,4 +1,5 @@
-import { Stack, TextInput, Button, Group, Text } from "@mantine/core";
+import { Stack, TextInput, Group, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { ChangeMetadataParameters } from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
 
@@ -30,8 +31,8 @@ const CustomMetadataStep = ({
           {t("changeMetadata.customFields.title", "Custom Metadata")}
         </Text>
         <Button
-          size="xs"
-          variant="light"
+          variant="secondary"
+          size="sm"
           onClick={() => addCustomMetadata()}
           disabled={disabled}
         >
@@ -73,9 +74,9 @@ const CustomMetadataStep = ({
             disabled={disabled}
           />
           <Button
-            size="xs"
-            variant="light"
-            color="red"
+            variant="secondary"
+            accent="danger"
+            size="sm"
             onClick={() => removeCustomMetadata(entry.id)}
             disabled={disabled}
           >
diff --git a/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.tsx b/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.tsx
index d0b16336a7..d6e3c55f71 100644
--- a/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.tsx
+++ b/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.tsx
@@ -1,5 +1,6 @@
 import { useMemo, useState } from "react";
-import { Badge, Group, SegmentedControl, Stack, Text } from "@mantine/core";
+import { Badge, Group, Stack, Text } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import type { TFunction } from "i18next";
 
@@ -167,10 +168,10 @@ const ComparePixelWorkbenchView = ({
           </Badge>
         </Group>
         <SegmentedControl
-          size="xs"
+          size="sm"
           value={viewMode}
           onChange={(value) => setViewMode(value as PixelViewMode)}
-          data={[
+          options={[
             {
               value: "side-by-side",
               label: t("compare.pixel.sideBySide", "Side-by-side"),
diff --git a/frontend/editor/src/core/components/tools/compare/compareView.css b/frontend/editor/src/core/components/tools/compare/compareView.css
index d65c5fa866..e399f98b40 100644
--- a/frontend/editor/src/core/components/tools/compare/compareView.css
+++ b/frontend/editor/src/core/components/tools/compare/compareView.css
@@ -550,7 +550,7 @@
   gap: 0.5rem;
 }
 
-/* Full-height light bar to the right of both cards (reference UI) */
+/* Full-height bar to the right of both cards */
 .compare-step-selection__swap {
   flex-shrink: 0;
   width: 36px;
@@ -558,48 +558,15 @@
   align-self: stretch;
   margin: 0;
   padding: 0.5rem 0.2rem;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
   gap: 0.35rem;
-  border-radius: var(--radius-md);
-  border: 1px solid
-    color-mix(in srgb, var(--mantine-color-blue-4) 28%, var(--border-default));
-  background: color-mix(
-    in srgb,
-    var(--mantine-color-blue-0) 92%,
-    var(--mantine-color-body)
-  );
-  color: var(--mantine-color-blue-filled);
-  cursor: pointer;
-  font: inherit;
-  transition:
-    background 0.12s ease,
-    border-color 0.12s ease;
-}
-
-.compare-step-selection__swap:hover:not(:disabled) {
-  background: color-mix(
-    in srgb,
-    var(--mantine-color-blue-1) 75%,
-    var(--mantine-color-body)
-  );
-  border-color: color-mix(
-    in srgb,
-    var(--mantine-color-blue-5) 35%,
-    var(--border-default)
-  );
-}
-
-.compare-step-selection__swap:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
 }
 
 .compare-step-selection__swap-icon {
   font-size: 1.35rem !important;
-  color: var(--mantine-color-blue-filled);
 }
 
 .compare-step-selection__swap-label {
@@ -607,36 +574,6 @@
   font-weight: 600;
   line-height: 1.15;
   text-align: center;
-  color: var(--mantine-color-blue-filled);
-  writing-mode: horizontal-tb;
-}
-
-[data-mantine-color-scheme="”dark”"] .compare-step-selection__swap {
-  background: color-mix(
-    in srgb,
-    var(--mantine-color-blue-9) 22%,
-    var(--mantine-color-dark-6)
-  );
-  border-color: color-mix(
-    in srgb,
-    var(--mantine-color-blue-4) 40%,
-    var(--border-default)
-  );
-  color: var(--mantine-color-blue-3);
-}
-
-[data-mantine-color-scheme="”dark”"]
-  .compare-step-selection__swap:hover:not(:disabled) {
-  background: color-mix(
-    in srgb,
-    var(--mantine-color-blue-9) 32%,
-    var(--mantine-color-dark-6)
-  );
-}
-
-[data-mantine-color-scheme="”dark”"] .compare-step-selection__swap-icon,
-[data-mantine-color-scheme="”dark”"] .compare-step-selection__swap-label {
-  color: var(--mantine-color-blue-3);
 }
 
 /* Pixel compare mode */
diff --git a/frontend/editor/src/core/components/tools/compress/CompressSettings.tsx b/frontend/editor/src/core/components/tools/compress/CompressSettings.tsx
index 1c5cb8ef4d..f0cd39b2c0 100644
--- a/frontend/editor/src/core/components/tools/compress/CompressSettings.tsx
+++ b/frontend/editor/src/core/components/tools/compress/CompressSettings.tsx
@@ -6,10 +6,10 @@ import {
   Divider,
   Checkbox,
   Slider,
-  SegmentedControl,
   Tooltip,
   Box,
 } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import SliderWithInput from "@app/components/shared/sliderWithInput/SliderWithInput";
 import { useTranslation } from "react-i18next";
 import { CompressParameters } from "@app/hooks/tools/compress/useCompressParameters";
@@ -258,14 +258,22 @@ const CompressSettings = ({
             </Text>
             <SegmentedControl
               fullWidth
-              disabled={disabled || imageMagickAvailable === false}
-              data={[
-                { value: "1", label: t("compress.lineArt.edgeLow", "Gentle") },
+              options={[
+                {
+                  value: "1",
+                  label: t("compress.lineArt.edgeLow", "Gentle"),
+                  disabled: disabled || imageMagickAvailable === false,
+                },
                 {
                   value: "2",
                   label: t("compress.lineArt.edgeMedium", "Balanced"),
+                  disabled: disabled || imageMagickAvailable === false,
+                },
+                {
+                  value: "3",
+                  label: t("compress.lineArt.edgeHigh", "Strong"),
+                  disabled: disabled || imageMagickAvailable === false,
                 },
-                { value: "3", label: t("compress.lineArt.edgeHigh", "Strong") },
               ]}
               value={parameters.lineArtEdgeLevel.toString()}
               onChange={(value) =>
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertSettings.tsx b/frontend/editor/src/core/components/tools/convert/ConvertSettings.tsx
index 5c0843660f..cc33ccbbb4 100644
--- a/frontend/editor/src/core/components/tools/convert/ConvertSettings.tsx
+++ b/frontend/editor/src/core/components/tools/convert/ConvertSettings.tsx
@@ -1,12 +1,6 @@
 import { useMemo } from "react";
-import {
-  Stack,
-  Text,
-  Group,
-  Divider,
-  UnstyledButton,
-  useMantineTheme,
-} from "@mantine/core";
+import { Stack, Text, Group, Divider, useMantineTheme } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
 import { useTranslation } from "react-i18next";
 import { useMultipleEndpointsEnabled } from "@app/hooks/useEndpointConfig";
@@ -336,7 +330,11 @@ const ConvertSettings = ({
           {t("convert.convertTo", "Convert to")}:
         </Text>
         {!parameters.fromExtension ? (
-          <UnstyledButton
+          <Button
+            variant="tertiary"
+            hover={false}
+            fullWidth
+            disabled
             style={{
               padding: "0.5rem 0.75rem",
               border: `0.0625rem solid ${theme.colors.gray[4]}`,
@@ -346,7 +344,7 @@ const ConvertSettings = ({
               cursor: "not-allowed",
             }}
           >
-            <Group justify="space-between">
+            <Group justify="space-between" style={{ width: "100%" }}>
               <Text size="sm">
                 {t(
                   "convert.selectSourceFormatFirst",
@@ -360,7 +358,7 @@ const ConvertSettings = ({
                 }}
               />
             </Group>
-          </UnstyledButton>
+          </Button>
         ) : (
           <GroupedFormatDropdown
             name="convert-to-dropdown"
diff --git a/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
index 296a91056a..7ffd30fa85 100644
--- a/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
+++ b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
@@ -3,12 +3,11 @@ import {
   Stack,
   Text,
   Group,
-  Button,
   Box,
   Popover,
-  UnstyledButton,
   useMantineTheme,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
 import CloudOutlinedIcon from "@mui/icons-material/CloudOutlined";
 import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
@@ -87,7 +86,10 @@ const GroupedFormatDropdown = ({
       zIndex={zIndex}
     >
       <Popover.Target>
-        <UnstyledButton
+        <Button
+          variant="tertiary"
+          hover={false}
+          fullWidth
           name={name}
           data-testid={name}
           onClick={() => setDropdownOpened(!dropdownOpened)}
@@ -106,7 +108,7 @@ const GroupedFormatDropdown = ({
               : "var(--dropdown-trigger-text)",
           }}
         >
-          <Group justify="space-between">
+          <Group justify="space-between" style={{ width: "100%" }}>
             <Text size="sm" c={value ? undefined : "dimmed"}>
               {selectedLabel}
             </Text>
@@ -119,7 +121,7 @@ const GroupedFormatDropdown = ({
               }}
             />
           </Group>
-        </UnstyledButton>
+        </Button>
       </Popover.Target>
       <Popover.Dropdown
         style={{
@@ -147,10 +149,21 @@ const GroupedFormatDropdown = ({
                   <Button
                     key={option.value}
                     data-testid={`format-option-${option.value}`}
-                    variant={value === option.value ? "filled" : "outline"}
+                    variant={value === option.value ? "primary" : "secondary"}
                     size="sm"
                     onClick={() => handleOptionSelect(option.value)}
                     disabled={option.enabled === false}
+                    rightSection={
+                      option.usesCloud ? (
+                        <CloudOutlinedIcon
+                          style={{
+                            fontSize: "0.625rem",
+                            marginLeft: "0.25rem",
+                            opacity: 0.7,
+                          }}
+                        />
+                      ) : undefined
+                    }
                     style={{
                       fontSize: "0.75rem",
                       height: "2rem",
@@ -160,15 +173,6 @@ const GroupedFormatDropdown = ({
                     }}
                   >
                     {option.label}
-                    {option.usesCloud && (
-                      <CloudOutlinedIcon
-                        style={{
-                          fontSize: "0.625rem",
-                          marginLeft: "0.25rem",
-                          opacity: 0.7,
-                        }}
-                      />
-                    )}
                   </Button>
                 ))}
               </Group>
diff --git a/frontend/editor/src/core/components/tools/crop/CropSettings.tsx b/frontend/editor/src/core/components/tools/crop/CropSettings.tsx
index 65b0e8f0fe..710391dd6c 100644
--- a/frontend/editor/src/core/components/tools/crop/CropSettings.tsx
+++ b/frontend/editor/src/core/components/tools/crop/CropSettings.tsx
@@ -4,11 +4,11 @@ import {
   Text,
   Box,
   Group,
-  ActionIcon,
   Center,
   Alert,
   Checkbox,
 } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import RestartAltIcon from "@mui/icons-material/RestartAlt";
 import { CropParametersHook } from "@app/hooks/tools/crop/useCropParameters";
@@ -193,7 +193,7 @@ const CropSettings = ({ parameters, disabled = false }: CropSettingsProps) => {
               {t("crop.preview.title", "Crop Area Selection")}
             </Text>
             <ActionIcon
-              variant="outline"
+              variant="secondary"
               onClick={handleReset}
               disabled={disabled || isFullCrop}
               title={t("crop.reset", "Reset to full PDF")}
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
index 2dbde539ef..9b6152cf55 100644
--- a/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
@@ -1,9 +1,7 @@
 import { Fragment, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ActionIcon,
   Badge,
-  Button,
   Flex,
   Group,
   NumberInput,
@@ -13,6 +11,8 @@ import {
   TextInput,
   Tooltip,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import {
   BookmarkNode,
@@ -227,8 +227,7 @@ export default function BookmarkEditor({
           <Flex align="flex-start" justify="space-between" gap="md">
             <Group gap="sm" align="flex-start">
               <ActionIcon
-                variant="subtle"
-                color="gray"
+                variant="tertiary"
                 onMouseDown={(e) => {
                   e.preventDefault();
                   if (hasChildren) handleToggle(bookmark.id);
@@ -272,13 +271,17 @@ export default function BookmarkEditor({
                 )}
               >
                 <ActionIcon
-                  variant="subtle"
-                  color="green"
+                  variant="tertiary"
+                  accent="success"
                   onMouseDown={(e) => {
                     e.preventDefault();
                     handleAddChild(bookmark.id);
                   }}
                   disabled={disabled}
+                  aria-label={t(
+                    "editTableOfContents.editor.actions.addChild",
+                    "Add child bookmark",
+                  )}
                 >
                   <LocalIcon icon="subdirectory-arrow-right-rounded" />
                 </ActionIcon>
@@ -290,13 +293,16 @@ export default function BookmarkEditor({
                 )}
               >
                 <ActionIcon
-                  variant="subtle"
-                  color="blue"
+                  variant="tertiary"
                   onMouseDown={(e) => {
                     e.preventDefault();
                     handleAddSibling(bookmark.id);
                   }}
                   disabled={disabled}
+                  aria-label={t(
+                    "editTableOfContents.editor.actions.addSibling",
+                    "Add sibling bookmark",
+                  )}
                 >
                   <LocalIcon icon="add-rounded" />
                 </ActionIcon>
@@ -308,13 +314,17 @@ export default function BookmarkEditor({
                 )}
               >
                 <ActionIcon
-                  variant="subtle"
-                  color="red"
+                  variant="tertiary"
+                  accent="danger"
                   onMouseDown={(e) => {
                     e.preventDefault();
                     handleRemove(bookmark.id);
                   }}
                   disabled={disabled}
+                  aria-label={t(
+                    "editTableOfContents.editor.actions.remove",
+                    "Remove bookmark",
+                  )}
                 >
                   <LocalIcon icon="delete-rounded" />
                 </ActionIcon>
@@ -399,8 +409,7 @@ export default function BookmarkEditor({
           </Text>
         </div>
         <Button
-          variant="default"
-          color="blue"
+          variant="secondary"
           leftSection={<LocalIcon icon="bookmark-add-rounded" />}
           onMouseDown={(e) => {
             e.preventDefault();
@@ -432,8 +441,7 @@ export default function BookmarkEditor({
               )}
             </Text>
             <Button
-              variant="subtle"
-              color="blue"
+              variant="tertiary"
               leftSection={<LocalIcon icon="add-rounded" />}
               onMouseDown={(e) => {
                 e.preventDefault();
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.tsx
index 32c5087505..387e1ffe6e 100644
--- a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.tsx
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.tsx
@@ -1,15 +1,8 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Alert,
-  Button,
-  Divider,
-  FileButton,
-  Stack,
-  Switch,
-  Text,
-  Tooltip,
-} from "@mantine/core";
+import { Alert, Divider, Stack, Switch, Text, Tooltip } from "@mantine/core";
+import { Button as DSButton } from "@app/ui/Button";
+import { FilePicker } from "@app/ui/FilePicker";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { BookmarkNode } from "@app/utils/editTableOfContents";
 
@@ -87,8 +80,8 @@ export default function EditTableOfContentsSettings({
       </Stack>
 
       <Stack gap="sm">
-        <Button
-          variant="light"
+        <DSButton
+          variant="secondary"
           leftSection={<LocalIcon icon="folder-rounded" />}
           onClick={onSelectFiles}
           fullWidth
@@ -96,8 +89,7 @@ export default function EditTableOfContentsSettings({
           {selectedFileName
             ? t("editTableOfContents.workbench.changeFile", "Change PDF")
             : t("editTableOfContents.workbench.selectFile", "Select PDF")}
-        </Button>
-
+        </DSButton>
         <Tooltip
           label={
             !selectedFileName
@@ -109,8 +101,8 @@ export default function EditTableOfContentsSettings({
           }
           disabled={Boolean(selectedFileName)}
         >
-          <Button
-            variant="default"
+          <DSButton
+            variant="secondary"
             leftSection={<LocalIcon icon="picture-as-pdf-rounded" />}
             onClick={onLoadFromPdf}
             loading={isLoading}
@@ -118,27 +110,18 @@ export default function EditTableOfContentsSettings({
             fullWidth
           >
             {t("editTableOfContents.actions.loadFromPdf", "Load from PDF")}
-          </Button>
+          </DSButton>
         </Tooltip>
-
-        <FileButton
+        <FilePicker
           onChange={(file) => file && onImportJson(file)}
           accept="application/json"
           disabled={disabled}
+          variant="secondary"
+          leftSection={<LocalIcon icon="upload-rounded" />}
+          fullWidth
         >
-          {(props) => (
-            <Button
-              {...props}
-              variant="default"
-              leftSection={<LocalIcon icon="upload-rounded" />}
-              disabled={disabled}
-              fullWidth
-            >
-              {t("editTableOfContents.actions.importJson", "Import JSON")}
-            </Button>
-          )}
-        </FileButton>
-
+          {t("editTableOfContents.actions.importJson", "Import JSON")}
+        </FilePicker>
         <Tooltip
           label={
             canReadClipboard
@@ -150,8 +133,8 @@ export default function EditTableOfContentsSettings({
           }
           disabled={canReadClipboard}
         >
-          <Button
-            variant="default"
+          <DSButton
+            variant="secondary"
             leftSection={<LocalIcon icon="content-paste-rounded" />}
             onClick={onImportClipboard}
             disabled={disabled || !canReadClipboard}
@@ -161,7 +144,7 @@ export default function EditTableOfContentsSettings({
               "editTableOfContents.actions.importClipboard",
               "Paste from clipboard",
             )}
-          </Button>
+          </DSButton>
         </Tooltip>
       </Stack>
 
@@ -184,16 +167,15 @@ export default function EditTableOfContentsSettings({
       </Stack>
 
       <Stack gap="sm">
-        <Button
-          variant="default"
+        <DSButton
+          variant="secondary"
           leftSection={<LocalIcon icon="download-rounded" />}
           onClick={onExportJson}
           disabled={disabled || bookmarks.length === 0}
           fullWidth
         >
           {t("editTableOfContents.actions.exportJson", "Download JSON")}
-        </Button>
-
+        </DSButton>
         <Tooltip
           label={
             canWriteClipboard
@@ -205,8 +187,8 @@ export default function EditTableOfContentsSettings({
           }
           disabled={canWriteClipboard}
         >
-          <Button
-            variant="default"
+          <DSButton
+            variant="secondary"
             leftSection={<LocalIcon icon="content-copy-rounded" />}
             onClick={onExportClipboard}
             disabled={disabled || bookmarks.length === 0 || !canWriteClipboard}
@@ -216,7 +198,7 @@ export default function EditTableOfContentsSettings({
               "editTableOfContents.actions.exportClipboard",
               "Copy to clipboard",
             )}
-          </Button>
+          </DSButton>
         </Tooltip>
       </Stack>
 
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
index 43702d5c65..148917dba6 100644
--- a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
@@ -1,6 +1,7 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Box, Button, Card, Divider, Group, Stack, Text } from "@mantine/core";
+import { Box, Card, Divider, Group, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { BookmarkNode } from "@app/utils/editTableOfContents";
 import ErrorNotification from "@app/components/tools/shared/ErrorNotification";
@@ -150,7 +151,6 @@ const EditTableOfContentsWorkbenchView = ({
             <Group justify="flex-end">
               <Button
                 leftSection={<LocalIcon icon="menu-book-rounded" />}
-                color="blue"
                 onClick={onExecute}
                 disabled={isExecuteDisabled}
                 loading={isExecuting}
@@ -213,7 +213,7 @@ const EditTableOfContentsWorkbenchView = ({
                   </Button>
                 )}
                 <Button
-                  variant="outline"
+                  variant="secondary"
                   leftSection={<LocalIcon icon="rotate-left" />}
                   onClick={onUndo}
                   disabled={isExecuting}
diff --git a/frontend/editor/src/core/components/tools/fullscreen/CompactToolItem.tsx b/frontend/editor/src/core/components/tools/fullscreen/CompactToolItem.tsx
index a6f4d257b3..37300cfeec 100644
--- a/frontend/editor/src/core/components/tools/fullscreen/CompactToolItem.tsx
+++ b/frontend/editor/src/core/components/tools/fullscreen/CompactToolItem.tsx
@@ -15,6 +15,7 @@ import {
   useToolMeta,
   getDisabledLabel,
 } from "@app/components/tools/fullscreen/shared";
+import { Button } from "@app/ui/Button";
 
 interface CompactToolItemProps {
   id: string;
@@ -53,27 +54,31 @@ const CompactToolItem: React.FC<CompactToolItemProps> = ({
     iconNode = tool.icon;
   }
 
+  const iconElement = tool.icon ? (
+    <span
+      className={iconClasses}
+      aria-hidden
+      style={{
+        background: iconBg,
+        ...getIconStyle(),
+      }}
+    >
+      {iconNode}
+    </span>
+  ) : undefined;
+
   const compactButton = (
-    <button
-      type="button"
+    <Button
+      variant="tertiary"
+      justify="start"
+      fullWidth
       className={`tool-panel__fullscreen-list-item ${getItemClasses(false)} ${isSelected ? "tool-panel__fullscreen-list-item--selected" : ""} ${!disabled ? "tool-panel__fullscreen-list-item--with-star" : ""}`}
       onClick={onClick}
       aria-disabled={disabled}
       disabled={disabled}
       data-tour={`tool-button-${id}`}
+      leftSection={iconElement}
     >
-      {tool.icon ? (
-        <span
-          className={iconClasses}
-          aria-hidden
-          style={{
-            background: iconBg,
-            ...getIconStyle(),
-          }}
-        >
-          {iconNode}
-        </span>
-      ) : null}
       <span className="tool-panel__fullscreen-list-body">
         <div style={{ display: "flex", alignItems: "center", gap: "0.5rem" }}>
           <Text className="tool-panel__fullscreen-name">{tool.name}</Text>
@@ -93,7 +98,7 @@ const CompactToolItem: React.FC<CompactToolItemProps> = ({
           />
         </div>
       )}
-    </button>
+    </Button>
   );
 
   const { key: disabledKey, fallback: disabledFallback } =
diff --git a/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.tsx b/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.tsx
index 32fa181a16..464403e286 100644
--- a/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.tsx
+++ b/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.tsx
@@ -14,6 +14,7 @@ import {
   useToolMeta,
   getDisabledLabel,
 } from "@app/components/tools/fullscreen/shared";
+import { Button } from "@app/ui/Button";
 
 interface DetailedToolItemProps {
   id: string;
@@ -56,8 +57,8 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({
   const disabledMessage = t(disabledKey, disabledFallback);
 
   return (
-    <button
-      type="button"
+    <Button
+      variant="tertiary"
       className={`tool-panel__fullscreen-item ${getItemClasses(true)} ${isSelected ? "tool-panel__fullscreen-item--selected" : ""} tool-panel__fullscreen-item--with-star`}
       onClick={onClick}
       aria-disabled={disabled}
@@ -123,7 +124,7 @@ const DetailedToolItem: React.FC<DetailedToolItemProps> = ({
           />
         </div>
       )}
-    </button>
+    </Button>
   );
 };
 
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.tsx
index 7c1c5fe423..487252ae81 100644
--- a/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.tsx
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useMemo } from "react";
-import { Alert, Button, Group, Loader, Stack, Text } from "@mantine/core";
+import { Alert, Group, Loader, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import type { GetPdfInfoOperationHook } from "@app/hooks/tools/getPdfInfo/useGetPdfInfoOperation";
 import { downloadFile } from "@app/services/downloadService";
@@ -72,7 +73,6 @@ const GetPdfInfoResults = ({
           {t("getPdfInfo.downloads", "Downloads")}
         </Text>
         <Button
-          color="blue"
           onClick={() => selectedFile && handleDownload(selectedFile)}
           disabled={!selectedFile}
           fullWidth
diff --git a/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
index 5a7e8c994f..61300fbb68 100644
--- a/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
+++ b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
@@ -1,5 +1,7 @@
 import React, { useState } from "react";
-import { Group, Button, Text, ActionIcon, Stack, Select } from "@mantine/core";
+import { Group, Text, Stack, Select } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import SortIcon from "@mui/icons-material/Sort";
 import ArrowUpwardIcon from "@mui/icons-material/ArrowUpward";
@@ -67,7 +69,7 @@ const MergeFileSorter: React.FC<MergeFileSorterProps> = ({
           />
 
           <ActionIcon
-            variant="light"
+            variant="secondary"
             size="md"
             onClick={handleDirectionToggle}
             disabled={disabled}
@@ -76,14 +78,19 @@ const MergeFileSorter: React.FC<MergeFileSorterProps> = ({
                 ? t("merge.sortBy.ascending", "Ascending")
                 : t("merge.sortBy.descending", "Descending")
             }
+            aria-label={
+              ascending
+                ? t("merge.sortBy.ascending", "Ascending")
+                : t("merge.sortBy.descending", "Descending")
+            }
           >
             {ascending ? <ArrowUpwardIcon /> : <ArrowDownwardIcon />}
           </ActionIcon>
         </Group>
 
         <Button
-          variant="light"
-          size="xs"
+          variant="secondary"
+          size="sm"
           leftSection={<SortIcon />}
           onClick={handleSort}
           disabled={disabled}
diff --git a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
index ce059c9204..2648990248 100644
--- a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
+++ b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
@@ -3,12 +3,12 @@ import {
   Text,
   Group,
   Select,
-  SegmentedControl,
   NumberInput,
-  Button,
-  ActionIcon,
   Divider,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import {
   type OverlayPdfsParameters,
@@ -121,17 +121,18 @@ export default function OverlayPdfsSettings({
           onChange={(v) =>
             onParameterChange("overlayPosition", (v === "1" ? 1 : 0) as 0 | 1)
           }
-          data={[
+          options={[
             {
               label: t("overlay-pdfs.position.foreground", "Foreground"),
               value: "0",
+              disabled,
             },
             {
               label: t("overlay-pdfs.position.background", "Background"),
               value: "1",
+              disabled,
             },
           ]}
-          disabled={disabled}
         />
       </Stack>
 
@@ -183,8 +184,7 @@ export default function OverlayPdfsSettings({
           {t("overlay-pdfs.overlayFiles.label", "Overlay Files")}
         </Text>
         <Button
-          size="xs"
-          color="blue"
+          size="sm"
           onClick={handleOpenOverlayFilesModal}
           disabled={disabled}
           leftSection={<LocalIcon icon="add" width="14" height="14" />}
@@ -219,8 +219,8 @@ export default function OverlayPdfsSettings({
                       </Group>
                       <ActionIcon
                         size="sm"
-                        variant="subtle"
-                        color="red"
+                        variant="tertiary"
+                        accent="danger"
                         className={styles.removeButton}
                         onClick={() => {
                           const next = (parameters.overlayFiles || []).filter(
@@ -229,6 +229,7 @@ export default function OverlayPdfsSettings({
                           handleOverlayFilesChange(next);
                         }}
                         disabled={disabled}
+                        aria-label={t("remove", "Remove")}
                       >
                         <LocalIcon
                           icon="close-rounded"
diff --git a/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorSidebar.tsx b/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorSidebar.tsx
index 168d5ffced..1892aaa7f3 100644
--- a/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorSidebar.tsx
+++ b/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorSidebar.tsx
@@ -1,19 +1,19 @@
 import React, { useCallback, useMemo, useState } from "react";
 import {
-  ActionIcon,
   Badge,
-  Button,
   Divider,
   Flex,
   Group,
   Menu,
   Modal,
   ScrollArea,
-  SegmentedControl,
   Stack,
   Switch,
   Text,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import AutorenewIcon from "@mui/icons-material/Autorenew";
 import InfoOutlinedIcon from "@mui/icons-material/InfoOutlined";
@@ -148,7 +148,11 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
                   header={pdfTextEditorTips.header}
                   pinOnClick
                 >
-                  <ActionIcon variant="subtle" color="blue" size="sm">
+                  <ActionIcon
+                    variant="tertiary"
+                    size="sm"
+                    aria-label={t("pdfTextEditor.title", "PDF Text Editor")}
+                  >
                     <LocalIcon
                       icon="info-outline-rounded"
                       width="1.25rem"
@@ -194,9 +198,12 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
                       position="top"
                     >
                       <ActionIcon
-                        variant="subtle"
-                        color="gray"
+                        variant="tertiary"
                         size="sm"
+                        aria-label={t(
+                          "pdfTextEditor.options.autoScaleText.title",
+                          "Auto-scale text to fit boxes",
+                        )}
                         style={{ flexShrink: 0 }}
                       >
                         <InfoOutlinedIcon fontSize="small" />
@@ -275,7 +282,7 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
                     onChange={(value) =>
                       handleModeChangeRequest(value as GroupingMode)
                     }
-                    data={[
+                    options={[
                       {
                         label: t("pdfTextEditor.groupingMode.auto", "Auto"),
                         value: "auto",
@@ -316,9 +323,12 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
                       position="top"
                     >
                       <ActionIcon
-                        variant="subtle"
-                        color="gray"
+                        variant="tertiary"
                         size="sm"
+                        aria-label={t(
+                          "pdfTextEditor.options.forceSingleElement.title",
+                          "Lock edited text to a single PDF element",
+                        )}
                         style={{ flexShrink: 0 }}
                       >
                         <InfoOutlinedIcon fontSize="small" />
@@ -357,7 +367,6 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
 
         <Group gap="xs" wrap="nowrap" p="md">
           <Button
-            variant="filled"
             onClick={onSaveToWorkbench}
             loading={isSavingToWorkbench}
             disabled={!hasDocument || !hasChanges || isConverting}
@@ -368,9 +377,13 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
           <Menu position="bottom-end" withinPortal>
             <Menu.Target>
               <ActionIcon
-                variant="default"
+                variant="secondary"
                 size="lg"
                 disabled={!hasDocument || isConverting}
+                aria-label={t(
+                  "pdfTextEditor.actions.moreOptions",
+                  "More options",
+                )}
               >
                 <MoreHorizIcon fontSize="small" />
               </ActionIcon>
@@ -410,10 +423,10 @@ const PdfTextEditorSidebar = ({ data }: PdfTextEditorSidebarProps) => {
             )}
           </Text>
           <Group justify="flex-end" gap="sm">
-            <Button variant="default" onClick={handleCancelModeChange}>
+            <Button variant="secondary" onClick={handleCancelModeChange}>
               {t("pdfTextEditor.modeChange.cancel", "Cancel")}
             </Button>
-            <Button color="red" onClick={handleConfirmModeChange}>
+            <Button accent="danger" onClick={handleConfirmModeChange}>
               {t("pdfTextEditor.modeChange.confirm", "Reset and Change Mode")}
             </Button>
           </Group>
diff --git a/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorView.tsx b/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorView.tsx
index cc6389845a..0cbd88e619 100644
--- a/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorView.tsx
+++ b/frontend/editor/src/core/components/tools/pdfTextEditor/PdfTextEditorView.tsx
@@ -7,11 +7,9 @@ import React, {
   useState,
 } from "react";
 import {
-  ActionIcon,
   Alert,
   Badge,
   Box,
-  Button,
   Card,
   Divider,
   Group,
@@ -24,6 +22,8 @@ import {
   Text,
   Tooltip,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Dropzone } from "@mantine/dropzone";
 import { useTranslation } from "react-i18next";
 import AutorenewIcon from "@mui/icons-material/Autorenew";
@@ -1553,10 +1553,10 @@ const PdfTextEditorView = ({ data }: PdfTextEditorViewProps) => {
       {resizeHandle}
       {activeGroupId === groupId && (
         <ActionIcon
-          size="xs"
-          variant="filled"
-          color="red"
-          radius="xl"
+          aria-label={t("pdfTextEditor.actions.clearText", "Clear text")}
+          size="sm"
+          variant="tertiary"
+          accent="danger"
           style={{
             position: "absolute",
             top: -8,
@@ -2008,7 +2008,7 @@ const PdfTextEditorView = ({ data }: PdfTextEditorViewProps) => {
                 </Text>
                 <Group justify="flex-end" gap="sm" mt="xs">
                   <Button
-                    variant="default"
+                    variant="secondary"
                     onClick={handleDismissWelcomeBanner}
                   >
                     {t("pdfTextEditor.welcomeBanner.gotIt", "Got it")}
@@ -2126,8 +2126,7 @@ const PdfTextEditorView = ({ data }: PdfTextEditorViewProps) => {
                           >
                             <ActionIcon
                               size="sm"
-                              variant="light"
-                              color="blue"
+                              variant="secondary"
                               aria-label={t(
                                 "pdfTextEditor.manual.merge",
                                 "Merge selection",
@@ -2147,8 +2146,7 @@ const PdfTextEditorView = ({ data }: PdfTextEditorViewProps) => {
                           >
                             <ActionIcon
                               size="sm"
-                              variant="light"
-                              color="blue"
+                              variant="secondary"
                               aria-label={t(
                                 "pdfTextEditor.manual.ungroup",
                                 "Ungroup selection",
@@ -2168,8 +2166,7 @@ const PdfTextEditorView = ({ data }: PdfTextEditorViewProps) => {
                           <Menu.Target>
                             <ActionIcon
                               size="sm"
-                              variant="light"
-                              color="blue"
+                              variant="secondary"
                               aria-label={t(
                                 "pdfTextEditor.manual.widthMenu",
                                 "Width options",
diff --git a/frontend/editor/src/core/components/tools/redact/ManualRedactionControls.tsx b/frontend/editor/src/core/components/tools/redact/ManualRedactionControls.tsx
index 867fac3399..49dc3b1da9 100644
--- a/frontend/editor/src/core/components/tools/redact/ManualRedactionControls.tsx
+++ b/frontend/editor/src/core/components/tools/redact/ManualRedactionControls.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
 import { useEffect, useRef, useCallback } from "react";
-import { Button, Stack, Text, Divider, ColorInput } from "@mantine/core";
+import { Stack, Text, Divider, ColorInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useRedaction, useRedactionMode } from "@app/contexts/RedactionContext";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useSignature } from "@app/contexts/SignatureContext";
@@ -154,10 +155,7 @@ export default function ManualRedactionControls({
         <Button
           fullWidth
           size="md"
-          radius="md"
-          mt="sm"
-          variant="filled"
-          color="blue"
+          style={{ marginTop: "0.75rem" }}
           disabled={!hasUnsavedChanges}
           onClick={handleSaveChanges}
         >
diff --git a/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.test.tsx b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.test.tsx
index fa320edeff..7f57b8299e 100644
--- a/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.test.tsx
+++ b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.test.tsx
@@ -34,10 +34,9 @@ describe("RedactSingleStepSettings", () => {
     );
 
     expect(screen.getByText("Mode")).toBeInTheDocument();
-    expect(
-      screen.getByRole("button", { name: "Automatic" }),
-    ).toBeInTheDocument();
-    expect(screen.getByRole("button", { name: "Manual" })).toBeInTheDocument();
+    // Mode selector renders as a radio-group (shared SegmentedControl)
+    expect(screen.getByText("Automatic")).toBeInTheDocument();
+    expect(screen.getByText("Manual")).toBeInTheDocument();
   });
 
   test("should render automatic mode settings when mode is automatic", () => {
@@ -126,7 +125,7 @@ describe("RedactSingleStepSettings", () => {
   });
 
   test("should disable all controls when disabled prop is true", () => {
-    render(
+    const { container } = render(
       <TestWrapper>
         <RedactSingleStepSettings
           parameters={defaultParameters}
@@ -136,9 +135,14 @@ describe("RedactSingleStepSettings", () => {
       </TestWrapper>,
     );
 
-    // Mode selector buttons should be disabled
-    expect(screen.getByRole("button", { name: "Automatic" })).toBeDisabled();
-    expect(screen.getByRole("button", { name: "Manual" })).toBeDisabled();
+    // Mode selector renders as radio inputs (shared SegmentedControl); both
+    // radios should be disabled when the control is disabled.
+    expect(
+      container.querySelector('input[type="radio"][value="automatic"]'),
+    ).toBeDisabled();
+    expect(
+      container.querySelector('input[type="radio"][value="manual"]'),
+    ).toBeDisabled();
 
     // Automatic settings controls should be disabled
     expect(screen.getByPlaceholderText("Enter a word")).toBeDisabled();
diff --git a/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.tsx b/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.tsx
index db346bd4ec..018a04a2b7 100644
--- a/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.tsx
+++ b/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.tsx
@@ -1,13 +1,8 @@
 import React, { useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Stack,
-  Text,
-  TextInput,
-  Button,
-  Group,
-  ActionIcon,
-} from "@mantine/core";
+import { Stack, Text, TextInput, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 interface WordsToRedactInputProps {
   wordsToRedact: string[];
@@ -73,10 +68,11 @@ export default function WordsToRedactInput({
           </Text>
           <ActionIcon
             size="sm"
-            variant="subtle"
-            color="red"
+            variant="tertiary"
+            accent="danger"
             onClick={() => removeWord(index)}
             disabled={disabled}
+            aria-label={t("remove", "Remove")}
           >
             ×
           </ActionIcon>
@@ -99,7 +95,7 @@ export default function WordsToRedactInput({
         />
         <Button
           size="sm"
-          variant="light"
+          variant="secondary"
           onClick={addWord}
           disabled={disabled || !currentWord.trim()}
         >
diff --git a/frontend/editor/src/core/components/tools/rotate/RotateSettings.tsx b/frontend/editor/src/core/components/tools/rotate/RotateSettings.tsx
index cae25c5a65..ba66790298 100644
--- a/frontend/editor/src/core/components/tools/rotate/RotateSettings.tsx
+++ b/frontend/editor/src/core/components/tools/rotate/RotateSettings.tsx
@@ -1,5 +1,6 @@
 import { useMemo, useState, useEffect } from "react";
-import { Stack, Text, Box, ActionIcon, Group, Center } from "@mantine/core";
+import { Stack, Text, Box, Group, Center } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import RotateLeftIcon from "@mui/icons-material/RotateLeft";
 import RotateRightIcon from "@mui/icons-material/RotateRight";
@@ -94,8 +95,8 @@ const RotateSettings = ({
       {/* Rotation Controls */}
       <Group justify="center" gap="lg">
         <ActionIcon
-          size="xl"
-          variant="outline"
+          size="lg"
+          variant="secondary"
           onClick={parameters.rotateAnticlockwise}
           disabled={disabled}
           aria-label={t("rotate.rotateLeft", "Rotate Anticlockwise")}
@@ -105,8 +106,8 @@ const RotateSettings = ({
         </ActionIcon>
 
         <ActionIcon
-          size="xl"
-          variant="outline"
+          size="lg"
+          variant="secondary"
           onClick={parameters.rotateClockwise}
           disabled={disabled}
           aria-label={t("rotate.rotateRight", "Rotate Clockwise")}
diff --git a/frontend/editor/src/core/components/tools/shared/NavigationControls.tsx b/frontend/editor/src/core/components/tools/shared/NavigationControls.tsx
index c17e61f252..0692907f17 100644
--- a/frontend/editor/src/core/components/tools/shared/NavigationControls.tsx
+++ b/frontend/editor/src/core/components/tools/shared/NavigationControls.tsx
@@ -1,6 +1,8 @@
-import { Stack, Group, ActionIcon, Text } from "@mantine/core";
+import { Stack, Group, Text } from "@mantine/core";
+import { useTranslation } from "react-i18next";
 import ChevronLeftIcon from "@mui/icons-material/ChevronLeft";
 import ChevronRightIcon from "@mui/icons-material/ChevronRight";
+import { ActionIcon } from "@app/ui/ActionIcon";
 
 export interface NavigationControlsProps {
   currentIndex: number;
@@ -15,13 +17,15 @@ const NavigationControls = ({
   onPrevious,
   onNext,
 }: NavigationControlsProps) => {
+  const { t } = useTranslation();
   if (totalFiles <= 1) return null;
 
   return (
     <Stack align="center" gap="xs" mt="xs">
       <Group justify="center" gap="xs">
         <ActionIcon
-          variant="light"
+          aria-label={t("common.previous", "Previous")}
+          variant="secondary"
           size="sm"
           onClick={onPrevious}
           disabled={totalFiles <= 1}
@@ -34,7 +38,8 @@ const NavigationControls = ({
         </Text>
 
         <ActionIcon
-          variant="light"
+          aria-label={t("common.next", "Next")}
+          variant="secondary"
           size="sm"
           onClick={onNext}
           disabled={totalFiles <= 1}
diff --git a/frontend/editor/src/core/components/tools/shared/OperationButton.tsx b/frontend/editor/src/core/components/tools/shared/OperationButton.tsx
index afe56a5d1c..9da4f03170 100644
--- a/frontend/editor/src/core/components/tools/shared/OperationButton.tsx
+++ b/frontend/editor/src/core/components/tools/shared/OperationButton.tsx
@@ -1,5 +1,6 @@
-import { Button, Box } from "@mantine/core";
+import { Box } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button, type ButtonVariant, type ButtonAccent } from "@app/ui/Button";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import { useBackendHealth } from "@app/hooks/useBackendHealth";
 import { CloudBadge } from "@app/components/shared/CloudBadge";
@@ -23,6 +24,26 @@ export interface OperationButtonProps {
   "data-tour"?: string;
 }
 
+export const operationButtonVariantMap: Record<
+  NonNullable<OperationButtonProps["variant"]>,
+  ButtonVariant
+> = {
+  filled: "primary",
+  outline: "secondary",
+  subtle: "tertiary",
+};
+
+export const operationButtonAccentMap: Record<string, ButtonAccent> = {
+  gray: "neutral",
+  grey: "neutral",
+  blue: "default",
+  red: "danger",
+  green: "success",
+  yellow: "warning",
+  violet: "premium",
+  grape: "premium",
+};
+
 const OperationButton = ({
   onClick,
   isLoading = false,
@@ -77,31 +98,29 @@ const OperationButton = ({
       ? (reasonTooltip[disabledReason] ?? null)
       : null;
 
+  const sharedVariant: ButtonVariant =
+    operationButtonVariantMap[variant] ?? "primary";
+  const sharedAccent: ButtonAccent =
+    operationButtonAccentMap[color] ?? "default";
+
   const button = (
     <Button
       type={type}
       onClick={onClick}
       fullWidth={fullWidth || !!tooltipLabel}
-      mr={tooltipLabel ? 0 : "md"}
-      ml={tooltipLabel ? 0 : "md"}
-      mt={tooltipLabel ? 0 : mt}
       loading={isLoading}
       disabled={combinedDisabled}
-      variant={variant}
-      color={color}
+      variant={sharedVariant}
+      accent={sharedAccent}
       data-testid={dataTestId}
       data-tour={dataTour}
-      style={{ minHeight: "2.5rem", height: "auto", position: "relative" }}
-      styles={{
-        label: {
-          whiteSpace: "normal",
-          textAlign: "center",
-          lineHeight: 1.2,
-        },
-        inner: {
-          paddingTop: "0.25rem",
-          paddingBottom: "0.25rem",
-        },
+      style={{
+        minHeight: "2.5rem",
+        height: "auto",
+        position: "relative",
+        marginLeft: tooltipLabel ? 0 : "1rem",
+        marginRight: tooltipLabel ? 0 : "1rem",
+        marginTop: tooltipLabel ? 0 : `var(--mantine-spacing-${mt})`,
       }}
     >
       {isLoading
diff --git a/frontend/editor/src/core/components/tools/shared/ReviewToolStep.tsx b/frontend/editor/src/core/components/tools/shared/ReviewToolStep.tsx
index 82e936678e..8c89029913 100644
--- a/frontend/editor/src/core/components/tools/shared/ReviewToolStep.tsx
+++ b/frontend/editor/src/core/components/tools/shared/ReviewToolStep.tsx
@@ -1,6 +1,7 @@
 import React, { useEffect, useRef } from "react";
-import { Button, Stack } from "@mantine/core";
+import { Stack } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import UndoIcon from "@mui/icons-material/Undo";
 import ErrorNotification from "@app/components/tools/shared/ErrorNotification";
 import ResultsPreview from "@app/components/tools/shared/ResultsPreview";
@@ -128,8 +129,8 @@ function ReviewStepContent<TParams = unknown>({
         >
           <Button
             leftSection={<UndoIcon />}
-            variant="outline"
-            color="var(--mantine-color-gray-6)"
+            variant="secondary"
+            accent="neutral"
             onClick={handleUndo}
             fullWidth
           >
@@ -141,9 +142,8 @@ function ReviewStepContent<TParams = unknown>({
         <Button
           data-testid="download-result-button"
           leftSection={<DownloadIcon />}
-          color="blue"
           fullWidth
-          mb="md"
+          style={{ marginBottom: "1rem" }}
           onClick={handleDownload}
         >
           {terminology.download}
diff --git a/frontend/editor/src/core/components/tools/shared/ScopedOperationButton.tsx b/frontend/editor/src/core/components/tools/shared/ScopedOperationButton.tsx
index 1761c91e4b..0dd351e95e 100644
--- a/frontend/editor/src/core/components/tools/shared/ScopedOperationButton.tsx
+++ b/frontend/editor/src/core/components/tools/shared/ScopedOperationButton.tsx
@@ -1,7 +1,10 @@
-import { Text, Box, Button } from "@mantine/core";
+import { Text, Box } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button, type ButtonVariant, type ButtonAccent } from "@app/ui/Button";
 import OperationButton, {
   OperationButtonProps,
+  operationButtonVariantMap,
+  operationButtonAccentMap,
 } from "@app/components/tools/shared/OperationButton";
 import { StirlingFile } from "@app/types/fileContext";
 import { useAllFiles } from "@app/contexts/FileContext";
@@ -73,6 +76,11 @@ export function ScopedOperationButton({
     allFiles.length > 0 &&
     selectedFiles.length === 0;
 
+  const loadingVariant: ButtonVariant =
+    operationButtonVariantMap[props.variant ?? "filled"] ?? "primary";
+  const loadingAccent: ButtonAccent =
+    operationButtonAccentMap[props.color ?? "blue"] ?? "default";
+
   return (
     <>
       {isFilesHydrating ? (
@@ -81,8 +89,8 @@ export function ScopedOperationButton({
             fullWidth
             disabled
             loading={!isBulkLoading}
-            variant={props.variant ?? "filled"}
-            color={props.color ?? "blue"}
+            variant={loadingVariant}
+            accent={loadingAccent}
             style={{
               position: "relative",
               overflow: "hidden",
diff --git a/frontend/editor/src/core/components/tools/showJS/ShowJSView.tsx b/frontend/editor/src/core/components/tools/showJS/ShowJSView.tsx
index 6585b1cddf..685d238e79 100644
--- a/frontend/editor/src/core/components/tools/showJS/ShowJSView.tsx
+++ b/frontend/editor/src/core/components/tools/showJS/ShowJSView.tsx
@@ -5,16 +5,9 @@ import React, {
   useRef,
   useState,
 } from "react";
-import {
-  ActionIcon,
-  Box,
-  Button,
-  Group,
-  Stack,
-  Text,
-  ScrollArea,
-  TextInput,
-} from "@mantine/core";
+import { Box, Group, Stack, Text, ScrollArea, TextInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ContentCopyRoundedIcon from "@mui/icons-material/ContentCopyRounded";
 import ArrowUpwardRoundedIcon from "@mui/icons-material/ArrowUpwardRounded";
 import ArrowDownwardRoundedIcon from "@mui/icons-material/ArrowDownwardRounded";
@@ -168,7 +161,7 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
             </Text>
             <ActionIcon
               size="sm"
-              variant="subtle"
+              variant="tertiary"
               onClick={() => {
                 if (matches.length)
                   setActive((p) => (p - 1 + matches.length) % matches.length);
@@ -179,7 +172,7 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
             </ActionIcon>
             <ActionIcon
               size="sm"
-              variant="subtle"
+              variant="tertiary"
               onClick={() => {
                 if (matches.length) setActive((p) => (p + 1) % matches.length);
               }}
@@ -190,8 +183,8 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
           </Group>
           <Group gap="xs" align="center" className="showjs-toolbar-controls">
             <Button
-              size="xs"
-              variant="subtle"
+              variant="tertiary"
+              size="sm"
               className="showjs-outline-button"
               onClick={handleDownload}
               disabled={!downloadUrl}
@@ -200,8 +193,8 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
               {terminology.download}
             </Button>
             <Button
-              size="xs"
-              variant="subtle"
+              variant="tertiary"
+              size="sm"
               className="showjs-outline-button"
               onClick={handleCopy}
               leftSection={<ContentCopyRoundedIcon fontSize="small" />}
@@ -321,7 +314,8 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
                   >
                     <div className="code-gutter">
                       {end != null ? (
-                        <button
+                        <Button
+                          variant="tertiary"
                           className={`fold-toggle ${folded ? "fold-collapsed" : ""}`}
                           onClick={() => toggleFold(ln)}
                           aria-label={
@@ -331,7 +325,7 @@ const ShowJSView: React.FC<ShowJSViewProps> = ({ data }) => {
                           }
                         >
                           {folded ? "▸" : "▾"}
-                        </button>
+                        </Button>
                       ) : (
                         <span className="fold-placeholder" />
                       )}
diff --git a/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.tsx b/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.tsx
index 8b40b8721a..50cc3d2fe2 100644
--- a/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.tsx
+++ b/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.tsx
@@ -1,7 +1,6 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ActionIcon,
   Alert,
   Badge,
   Box,
@@ -13,6 +12,7 @@ import {
   Tooltip,
 } from "@mantine/core";
 import { LocalIcon } from "@app/components/shared/LocalIcon";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import {
   SavedSignature,
   SavedSignatureType,
@@ -301,7 +301,7 @@ export const SavedSignaturesSection = ({
                 </Text>
                 <Group gap={4}>
                   <ActionIcon
-                    variant="light"
+                    variant="secondary"
                     aria-label={translate("saved.prev", "Previous")}
                     onClick={() =>
                       setActivePersonalIndex((prev) => Math.max(0, prev - 1))
@@ -315,7 +315,7 @@ export const SavedSignaturesSection = ({
                     />
                   </ActionIcon>
                   <ActionIcon
-                    variant="light"
+                    variant="secondary"
                     aria-label={translate("saved.next", "Next")}
                     onClick={() =>
                       setActivePersonalIndex((prev) =>
@@ -351,8 +351,7 @@ export const SavedSignaturesSection = ({
                     </Badge>
                     <Group gap="xs">
                       <ActionIcon
-                        variant="subtle"
-                        color="blue"
+                        variant="tertiary"
                         aria-label={t("sign.saved.use", "Use signature")}
                         onClick={() => onUseSignature(activePersonalSignature)}
                         disabled={disabled}
@@ -365,8 +364,8 @@ export const SavedSignaturesSection = ({
                       </ActionIcon>
                       <Tooltip label={translate("saved.delete", "Remove")}>
                         <ActionIcon
-                          variant="subtle"
-                          color="red"
+                          variant="tertiary"
+                          accent="danger"
                           aria-label={translate("saved.delete", "Remove")}
                           onClick={() =>
                             onDeleteSignature(activePersonalSignature)
@@ -432,7 +431,7 @@ export const SavedSignaturesSection = ({
                 </Text>
                 <Group gap={4}>
                   <ActionIcon
-                    variant="light"
+                    variant="secondary"
                     aria-label={translate("saved.prev", "Previous")}
                     onClick={() =>
                       setActiveSharedIndex((prev) => Math.max(0, prev - 1))
@@ -446,7 +445,7 @@ export const SavedSignaturesSection = ({
                     />
                   </ActionIcon>
                   <ActionIcon
-                    variant="light"
+                    variant="secondary"
                     aria-label={translate("saved.next", "Next")}
                     onClick={() =>
                       setActiveSharedIndex((prev) =>
@@ -478,8 +477,7 @@ export const SavedSignaturesSection = ({
                     </Badge>
                     <Group gap="xs">
                       <ActionIcon
-                        variant="subtle"
-                        color="blue"
+                        variant="tertiary"
                         aria-label={t("sign.saved.use", "Use signature")}
                         onClick={() => onUseSignature(activeSharedSignature)}
                         disabled={disabled}
@@ -493,8 +491,8 @@ export const SavedSignaturesSection = ({
                       {isAdmin && (
                         <Tooltip label={translate("saved.delete", "Remove")}>
                           <ActionIcon
-                            variant="subtle"
-                            color="red"
+                            variant="tertiary"
+                            accent="danger"
                             aria-label={translate("saved.delete", "Remove")}
                             onClick={() =>
                               onDeleteSignature(activeSharedSignature)
@@ -564,7 +562,7 @@ export const SavedSignaturesSection = ({
                   </Text>
                   <Group gap={4}>
                     <ActionIcon
-                      variant="light"
+                      variant="secondary"
                       aria-label={translate("saved.prev", "Previous")}
                       onClick={() =>
                         setActiveLocalStorageIndex((prev) =>
@@ -580,7 +578,7 @@ export const SavedSignaturesSection = ({
                       />
                     </ActionIcon>
                     <ActionIcon
-                      variant="light"
+                      variant="secondary"
                       aria-label={translate("saved.next", "Next")}
                       onClick={() =>
                         setActiveLocalStorageIndex((prev) =>
@@ -616,8 +614,7 @@ export const SavedSignaturesSection = ({
                       </Badge>
                       <Group gap="xs">
                         <ActionIcon
-                          variant="subtle"
-                          color="blue"
+                          variant="tertiary"
                           aria-label={t("sign.saved.use", "Use signature")}
                           onClick={() =>
                             onUseSignature(activeLocalStorageSignature)
@@ -632,8 +629,8 @@ export const SavedSignaturesSection = ({
                         </ActionIcon>
                         <Tooltip label={translate("saved.delete", "Remove")}>
                           <ActionIcon
-                            variant="subtle"
-                            color="red"
+                            variant="tertiary"
+                            accent="danger"
                             aria-label={translate("saved.delete", "Remove")}
                             onClick={() =>
                               onDeleteSignature(activeLocalStorageSignature)
diff --git a/frontend/editor/src/core/components/tools/sign/SignSettings.tsx b/frontend/editor/src/core/components/tools/sign/SignSettings.tsx
index de7a410b0d..648ada1c47 100644
--- a/frontend/editor/src/core/components/tools/sign/SignSettings.tsx
+++ b/frontend/editor/src/core/components/tools/sign/SignSettings.tsx
@@ -2,16 +2,15 @@
 import { useTranslation } from "react-i18next";
 import {
   Stack,
-  Button,
   Text,
   Alert,
-  SegmentedControl,
   Divider,
-  ActionIcon,
   Tooltip,
   Group,
   Box,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { SignParameters } from "@app/hooks/tools/sign/useSignParameters";
 import { useSignature } from "@app/contexts/SignatureContext";
 import { useViewer } from "@app/contexts/ViewerContext";
@@ -437,9 +436,9 @@ const SignSettings = ({
 
     const button = (
       <Button
-        size="xs"
-        variant="outline"
-        color={isSaved ? "green" : undefined}
+        size="sm"
+        variant="secondary"
+        accent={isSaved ? "success" : undefined}
         onClick={() => onClick(scope)}
         disabled={
           !isReady || disabled || isSavedSignatureLimitReached || !hasChanges
@@ -1122,49 +1121,33 @@ const SignSettings = ({
     onActivateSignaturePlacement || onDeactivateSignature ? (
       isPlacementMode ? (
         <Tooltip label={translate("mode.pause", "Pause placement")}>
-          <ActionIcon
-            variant="default"
-            size="lg"
+          <Button
+            variant="secondary"
             aria-label={translate("mode.pause", "Pause placement")}
             onClick={handlePausePlacement}
             disabled={disabled || !onDeactivateSignature}
-            style={{
-              width: "auto",
-              paddingInline: "0.75rem",
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-            }}
+            leftSection={
+              <LocalIcon icon="pause-circle-rounded" width={20} height={20} />
+            }
           >
-            <LocalIcon icon="pause-circle-rounded" width={20} height={20} />
-            <Text component="span" size="sm" fw={500}>
-              {translate("mode.pause", "Pause placement")}
-            </Text>
-          </ActionIcon>
+            {translate("mode.pause", "Pause placement")}
+          </Button>
         </Tooltip>
       ) : (
         <Tooltip label={translate("mode.resume", "Resume placement")}>
-          <ActionIcon
-            variant="default"
-            size="lg"
+          <Button
+            variant="secondary"
             aria-label={translate("mode.resume", "Resume placement")}
             onClick={handleResumePlacement}
             disabled={
               disabled || !isCurrentTypeReady || !onActivateSignaturePlacement
             }
-            style={{
-              width: "auto",
-              paddingInline: "0.75rem",
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-            }}
+            leftSection={
+              <LocalIcon icon="play-arrow-rounded" width={20} height={20} />
+            }
           >
-            <LocalIcon icon="play-arrow-rounded" width={20} height={20} />
-            <Text component="span" size="sm" fw={500}>
-              {translate("mode.resume", "Resume placement")}
-            </Text>
-          </ActionIcon>
+            {translate("mode.resume", "Resume placement")}
+          </Button>
         </Tooltip>
       )
     ) : null;
@@ -1185,7 +1168,7 @@ const SignSettings = ({
             onChange={(value) =>
               handleSignatureSourceChange(value as SignatureSource)
             }
-            data={sourceOptions}
+            options={sourceOptions}
           />
         )}
         {renderSignatureBuilder()}
@@ -1228,7 +1211,7 @@ const SignSettings = ({
       />
 
       {onSave && (
-        <Button onClick={onSave} color="blue" variant="filled" fullWidth>
+        <Button onClick={onSave} fullWidth>
           {translate("applySignatures", "Apply Signatures")}
         </Button>
       )}
diff --git a/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.tsx b/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.tsx
index d951951421..10bd556df9 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.tsx
+++ b/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.tsx
@@ -1,31 +1,38 @@
 import React from "react";
-import { ActionIcon } from "@mantine/core";
-import type { MantineSize } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import StarRoundedIcon from "@mui/icons-material/StarRounded";
 import StarBorderRoundedIcon from "@mui/icons-material/StarBorderRounded";
-
+import { ActionIcon } from "@app/ui/ActionIcon";
+import type { ActionIconSize } from "@app/ui/ActionIcon";
+type FavoriteStarSize = "xs" | ActionIconSize;
+const SIZE_MAP: Record<FavoriteStarSize, ActionIconSize> = {
+  xs: "sm",
+  sm: "sm",
+  md: "md",
+  lg: "lg",
+  xl: "xl",
+};
 interface FavoriteStarProps {
   isFavorite: boolean;
   onToggle: () => void;
   className?: string;
-  size?: MantineSize;
+  size?: FavoriteStarSize;
 }
 
 const FavoriteStar: React.FC<FavoriteStarProps> = ({
   isFavorite,
   onToggle,
   className,
-  size = "xs",
+  size = "sm",
 }) => {
   const { t } = useTranslation();
 
   return (
     <ActionIcon
-      component="span"
-      variant="subtle"
-      radius="xl"
-      size={size}
+      as="span"
+      variant="tertiary"
+      shape="circle"
+      size={SIZE_MAP[size]}
       onClick={(e: React.MouseEvent) => {
         e.stopPropagation();
         onToggle();
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolButton.tsx b/frontend/editor/src/core/components/tools/toolPicker/ToolButton.tsx
index e184ae6d58..efbe3bb2cb 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/ToolButton.tsx
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolButton.tsx
@@ -1,5 +1,6 @@
 import React, { memo } from "react";
-import { Button, Badge } from "@mantine/core";
+import { Badge } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import { ToolIcon } from "@app/components/shared/ToolIcon";
@@ -143,84 +144,83 @@ const ToolButton: React.FC<ToolButtonProps> = ({
       </div>
     </div>
   );
-
+  const buttonIcon = (
+    <ToolIcon icon={tool.icon} opacity={visuallyUnavailable ? 0.25 : 1} />
+  );
   const buttonContent = (
-    <>
-      <ToolIcon icon={tool.icon} opacity={visuallyUnavailable ? 0.25 : 1} />
+    <div
+      style={{
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "flex-start",
+        flex: 1,
+        overflow: "visible",
+      }}
+    >
       <div
         style={{
           display: "flex",
-          flexDirection: "column",
-          alignItems: "flex-start",
-          flex: 1,
-          overflow: "visible",
+          alignItems: "center",
+          gap: "0.5rem",
+          width: "100%",
         }}
       >
-        <div
+        <FitText
+          text={tool.name}
+          lines={1}
+          minimumFontScale={0.8}
+          as="span"
           style={{
-            display: "flex",
-            alignItems: "center",
-            gap: "0.5rem",
-            width: "100%",
+            display: "inline-block",
+            maxWidth: "100%",
+            opacity: visuallyUnavailable ? 0.25 : 1,
+          }}
+        />
+        {tool.versionStatus === "alpha" && (
+          <Badge
+            size="xs"
+            variant="light"
+            color="orange"
+            style={{ flexShrink: 0, opacity: visuallyUnavailable ? 0.25 : 1 }}
+          >
+            {t("toolPanel.alpha", "Alpha")}
+          </Badge>
+        )}
+        {typeof badgeCount === "number" && badgeCount > 0 && (
+          <Badge
+            size="sm"
+            variant="filled"
+            color="red"
+            style={{ flexShrink: 0 }}
+          >
+            {badgeCount}
+          </Badge>
+        )}
+        {usesCloud && !visuallyUnavailable && <CloudBadge />}
+      </div>
+      {showDescription && tool.description && (
+        <span
+          className="tool-button__description"
+          style={{ opacity: visuallyUnavailable ? 0.25 : 1 }}
+        >
+          {tool.description}
+        </span>
+      )}
+      {matchedSynonym && (
+        <span
+          style={{
+            fontSize: "0.75rem",
+            color: "var(--mantine-color-dimmed)",
+            opacity: visuallyUnavailable ? 0.25 : 1,
+            marginTop: "1px",
+            overflow: "visible",
+            whiteSpace: "nowrap",
           }}
         >
-          <FitText
-            text={tool.name}
-            lines={1}
-            minimumFontScale={0.8}
-            as="span"
-            style={{
-              display: "inline-block",
-              maxWidth: "100%",
-              opacity: visuallyUnavailable ? 0.25 : 1,
-            }}
-          />
-          {tool.versionStatus === "alpha" && (
-            <Badge
-              size="xs"
-              variant="light"
-              color="orange"
-              style={{ flexShrink: 0, opacity: visuallyUnavailable ? 0.25 : 1 }}
-            >
-              {t("toolPanel.alpha", "Alpha")}
-            </Badge>
-          )}
-          {typeof badgeCount === "number" && badgeCount > 0 && (
-            <Badge
-              size="sm"
-              variant="filled"
-              color="red"
-              style={{ flexShrink: 0 }}
-            >
-              {badgeCount}
-            </Badge>
-          )}
-          {usesCloud && !visuallyUnavailable && <CloudBadge />}
-        </div>
-        {showDescription && tool.description && (
-          <span
-            className="tool-button__description"
-            style={{ opacity: visuallyUnavailable ? 0.25 : 1 }}
-          >
-            {tool.description}
-          </span>
-        )}
-        {matchedSynonym && (
-          <span
-            style={{
-              fontSize: "0.75rem",
-              color: "var(--mantine-color-dimmed)",
-              opacity: visuallyUnavailable ? 0.25 : 1,
-              marginTop: "1px",
-              overflow: "visible",
-              whiteSpace: "nowrap",
-            }}
-          >
-            {matchedSynonym}
-          </span>
-        )}
-      </div>
-    </>
+          {matchedSynonym}
+        </span>
+      )}
+    </div>
   );
 
   const handleExternalClick = (e: React.MouseEvent) => {
@@ -234,24 +234,21 @@ const ToolButton: React.FC<ToolButtonProps> = ({
   const buttonElement = navProps ? (
     // For internal tools with URLs, render Button as an anchor for proper link behavior
     <Button
-      component="a"
+      as="a"
       href={navProps.href}
       onClick={navProps.onClick}
-      variant="subtle"
+      variant="tertiary"
+      accent="neutral"
       size="sm"
-      radius="md"
       fullWidth
-      justify="flex-start"
+      justify="start"
       className="tool-button"
       data-tour={`tool-button-${id}`}
-      styles={{
-        root: {
-          borderRadius: 0,
-          color: "var(--tools-text-and-icon-color)",
-          overflow: "visible",
-          ...selectedBg,
-        },
-        label: { overflow: "visible" },
+      leftSection={buttonIcon}
+      style={{
+        borderRadius: 0,
+        overflow: "visible",
+        ...selectedBg,
       }}
     >
       {buttonContent}
@@ -259,26 +256,23 @@ const ToolButton: React.FC<ToolButtonProps> = ({
   ) : tool.link && !isUnavailable ? (
     // For external links, render Button as an anchor with proper href
     <Button
-      component="a"
+      as="a"
       href={tool.link}
       target="_blank"
       rel="noopener noreferrer"
       onClick={handleExternalClick}
-      variant="subtle"
+      variant="tertiary"
+      accent="neutral"
       size="sm"
-      radius="md"
       fullWidth
-      justify="flex-start"
+      justify="start"
       className="tool-button"
       data-tour={`tool-button-${id}`}
-      styles={{
-        root: {
-          borderRadius: 0,
-          color: "var(--tools-text-and-icon-color)",
-          overflow: "visible",
-          ...selectedBg,
-        },
-        label: { overflow: "visible" },
+      leftSection={buttonIcon}
+      style={{
+        borderRadius: 0,
+        overflow: "visible",
+        ...selectedBg,
       }}
     >
       {buttonContent}
@@ -286,23 +280,20 @@ const ToolButton: React.FC<ToolButtonProps> = ({
   ) : (
     // For unavailable tools, use regular button
     <Button
-      variant="subtle"
+      variant="tertiary"
+      accent="neutral"
       onClick={() => handleClick(id)}
       size="sm"
-      radius="md"
       fullWidth
-      justify="flex-start"
+      justify="start"
       className="tool-button"
       aria-disabled={isUnavailable}
       data-tour={`tool-button-${id}`}
-      styles={{
-        root: {
-          borderRadius: 0,
-          color: "var(--tools-text-and-icon-color)",
-          cursor: visuallyUnavailable ? "not-allowed" : undefined,
-          overflow: "visible",
-        },
-        label: { overflow: "visible" },
+      leftSection={buttonIcon}
+      style={{
+        borderRadius: 0,
+        cursor: visuallyUnavailable ? "not-allowed" : undefined,
+        overflow: "visible",
       }}
     >
       {buttonContent}
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css b/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
index 338afb095a..1a24278b4d 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
@@ -72,7 +72,7 @@
   padding-left: 0.5rem;
 }
 
-.tool-button .mantine-Button-label {
+.tool-button .sui-btn__label {
   font-size: 0.84rem;
   font-weight: 500;
   line-height: 1.2;
@@ -90,7 +90,8 @@
 
 .tool-button-star {
   position: absolute;
-  top: 0.35rem;
+  top: 50%;
+  transform: translateY(-50%);
   right: 0.35rem;
   opacity: 0;
   transition: opacity 0.2s ease;
@@ -126,7 +127,7 @@
   height: auto;
 }
 
-.tool-picker__compact .tool-button .mantine-Button-label {
+.tool-picker__compact .tool-button .sui-btn__label {
   align-items: center;
 }
 
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
index ae136c4333..66463b9005 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
@@ -1,5 +1,6 @@
 import { useState, useRef, useEffect, useMemo } from "react";
-import { Stack, Button, Text } from "@mantine/core";
+import { Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { ToolRegistryEntry } from "@app/data/toolsTaxonomy";
@@ -141,7 +142,7 @@ const ToolSearch = ({
             {filteredTools.map(({ id, tool }) => (
               <Button
                 key={id}
-                variant="subtle"
+                variant="tertiary"
                 onClick={() => {
                   onToolSelect?.(id as ToolId);
                   setDropdownOpen(false);
@@ -152,7 +153,7 @@ const ToolSearch = ({
                   </div>
                 }
                 fullWidth
-                justify="flex-start"
+                justify="start"
                 style={{
                   borderRadius: "6px",
                   color: "var(--tools-text-and-icon-color)",
diff --git a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureResults.tsx b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureResults.tsx
index e805a47636..22020ac6dc 100644
--- a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureResults.tsx
+++ b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureResults.tsx
@@ -2,14 +2,14 @@ import { useCallback, useMemo, useState } from "react";
 import {
   Alert,
   Badge,
-  Button,
   Divider,
   Group,
   Loader,
   Stack,
   Text,
-  SegmentedControl,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import type { SignatureValidationReportEntry } from "@app/types/validateSignature";
 import type { ValidateSignatureOperationHook } from "@app/hooks/tools/validateSignature/useValidateSignatureOperation";
@@ -119,10 +119,16 @@ const ValidateSignatureResults = ({
     return t("validateSignature.downloadJson", "Download JSON");
   }, [selectedType, t]);
 
-  const downloadTypeOptions = [
+  const downloadTypeOptions: {
+    label: string;
+    value: "pdf" | "csv" | "json";
+  }[] = [
     { label: t("validateSignature.downloadType.pdf", "PDF"), value: "pdf" },
     { label: t("validateSignature.downloadType.csv", "CSV"), value: "csv" },
-    { label: t("validateSignature.downloadType.json", "JSON"), value: "json" },
+    {
+      label: t("validateSignature.downloadType.json", "JSON"),
+      value: "json",
+    },
   ];
 
   const handleDownload = useCallback((file: File) => {
@@ -289,10 +295,9 @@ const ValidateSignatureResults = ({
         <SegmentedControl
           value={selectedType}
           onChange={(v) => setSelectedType(v as "pdf" | "csv" | "json")}
-          data={downloadTypeOptions}
+          options={downloadTypeOptions}
         />
         <Button
-          color="blue"
           onClick={() => selectedFile && handleDownload(selectedFile)}
           disabled={!selectedFile}
           fullWidth
diff --git a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.tsx b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.tsx
index 018afc5fea..5e865551c0 100644
--- a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.tsx
+++ b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.tsx
@@ -1,4 +1,5 @@
-import { Card, Group, Stack, Text, Button } from "@mantine/core";
+import { Card, Group, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import FileUploadButton from "@app/components/shared/FileUploadButton";
 import { ValidateSignatureParameters } from "@app/hooks/tools/validateSignature/useValidateSignatureParameters";
@@ -52,8 +53,7 @@ const ValidateSignatureSettings = ({
           />
           {certFile && (
             <Button
-              variant="subtle"
-              color="gray"
+              variant="tertiary"
               onClick={() => handleCertFileChange(null)}
               disabled={disabled}
             >
diff --git a/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.tsx b/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.tsx
index 2b6608d582..1ca0652483 100644
--- a/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.tsx
+++ b/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.tsx
@@ -1,11 +1,4 @@
-import {
-  ActionIcon,
-  Tooltip,
-  Popover,
-  TextInput,
-  Button,
-  Stack,
-} from "@mantine/core";
+import { Tooltip, Popover, TextInput, Stack } from "@mantine/core";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -14,41 +7,20 @@ import CommentIcon from "@mui/icons-material/ChatBubbleOutlineRounded";
 import AddCommentIcon from "@mui/icons-material/AddCommentOutlined";
 import OpenInNewIcon from "@mui/icons-material/OpenInNewRounded";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import type { FirstLinkTarget } from "@app/components/viewer/useAnnotationMenuHandlers";
 
-export const commonButtonStyles = {
-  root: {
-    flexShrink: 0,
-    backgroundColor: "var(--bg-raised)",
-    border: "1px solid var(--border-default)",
-    color: "var(--text-secondary)",
-    "&:hover": {
-      backgroundColor: "var(--hover-bg)",
-      borderColor: "var(--border-strong)",
-      color: "var(--text-primary)",
-    },
-  },
-};
-
 export function DeleteButton({ onDelete }: { onDelete: () => void }) {
   const { t } = useTranslation();
   return (
     <Tooltip label={t("annotation.delete", "Delete")}>
       <ActionIcon
-        variant="subtle"
-        color="red"
+        aria-label={t("annotation.delete", "Delete")}
+        variant="secondary"
+        accent="danger"
         size="md"
         onClick={onDelete}
-        styles={{
-          root: {
-            ...commonButtonStyles.root,
-            "&:hover": {
-              backgroundColor: "var(--mantine-color-red-1)",
-              borderColor: "var(--mantine-color-red-4)",
-              color: "var(--mantine-color-red-7)",
-            },
-          },
-        }}
       >
         <DeleteIcon style={{ fontSize: 18 }} />
       </ActionIcon>
@@ -61,11 +33,11 @@ export function EditTextButton({ onEdit }: { onEdit: () => void }) {
   return (
     <Tooltip label={t("annotation.editText", "Edit Text")}>
       <ActionIcon
-        variant="subtle"
-        color="gray"
+        aria-label={t("annotation.editText", "Edit Text")}
+        variant="secondary"
+        accent="neutral"
         size="md"
         onClick={onEdit}
-        styles={commonButtonStyles}
       >
         <EditIcon style={{ fontSize: 18 }} />
       </ActionIcon>
@@ -85,20 +57,17 @@ export function AttachCommentButton({
   onAdd,
 }: AttachCommentButtonProps) {
   const { t } = useTranslation();
+  const label = isInSidebar
+    ? t("viewer.comments.viewComment", "View comment")
+    : t("viewer.comments.addComment", "Add comment");
   return (
-    <Tooltip
-      label={
-        isInSidebar
-          ? t("viewer.comments.viewComment", "View comment")
-          : t("viewer.comments.addComment", "Add comment")
-      }
-    >
+    <Tooltip label={label}>
       <ActionIcon
-        variant={isInSidebar ? "filled" : "subtle"}
-        color={isInSidebar ? "blue" : "gray"}
+        aria-label={label}
+        variant={isInSidebar ? "primary" : "secondary"}
+        accent={isInSidebar ? undefined : "neutral"}
         size="md"
         onClick={isInSidebar ? onView : onAdd}
-        styles={isInSidebar ? undefined : commonButtonStyles}
       >
         <AddCommentIcon style={{ fontSize: 18 }} />
       </ActionIcon>
@@ -113,20 +82,17 @@ interface CommentButtonProps {
 
 export function CommentButton({ hasContent, onClick }: CommentButtonProps) {
   const { t } = useTranslation();
+  const label = hasContent
+    ? t("viewer.comments.viewComment", "View comment")
+    : t("viewer.comments.addComment", "Add comment");
   return (
-    <Tooltip
-      label={
-        hasContent
-          ? t("viewer.comments.viewComment", "View comment")
-          : t("viewer.comments.addComment", "Add comment")
-      }
-    >
+    <Tooltip label={label}>
       <ActionIcon
-        variant="subtle"
-        color="gray"
+        aria-label={label}
+        variant="secondary"
+        accent="neutral"
         size="md"
         onClick={onClick}
-        styles={commonButtonStyles}
       >
         <CommentIcon style={{ fontSize: 18 }} />
       </ActionIcon>
@@ -153,11 +119,11 @@ export function LinkButton({
     return (
       <Tooltip label={t("viewer.comments.goToLink", "Go to link")}>
         <ActionIcon
-          variant="subtle"
-          color="gray"
+          aria-label={t("viewer.comments.goToLink", "Go to link")}
+          variant="secondary"
+          accent="neutral"
           size="md"
           onClick={onGoToLink}
-          styles={commonButtonStyles}
         >
           <OpenInNewIcon style={{ fontSize: 18 }} />
         </ActionIcon>
@@ -170,11 +136,11 @@ export function LinkButton({
       <Popover.Target>
         <Tooltip label={t("viewer.comments.addLink", "Add link")}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={t("viewer.comments.addLink", "Add link")}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={() => setOpen((o) => !o)}
-            styles={commonButtonStyles}
           >
             <LocalIcon icon="link" width="1.25rem" height="1.25rem" />
           </ActionIcon>
@@ -190,7 +156,7 @@ export function LinkButton({
             style={{ minWidth: 220 }}
           />
           <Button
-            size="xs"
+            size="sm"
             disabled={!url.trim()}
             onClick={() => {
               onAddLink(url);
diff --git a/frontend/editor/src/core/components/viewer/AttachmentSidebar.tsx b/frontend/editor/src/core/components/viewer/AttachmentSidebar.tsx
index a858498bb6..4dcc61fe2b 100644
--- a/frontend/editor/src/core/components/viewer/AttachmentSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/AttachmentSidebar.tsx
@@ -1,15 +1,8 @@
 import { useEffect, useMemo, useRef, useState, useCallback } from "react";
-import {
-  Box,
-  ScrollArea,
-  Text,
-  ActionIcon,
-  Button,
-  Loader,
-  Stack,
-  TextInput,
-} from "@mantine/core";
+import { Box, ScrollArea, Text, Loader, Stack, TextInput } from "@mantine/core";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { PdfAttachmentObject } from "@embedpdf/models";
@@ -322,9 +315,10 @@ export const AttachmentSidebar = ({
             )}
           </div>
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             className="attachment-item__download-icon"
+            aria-label={t("viewer.attachments.download", "Download attachment")}
             onClick={(event) => handleDownload(attachment, event)}
           >
             <DownloadIcon sx={{ fontSize: "1.2rem" }} />
@@ -388,11 +382,14 @@ export const AttachmentSidebar = ({
         </div>
         <Box style={{ display: "flex", alignItems: "center", gap: 2 }}>
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
+            accent="neutral"
             size="sm"
-            color="gray"
             onClick={toggleAttachmentSidebar}
-            aria-label="Close attachments sidebar"
+            aria-label={t(
+              "viewer.attachments.closeSidebar",
+              "Close attachments sidebar",
+            )}
             title={t("viewer.attachments.close", "Close attachments")}
           >
             <LocalIcon icon="close-rounded" width="1.1rem" height="1.1rem" />
@@ -451,7 +448,11 @@ export const AttachmentSidebar = ({
               <Text size="sm" c="red" ta="center">
                 {currentError}
               </Text>
-              <ActionIcon variant="light" onClick={requestReload}>
+              <ActionIcon
+                variant="secondary"
+                aria-label={t("viewer.attachments.retry", "Retry")}
+                onClick={requestReload}
+              >
                 <LocalIcon icon="refresh" />
               </ActionIcon>
             </Stack>
@@ -487,8 +488,8 @@ export const AttachmentSidebar = ({
                 )}
               </Text>
               <Button
-                variant="light"
-                size="xs"
+                variant="secondary"
+                size="sm"
                 onClick={handleAddAttachment}
                 leftSection={
                   <LocalIcon icon="add" width="1rem" height="1rem" />
@@ -502,20 +503,15 @@ export const AttachmentSidebar = ({
           {showAttachmentList && (
             <>
               <Button
-                variant="subtle"
-                size="compact-xs"
+                variant="tertiary"
+                size="sm"
                 fullWidth
+                justify="start"
                 onClick={handleAddAttachment}
                 leftSection={
                   <LocalIcon icon="add" width="0.9rem" height="0.9rem" />
                 }
-                mb="xs"
-                styles={{
-                  root: {
-                    justifyContent: "flex-start",
-                    paddingInline: 6,
-                  },
-                }}
+                style={{ marginBottom: "var(--space-xs)" }}
               >
                 {t("viewer.attachments.addAttachment", "Add attachment")}
               </Button>
diff --git a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
index 40bd9d3045..e9ae53183e 100644
--- a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
@@ -3,16 +3,15 @@ import {
   Box,
   ScrollArea,
   Text,
-  ActionIcon,
   Loader,
   Stack,
   TextInput,
   NumberInput,
-  Button,
   Group,
-  UnstyledButton,
 } from "@mantine/core";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { useFileContext } from "@app/contexts/FileContext";
@@ -20,6 +19,7 @@ import { isStirlingFile, type FileId } from "@app/types/fileContext";
 import { createStirlingFilesAndStubs } from "@app/services/fileStubHelpers";
 import apiClient from "@app/services/apiClient";
 import { PdfBookmarkObject, PdfActionType } from "@embedpdf/models";
+import { useTranslation } from "react-i18next";
 import BookmarksIcon from "@mui/icons-material/BookmarksRounded";
 import "@app/components/viewer/SidebarBase.css";
 import "@app/components/viewer/BookmarkSidebar.css";
@@ -93,6 +93,7 @@ export const BookmarkSidebar = ({
     getScrollState,
     toggleBookmarkSidebar,
   } = useViewer();
+  const { t } = useTranslation();
   const { handleToolSelectForced } = useToolWorkflow();
   const { selectors, actions: fileActions } = useFileContext();
   const [expanded, setExpanded] = useState<Record<string, boolean>>({});
@@ -475,6 +476,34 @@ export const BookmarkSidebar = ({
     }));
   };
 
+  const expandAll = useCallback(() => {
+    const allExpanded: Record<string, boolean> = {};
+    const expandRecursive = (nodes: BookmarkNode[]) => {
+      nodes.forEach((node) => {
+        if (node.children && node.children.length > 0) {
+          allExpanded[node.id] = true;
+          expandRecursive(node.children as BookmarkNode[]);
+        }
+      });
+    };
+    expandRecursive(bookmarksWithIds);
+    setExpanded(allExpanded);
+  }, [bookmarksWithIds]);
+
+  const collapseAll = useCallback(() => {
+    const allCollapsed: Record<string, boolean> = {};
+    const collapseRecursive = (nodes: BookmarkNode[]) => {
+      nodes.forEach((node) => {
+        if (node.children && node.children.length > 0) {
+          allCollapsed[node.id] = false;
+          collapseRecursive(node.children as BookmarkNode[]);
+        }
+      });
+    };
+    collapseRecursive(bookmarksWithIds);
+    setExpanded(allCollapsed);
+  }, [bookmarksWithIds]);
+
   const handleBookmarkClick = (
     bookmark: PdfBookmarkObject,
     event: React.MouseEvent,
@@ -569,9 +598,10 @@ export const BookmarkSidebar = ({
           >
             {hasChildren ? (
               <ActionIcon
-                variant="subtle"
+                variant="tertiary"
                 size="sm"
                 className="bookmark-item__expand-icon"
+                aria-label={isNodeExpanded ? "Collapse" : "Expand"}
                 onClick={(event) => {
                   event.stopPropagation();
                   toggleNode(node.id);
@@ -654,12 +684,54 @@ export const BookmarkSidebar = ({
           </Text>
         </div>
         <Box style={{ display: "flex", alignItems: "center", gap: 2 }}>
+          {bookmarkSupport && bookmarksWithIds.length > 0 && (
+            <>
+              {Object.values(expanded).some((val) => val === false) ? (
+                <ActionIcon
+                  variant="tertiary"
+                  size="sm"
+                  onClick={expandAll}
+                  aria-label={t(
+                    "viewer.bookmarks.expandAll",
+                    "Expand all bookmarks",
+                  )}
+                  title="Expand all"
+                >
+                  <LocalIcon
+                    icon="unfold-more"
+                    width="1.1rem"
+                    height="1.1rem"
+                  />
+                </ActionIcon>
+              ) : (
+                <ActionIcon
+                  variant="tertiary"
+                  size="sm"
+                  onClick={collapseAll}
+                  aria-label={t(
+                    "viewer.bookmarks.collapseAll",
+                    "Collapse all bookmarks",
+                  )}
+                  title="Collapse all"
+                >
+                  <LocalIcon
+                    icon="unfold-less"
+                    width="1.1rem"
+                    height="1.1rem"
+                  />
+                </ActionIcon>
+              )}
+            </>
+          )}
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
+            accent="neutral"
             size="sm"
-            color="gray"
             onClick={toggleBookmarkSidebar}
-            aria-label="Close bookmarks sidebar"
+            aria-label={t(
+              "viewer.bookmarks.closeSidebar",
+              "Close bookmarks sidebar",
+            )}
             title="Close bookmarks"
           >
             <LocalIcon icon="close-rounded" width="1.1rem" height="1.1rem" />
@@ -706,7 +778,7 @@ export const BookmarkSidebar = ({
               <Text size="sm" c="red" ta="center">
                 {currentError}
               </Text>
-              <Button size="xs" variant="light" onClick={requestReload}>
+              <Button variant="secondary" size="sm" onClick={requestReload}>
                 Retry
               </Button>
             </Stack>
@@ -726,7 +798,6 @@ export const BookmarkSidebar = ({
               </Text>
             </Stack>
           )}
-
           {showEmptyState && !isAddingBookmark && (
             <Stack align="center" gap="sm" py="lg">
               <LocalIcon
@@ -739,8 +810,8 @@ export const BookmarkSidebar = ({
                 No bookmarks in this document
               </Text>
               <Button
-                variant="light"
-                size="xs"
+                variant="tertiary"
+                size="sm"
                 onClick={handleOpenAddBookmark}
                 leftSection={
                   <LocalIcon icon="add" width="1rem" height="1rem" />
@@ -769,7 +840,10 @@ export const BookmarkSidebar = ({
                 <TextInput
                   size="xs"
                   placeholder="Bookmark title"
-                  aria-label="Bookmark title"
+                  aria-label={t(
+                    "viewer.bookmarks.bookmarkTitle",
+                    "Bookmark title",
+                  )}
                   value={newBookmarkTitle}
                   onChange={(e) => setNewBookmarkTitle(e.currentTarget.value)}
                   autoFocus
@@ -793,16 +867,16 @@ export const BookmarkSidebar = ({
                 )}
                 <Group justify="flex-end" gap="xs">
                   <Button
-                    size="xs"
-                    variant="default"
+                    size="sm"
+                    variant="secondary"
                     onClick={handleCancelAddBookmark}
                     disabled={isSavingBookmark}
                   >
                     Cancel
                   </Button>
                   <Button
-                    size="xs"
-                    color="blue"
+                    size="sm"
+                    variant="primary"
                     onClick={handleSubmitAddBookmark}
                     loading={isSavingBookmark}
                     disabled={!newBookmarkTitle.trim()}
@@ -813,25 +887,19 @@ export const BookmarkSidebar = ({
               </Stack>
             </Box>
           )}
-
           {showBookmarkList && (
             <>
               {!isAddingBookmark && (
                 <Button
-                  variant="subtle"
-                  size="compact-xs"
+                  variant="tertiary"
+                  size="sm"
                   fullWidth
+                  justify="start"
                   onClick={handleOpenAddBookmark}
                   leftSection={
                     <LocalIcon icon="add" width="0.9rem" height="0.9rem" />
                   }
-                  mb="xs"
-                  styles={{
-                    root: {
-                      justifyContent: "flex-start",
-                      paddingInline: 6,
-                    },
-                  }}
+                  style={{ marginBottom: "var(--space-xs)" }}
                 >
                   Add bookmark
                 </Button>
@@ -862,9 +930,12 @@ export const BookmarkSidebar = ({
             flexShrink: 0,
           }}
         >
-          <UnstyledButton
+          <Button
+            variant="tertiary"
+            hover={false}
             type="button"
             onClick={handleFallbackToTool}
+            fullWidth
             style={{ width: "100%" }}
           >
             <Group gap="xs" justify="center" wrap="nowrap">
@@ -883,7 +954,7 @@ export const BookmarkSidebar = ({
                 Need to reorder or nest? Open the Bookmark Editor
               </Text>
             </Group>
-          </UnstyledButton>
+          </Button>
         </Box>
       )}
     </Box>
diff --git a/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx b/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
index cc470b3ea6..e25f9671d9 100644
--- a/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
@@ -5,16 +5,15 @@ import {
   Text,
   Textarea,
   Stack,
-  ActionIcon,
   Group,
   Tooltip,
   TextInput,
   Menu,
   Modal,
-  Button,
-  UnstyledButton,
 } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import DeleteIcon from "@mui/icons-material/Delete";
 import CheckIcon from "@mui/icons-material/CheckRounded";
 import MoreHorizIcon from "@mui/icons-material/MoreHoriz";
@@ -120,7 +119,6 @@ function getCommentDisplayContent(entry: {
 
 /** Placeholder authors we never show; use current user's name from context instead. */
 const PLACEHOLDER_AUTHORS = new Set(["Guest", "Digital Signature", ""]);
-
 function getAuthorName(
   obj: Pick<PdfAnnotationObject, "author">,
   currentDisplayName: string,
@@ -188,7 +186,6 @@ function getIconByType(type: number | undefined): string {
   if (type === 15) return "edit";
   return "comment";
 }
-
 function isCommentAnnotation(ann: PdfAnnotationObject): boolean {
   const customData = getStirlingAnnotationMetadata(ann).customData;
   const toolId = customData?.toolId ?? customData?.annotationToolId;
@@ -252,7 +249,6 @@ function getAnnotationToolId(ann: PdfAnnotationObject): string {
   const customData = getStirlingAnnotationMetadata(ann).customData;
   return customData?.toolId ?? customData?.annotationToolId ?? "";
 }
-
 function getAnnotationTypeLabel(
   ann: PdfAnnotationObject,
   t: (key: string, fallback: string) => string,
@@ -285,7 +281,6 @@ function getAnnotationTypeLabel(
   if (type === 1) return t("viewer.comments.typeComment", "Comment");
   return t("viewer.comments.typeComment", "Comment");
 }
-
 function AnnotationTypeIcon({ ann }: { ann: PdfAnnotationObject }) {
   const toolId = getAnnotationToolId(ann);
   const iconName = TOOL_ICON_MAP[toolId] ?? getIconByType(ann?.type);
@@ -714,9 +709,10 @@ export function CommentsSidebar({
           <Group gap={2} wrap="nowrap" style={{ flexShrink: 0 }}>
             <Tooltip label={t("viewer.comments.addComment", "Add comment")}>
               <ActionIcon
-                variant="subtle"
+                variant="tertiary"
+                accent="neutral"
                 size="sm"
-                color="gray"
+                aria-label={t("viewer.comments.addComment", "Add comment")}
                 onClick={handleAddComment}
               >
                 <LocalIcon icon="add" width="1.25rem" height="1.25rem" />
@@ -727,7 +723,15 @@ export function CommentsSidebar({
                 <Tooltip
                   label={t("viewer.comments.moreActions", "More actions")}
                 >
-                  <ActionIcon variant="subtle" size="sm" color="gray">
+                  <ActionIcon
+                    variant="tertiary"
+                    accent="neutral"
+                    size="sm"
+                    aria-label={t(
+                      "viewer.comments.moreActions",
+                      "More actions",
+                    )}
+                  >
                     <MoreHorizIcon style={{ fontSize: 20 }} />
                   </ActionIcon>
                 </Tooltip>
@@ -746,11 +750,14 @@ export function CommentsSidebar({
         )}
         {toggleCommentsSidebar && (
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
+            accent="neutral"
             size="sm"
-            color="gray"
             onClick={toggleCommentsSidebar}
-            aria-label="Close comments sidebar"
+            aria-label={t(
+              "viewer.comments.closeSidebar",
+              "Close comments sidebar",
+            )}
             title={t("viewer.comments.close", "Close comments")}
           >
             <LocalIcon icon="close-rounded" width="1.1rem" height="1.1rem" />
@@ -775,9 +782,9 @@ export function CommentsSidebar({
               </Text>
               {isPlacingComment ? (
                 <Button
-                  variant="light"
-                  color="orange"
-                  size="xs"
+                  variant="tertiary"
+                  accent="warning"
+                  size="sm"
                   onClick={handleCancelPlacingComment}
                   leftSection={
                     <LocalIcon
@@ -794,8 +801,8 @@ export function CommentsSidebar({
                 </Button>
               ) : (
                 <Button
-                  variant="light"
-                  size="xs"
+                  variant="tertiary"
+                  size="sm"
                   onClick={handleAddComment}
                   leftSection={
                     <LocalIcon icon="add" width="1rem" height="1rem" />
@@ -809,10 +816,11 @@ export function CommentsSidebar({
             <>
               {isPlacingComment ? (
                 <Button
-                  variant="light"
-                  color="orange"
-                  size="compact-xs"
+                  variant="tertiary"
+                  accent="warning"
+                  size="sm"
                   fullWidth
+                  justify="start"
                   onClick={handleCancelPlacingComment}
                   leftSection={
                     <LocalIcon
@@ -821,12 +829,7 @@ export function CommentsSidebar({
                       height="0.9rem"
                     />
                   }
-                  styles={{
-                    root: {
-                      justifyContent: "flex-start",
-                      paddingInline: 6,
-                    },
-                  }}
+                  style={{ paddingInline: 6 }}
                 >
                   {t(
                     "viewer.comments.placingHint",
@@ -835,19 +838,15 @@ export function CommentsSidebar({
                 </Button>
               ) : (
                 <Button
-                  variant="subtle"
-                  size="compact-xs"
+                  variant="tertiary"
+                  size="sm"
                   fullWidth
+                  justify="start"
                   onClick={handleAddComment}
                   leftSection={
                     <LocalIcon icon="add" width="0.9rem" height="0.9rem" />
                   }
-                  styles={{
-                    root: {
-                      justifyContent: "flex-start",
-                      paddingInline: 6,
-                    },
-                  }}
+                  style={{ paddingInline: 6 }}
                 >
                   {t("viewer.comments.addComment", "Add comment")}
                 </Button>
@@ -943,9 +942,13 @@ export function CommentsSidebar({
                                   )}
                                 >
                                   <ActionIcon
-                                    variant="subtle"
+                                    variant="tertiary"
+                                    accent="neutral"
                                     size="sm"
-                                    color="gray"
+                                    aria-label={t(
+                                      "viewer.comments.locateAnnotation",
+                                      "Locate in document",
+                                    )}
                                     onClick={() =>
                                       handleLocateAnnotation(pageIndex, ann)
                                     }
@@ -962,9 +965,13 @@ export function CommentsSidebar({
                                       )}
                                     >
                                       <ActionIcon
-                                        variant="subtle"
+                                        variant="tertiary"
+                                        accent="neutral"
                                         size="sm"
-                                        color="gray"
+                                        aria-label={t(
+                                          "viewer.comments.moreActions",
+                                          "More actions",
+                                        )}
                                       >
                                         <MoreHorizIcon
                                           style={{ fontSize: 20 }}
@@ -1030,9 +1037,12 @@ export function CommentsSidebar({
                                     )}
                                   >
                                     <ActionIcon
-                                      variant="filled"
+                                      variant="primary"
                                       size="sm"
-                                      color="blue"
+                                      aria-label={t(
+                                        "viewer.comments.addComment",
+                                        "Add comment",
+                                      )}
                                       onClick={() => {
                                         handleSendMainComment(
                                           pageIndex,
@@ -1043,9 +1053,7 @@ export function CommentsSidebar({
                                       }}
                                       disabled={!(draft ?? "").trim()}
                                     >
-                                      <CheckIcon
-                                        style={{ fontSize: 18, color: "white" }}
-                                      />
+                                      <CheckIcon style={{ fontSize: 18 }} />
                                     </ActionIcon>
                                   </Tooltip>
                                 </Group>
@@ -1112,7 +1120,9 @@ export function CommentsSidebar({
                                               >
                                                 {canEditReply &&
                                                 !isEditingReply ? (
-                                                  <UnstyledButton
+                                                  <Button
+                                                    variant="tertiary"
+                                                    hover={false}
                                                     type="button"
                                                     onClick={() => {
                                                       setEditingReplyKey(
@@ -1135,7 +1145,7 @@ export function CommentsSidebar({
                                                         "Edit",
                                                       )}
                                                     </Text>
-                                                  </UnstyledButton>
+                                                  </Button>
                                                 ) : null}
                                                 {rTimestamp ? (
                                                   <Text size="xs" c="dimmed">
@@ -1178,9 +1188,12 @@ export function CommentsSidebar({
                                                     )}
                                                   >
                                                     <ActionIcon
-                                                      variant="filled"
+                                                      variant="primary"
                                                       size="sm"
-                                                      color="blue"
+                                                      aria-label={t(
+                                                        "viewer.comments.saveReply",
+                                                        "Save reply",
+                                                      )}
                                                       onClick={() =>
                                                         handleSaveReplyEdit(
                                                           replyEditKey,
@@ -1196,7 +1209,6 @@ export function CommentsSidebar({
                                                       <CheckIcon
                                                         style={{
                                                           fontSize: 18,
-                                                          color: "white",
                                                         }}
                                                       />
                                                     </ActionIcon>
@@ -1252,13 +1264,12 @@ export function CommentsSidebar({
                                     )}
                                   >
                                     <ActionIcon
-                                      variant="filled"
+                                      variant="primary"
                                       size="md"
-                                      color="blue"
-                                      style={{
-                                        backgroundColor:
-                                          "var(--mantine-color-blue-6)",
-                                      }}
+                                      aria-label={t(
+                                        "viewer.comments.addComment",
+                                        "Add comment",
+                                      )}
                                       onClick={() =>
                                         handleSendReply(
                                           pageIndex,
@@ -1268,9 +1279,7 @@ export function CommentsSidebar({
                                       }
                                       disabled={!replyDraft.trim()}
                                     >
-                                      <CheckIcon
-                                        style={{ fontSize: 20, color: "white" }}
-                                      />
+                                      <CheckIcon style={{ fontSize: 20 }} />
                                     </ActionIcon>
                                   </Tooltip>
                                 </Group>
@@ -1305,10 +1314,10 @@ export function CommentsSidebar({
           )}
         </Text>
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={handleRemoveFromSidebar}>
+          <Button variant="secondary" onClick={handleRemoveFromSidebar}>
             {t("viewer.comments.removeCommentOnly", "Remove comment only")}
           </Button>
-          <Button color="red" onClick={handleDeleteAnnotation}>
+          <Button accent="danger" onClick={handleDeleteAnnotation}>
             {t(
               "viewer.comments.deleteAnnotationAndComment",
               "Delete annotation & comment",
@@ -1331,10 +1340,13 @@ export function CommentsSidebar({
           )}
         </Text>
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={() => setClearAllModalOpen(false)}>
+          <Button
+            variant="secondary"
+            onClick={() => setClearAllModalOpen(false)}
+          >
             {t("viewer.comments.cancelClearAll", "Cancel")}
           </Button>
-          <Button color="red" onClick={handleClearAllComments}>
+          <Button accent="danger" onClick={handleClearAllComments}>
             {t("viewer.comments.clearAll", "Clear all comments")}
           </Button>
         </Group>
diff --git a/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx b/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
index 24bc42b02e..555f93df9d 100644
--- a/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
+++ b/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
@@ -6,7 +6,9 @@ import React, {
   useState,
 } from "react";
 import { useTranslation } from "react-i18next";
-import { Box, Center, Text, ActionIcon, Button, Stack } from "@mantine/core";
+import { Box, Center, Text, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import LockIcon from "@mui/icons-material/Lock";
 
@@ -1225,15 +1227,14 @@ const EmbedPdfViewerContent = ({
       {/* Close Button - Only show in preview mode */}
       {onClose && previewFile && (
         <ActionIcon
-          variant="filled"
-          color="gray"
+          variant="secondary"
           size="lg"
+          aria-label={t("common.close", "Close")}
           style={{
             position: "absolute",
             top: "1rem",
             right: "1rem",
             zIndex: 1000,
-            borderRadius: "50%",
           }}
           onClick={onClose}
         >
@@ -1261,7 +1262,6 @@ const EmbedPdfViewerContent = ({
               )}
             </Text>
             <Button
-              variant="filled"
               onClick={() => {
                 if (currentFile && isStirlingFile(currentFile)) {
                   actions.openEncryptedUnlockPrompt(currentFile.fileId);
diff --git a/frontend/editor/src/core/components/viewer/LayerSidebar.tsx b/frontend/editor/src/core/components/viewer/LayerSidebar.tsx
index 91eaac01bd..126da6f016 100644
--- a/frontend/editor/src/core/components/viewer/LayerSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/LayerSidebar.tsx
@@ -6,13 +6,14 @@ import {
   Checkbox,
   Stack,
   Loader,
-  ActionIcon,
   Tooltip,
 } from "@mantine/core";
 import LayersIcon from "@mui/icons-material/Layers";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import VisibilityIcon from "@mui/icons-material/Visibility";
 import VisibilityOffIcon from "@mui/icons-material/VisibilityOff";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import { useTranslation } from "react-i18next";
 import { useViewer } from "@app/contexts/ViewerContext";
 import "@app/components/viewer/SidebarBase.css";
 import "@app/components/viewer/LayerSidebar.css";
@@ -51,6 +52,7 @@ export function LayerSidebar({
   onApplyLayers,
   onLayersDetected,
 }: LayerSidebarProps) {
+  const { t } = useTranslation();
   const { toggleLayerSidebar } = useViewer();
   const [layers, setLayers] = useState<LayerInfo[]>([]);
   const [visibility, setVisibility] = useState<Record<string, boolean>>({});
@@ -339,26 +341,25 @@ export function LayerSidebar({
           </Text>
           {isApplying && <Loader size="xs" type="dots" />}
         </div>
-
         <div className="layer-sidebar__header-actions">
           {status === "ready" && leafIds.length > 0 && (
             <>
               <ActionIcon
-                variant="subtle"
+                variant="tertiary"
                 size="sm"
                 onClick={showAll}
                 disabled={allVisible || isApplying}
-                aria-label="Show all layers"
+                aria-label={t("viewer.layers.showAll", "Show all layers")}
                 title="Show all"
               >
                 <VisibilityIcon sx={{ fontSize: "1rem" }} />
               </ActionIcon>
               <ActionIcon
-                variant="subtle"
+                variant="tertiary"
                 size="sm"
                 onClick={hideAll}
                 disabled={allHidden || isApplying}
-                aria-label="Hide all layers"
+                aria-label={t("viewer.layers.hideAll", "Hide all layers")}
                 title="Hide all"
               >
                 <VisibilityOffIcon sx={{ fontSize: "1rem" }} />
@@ -366,11 +367,11 @@ export function LayerSidebar({
             </>
           )}
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
+            accent="neutral"
             size="sm"
-            color="gray"
             onClick={toggleLayerSidebar}
-            aria-label="Close layers sidebar"
+            aria-label={t("viewer.layers.closeSidebar", "Close layers sidebar")}
             title="Close layers"
           >
             <LocalIcon icon="close-rounded" width="1.1rem" height="1.1rem" />
diff --git a/frontend/editor/src/core/components/viewer/LinkLayer.tsx b/frontend/editor/src/core/components/viewer/LinkLayer.tsx
index 227045ebb9..e1a2aeb8f0 100644
--- a/frontend/editor/src/core/components/viewer/LinkLayer.tsx
+++ b/frontend/editor/src/core/components/viewer/LinkLayer.tsx
@@ -17,7 +17,8 @@ import {
   type PdfLinkAnnoObject,
 } from "@embedpdf/models";
 import { Z_INDEX_VIEWER_FLOATING_MENU } from "@app/styles/zIndex";
-
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 // ---------------------------------------------------------------------------
 // Inline SVG icons (thin-stroke, modern)
 // ---------------------------------------------------------------------------
@@ -206,8 +207,8 @@ const LinkToolbar: React.FC<LinkToolbarProps> = React.memo(
         onMouseLeave={onMouseLeave}
       >
         {/* Delete */}
-        <button
-          type="button"
+        <ActionIcon
+          variant="tertiary"
           className="pdf-link-toolbar-btn pdf-link-toolbar-btn--delete"
           onClick={(e) => {
             e.stopPropagation();
@@ -217,13 +218,12 @@ const LinkToolbar: React.FC<LinkToolbarProps> = React.memo(
           title={t("viewer.link.delete", "Delete link")}
         >
           <TrashIcon />
-        </button>
-
+        </ActionIcon>
         <span className="pdf-link-toolbar-sep" />
 
         {/* Navigate / Open */}
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           className="pdf-link-toolbar-btn pdf-link-toolbar-btn--go"
           onClick={(e) => {
             e.stopPropagation();
@@ -234,7 +234,7 @@ const LinkToolbar: React.FC<LinkToolbarProps> = React.memo(
         >
           {internal ? <PageIcon /> : <ExternalLinkIcon />}
           <span className="pdf-link-toolbar-label">{label}</span>
-        </button>
+        </Button>
       </div>
     );
   },
diff --git a/frontend/editor/src/core/components/viewer/NonPdfViewer.tsx b/frontend/editor/src/core/components/viewer/NonPdfViewer.tsx
index 1b54fa1680..ed4a2e2263 100644
--- a/frontend/editor/src/core/components/viewer/NonPdfViewer.tsx
+++ b/frontend/editor/src/core/components/viewer/NonPdfViewer.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useMemo } from "react";
-import { Box, Button, Center, Stack, Text } from "@mantine/core";
+import { Box, Center, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import ArticleIcon from "@mui/icons-material/Article";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 
@@ -81,8 +82,8 @@ export function NonPdfViewer({ file }: NonPdfViewerProps) {
               </Text>
               {isConvertAvailable && (
                 <Button
-                  variant="light"
-                  color="orange"
+                  variant="secondary"
+                  accent="warning"
                   leftSection={<PictureAsPdfIcon />}
                   onClick={handleConvertToPdf}
                 >
diff --git a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
index b3bab51953..893cd35d44 100644
--- a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
+++ b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
@@ -1,17 +1,10 @@
 import { useState, useEffect } from "react";
-import {
-  ActionIcon,
-  Button,
-  Paper,
-  Group,
-  Menu,
-  NumberInput,
-  Slider,
-} from "@mantine/core";
+import { Paper, Group, Menu, NumberInput, Slider } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useIsPhone } from "@app/hooks/useIsMobile";
 import { Tooltip } from "@app/components/shared/Tooltip";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import FirstPageIcon from "@mui/icons-material/FirstPage";
 import ArrowBackIosIcon from "@mui/icons-material/ArrowBackIos";
 import ArrowForwardIosIcon from "@mui/icons-material/ArrowForwardIos";
@@ -161,35 +154,31 @@ export function PdfViewerToolbar({
     >
       {/* First Page Button */}
       {!isPhone && (
-        <Button
-          variant="subtle"
-          color="blue"
+        <ActionIcon
+          variant="tertiary"
           size={buttonSize}
-          px={8}
-          radius="xl"
           onClick={handleFirstPage}
           disabled={scrollState.currentPage === 1}
           style={{ minWidth: buttonMinWidth }}
           title={t("viewer.firstPage", "First Page")}
+          aria-label={t("viewer.firstPage", "First Page")}
         >
           <FirstPageIcon fontSize="small" />
-        </Button>
+        </ActionIcon>
       )}
 
       {/* Previous Page Button */}
-      <Button
-        variant="subtle"
-        color="blue"
+      <ActionIcon
+        variant="tertiary"
         size={buttonSize}
-        px={8}
-        radius="xl"
         onClick={handlePreviousPage}
         disabled={scrollState.currentPage === 1}
         style={{ minWidth: buttonMinWidth }}
         title={t("viewer.previousPage", "Previous Page")}
+        aria-label={t("viewer.previousPage", "Previous Page")}
       >
         <ArrowBackIosIcon fontSize="small" />
-      </Button>
+      </ActionIcon>
 
       {/* Page Input */}
       <NumberInput
@@ -219,35 +208,31 @@ export function PdfViewerToolbar({
       </span>
 
       {/* Next Page Button */}
-      <Button
-        variant="subtle"
-        color="blue"
+      <ActionIcon
+        variant="tertiary"
         size={buttonSize}
-        px={8}
-        radius="xl"
         onClick={handleNextPage}
         disabled={scrollState.currentPage === scrollState.totalPages}
         style={{ minWidth: buttonMinWidth }}
         title={t("viewer.nextPage", "Next Page")}
+        aria-label={t("viewer.nextPage", "Next Page")}
       >
         <ArrowForwardIosIcon fontSize="small" />
-      </Button>
+      </ActionIcon>
 
       {/* Last Page Button */}
       {!isPhone && (
-        <Button
-          variant="subtle"
-          color="blue"
+        <ActionIcon
+          variant="tertiary"
           size={buttonSize}
-          px={8}
-          radius="xl"
           onClick={handleLastPage}
           disabled={scrollState.currentPage === scrollState.totalPages}
           style={{ minWidth: buttonMinWidth }}
           title={t("viewer.lastPage", "Last Page")}
+          aria-label={t("viewer.lastPage", "Last Page")}
         >
           <LastPageIcon fontSize="small" />
-        </Button>
+        </ActionIcon>
       )}
 
       {/* Dual Page Toggle */}
@@ -261,21 +246,24 @@ export function PdfViewerToolbar({
           position="top"
           arrow
         >
-          <Button
-            variant={isDualPageActive ? "filled" : "light"}
-            color="blue"
+          <ActionIcon
+            variant={isDualPageActive ? "primary" : "secondary"}
             size={buttonSize}
-            radius="xl"
             onClick={handleDualPageToggle}
             disabled={scrollState.totalPages <= 1}
             style={{ minWidth: buttonMinWidth }}
+            aria-label={
+              isDualPageActive
+                ? t("viewer.singlePageView", "Single Page View")
+                : t("viewer.dualPageView", "Dual Page View")
+            }
           >
             {isDualPageActive ? (
               <DescriptionIcon fontSize="small" />
             ) : (
               <ViewWeekIcon fontSize="small" />
             )}
-          </Button>
+          </ActionIcon>
         </Tooltip>
       )}
 
@@ -292,11 +280,9 @@ export function PdfViewerToolbar({
           position="top"
           arrow
         >
-          <Button
-            variant={pdfRenderMode !== "normal" ? "filled" : "light"}
-            color="blue"
+          <ActionIcon
+            variant={pdfRenderMode !== "normal" ? "primary" : "secondary"}
             size={buttonSize}
-            radius="xl"
             onClick={cyclePdfRenderMode}
             style={{ minWidth: buttonMinWidth }}
             aria-label={
@@ -310,7 +296,7 @@ export function PdfViewerToolbar({
             {pdfRenderMode === "normal" && <DarkModeIcon fontSize="small" />}
             {pdfRenderMode === "dark" && <WbTwilightIcon fontSize="small" />}
             {pdfRenderMode === "sepia" && <WbSunnyIcon fontSize="small" />}
-          </Button>
+          </ActionIcon>
         </Tooltip>
       )}
 
@@ -323,9 +309,7 @@ export function PdfViewerToolbar({
           style={{ marginLeft: 16, flexShrink: 0 }}
         >
           <ActionIcon
-            variant="subtle"
-            color="blue"
-            radius="md"
+            variant="tertiary"
             onClick={handleZoomOut}
             aria-label={t("viewer.zoomOut", "Zoom out")}
           >
@@ -346,9 +330,7 @@ export function PdfViewerToolbar({
             label={null}
           />
           <ActionIcon
-            variant="subtle"
-            color="blue"
-            radius="md"
+            variant="tertiary"
             onClick={handleZoomIn}
             aria-label={t("viewer.zoomIn", "Zoom in")}
           >
@@ -376,9 +358,7 @@ export function PdfViewerToolbar({
         >
           <Menu.Target>
             <ActionIcon
-              variant="light"
-              color="blue"
-              radius="md"
+              variant="secondary"
               size="lg"
               aria-label={t("viewer.moreOptions", "More")}
               style={{ marginLeft: 4 }}
diff --git a/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.tsx b/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.tsx
index 3e1af1fa71..24a1fc8763 100644
--- a/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.tsx
+++ b/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.tsx
@@ -3,7 +3,9 @@ import {
   RedactionSelectionMenuProps,
 } from "@embedpdf/plugin-redaction/react";
 import { PdfAnnotationSubtype } from "@embedpdf/models";
-import { ActionIcon, Tooltip, Button, Group } from "@mantine/core";
+import { Tooltip, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { createPortal } from "react-dom";
 import { useEffect, useState, useRef, useCallback } from "react";
@@ -141,23 +143,11 @@ function RedactionSelectionMenuInner({
       <Group gap="sm" wrap="nowrap" justify="center">
         <Tooltip label={t("viewer.redaction.removeMark", "Remove this mark")}>
           <ActionIcon
-            variant="subtle"
-            color="gray"
+            aria-label={t("viewer.redaction.removeMark", "Remove this mark")}
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={handleRemove}
-            styles={{
-              root: {
-                flexShrink: 0,
-                backgroundColor: "var(--bg-raised)",
-                border: "1px solid var(--border-default)",
-                color: "var(--text-secondary)",
-                "&:hover": {
-                  backgroundColor: "var(--hover-bg)",
-                  borderColor: "var(--border-strong)",
-                  color: "var(--text-primary)",
-                },
-              },
-            }}
           >
             <DeleteIcon style={{ fontSize: 18 }} />
           </ActionIcon>
@@ -172,14 +162,11 @@ function RedactionSelectionMenuInner({
           position="top"
         >
           <Button
-            variant="filled"
-            color="red"
-            size="xs"
+            accent="danger"
+            size="sm"
             onClick={handleApply}
             leftSection={<CheckCircleIcon style={{ fontSize: 16 }} />}
-            styles={{
-              root: { flexShrink: 0, whiteSpace: "nowrap" },
-            }}
+            style={{ flexShrink: 0, whiteSpace: "nowrap" }}
           >
             Apply (permanent)
           </Button>
diff --git a/frontend/editor/src/core/components/viewer/SearchInterface.tsx b/frontend/editor/src/core/components/viewer/SearchInterface.tsx
index f111837860..2c93aff17c 100644
--- a/frontend/editor/src/core/components/viewer/SearchInterface.tsx
+++ b/frontend/editor/src/core/components/viewer/SearchInterface.tsx
@@ -1,7 +1,8 @@
 import React, { useState, useEffect, useRef } from "react";
-import { Box, TextInput, ActionIcon, Text, Group } from "@mantine/core";
+import { Box, TextInput, Text, Group } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import { LocalIcon } from "@app/components/shared/LocalIcon";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { ViewerContext } from "@app/contexts/ViewerContext";
 
 interface SearchInterfaceProps {
@@ -200,7 +201,7 @@ export function SearchInterface({ visible, onClose }: SearchInterfaceProps) {
           {t("search.title", "Search PDF")}
         </Text>
         <ActionIcon
-          variant="subtle"
+          variant="tertiary"
           size="sm"
           onClick={handleCloseClick}
           aria-label={t("viewer.search.close", "Close search")}
@@ -225,7 +226,7 @@ export function SearchInterface({ visible, onClose }: SearchInterfaceProps) {
           rightSection={
             searchQuery.trim() && (
               <ActionIcon
-                variant="subtle"
+                variant="tertiary"
                 onClick={handleClearSearch}
                 aria-label={t("viewer.search.clear", "Clear search")}
               >
@@ -275,7 +276,7 @@ export function SearchInterface({ visible, onClose }: SearchInterfaceProps) {
 
         <Group gap="xs">
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             onClick={handlePrevious}
             disabled={!resultInfo || resultInfo.currentIndex <= 1}
@@ -284,7 +285,7 @@ export function SearchInterface({ visible, onClose }: SearchInterfaceProps) {
             <LocalIcon icon="keyboard-arrow-up" width="1rem" height="1rem" />
           </ActionIcon>
           <ActionIcon
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             onClick={handleNext}
             disabled={
diff --git a/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.tsx b/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.tsx
index 73479a826f..930790a59e 100644
--- a/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.tsx
+++ b/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.tsx
@@ -1,6 +1,7 @@
 import { memo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ActionIcon, Tooltip } from "@mantine/core";
+import { Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import { useInteractionManagerCapability } from "@embedpdf/plugin-interaction-manager/react";
 import {
@@ -162,9 +163,9 @@ export const SignaturePreviewLayer = memo(function SignaturePreviewLayer({
               {!readOnly && (
                 <ActionIcon
                   size="sm"
-                  radius="xl"
-                  variant="filled"
-                  color="red"
+                  shape="circle"
+                  variant="primary"
+                  accent="danger"
                   style={{
                     position: "absolute",
                     top: -10,
diff --git a/frontend/editor/src/core/components/viewer/TextSelectionMenu.tsx b/frontend/editor/src/core/components/viewer/TextSelectionMenu.tsx
index af3399e38d..322dd4806f 100644
--- a/frontend/editor/src/core/components/viewer/TextSelectionMenu.tsx
+++ b/frontend/editor/src/core/components/viewer/TextSelectionMenu.tsx
@@ -1,4 +1,5 @@
-import { ActionIcon, Tooltip } from "@mantine/core";
+import { Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ContentCopyIcon from "@mui/icons-material/ContentCopy";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { createPortal } from "react-dom";
@@ -72,14 +73,12 @@ export function TextSelectionMenu({
       >
         <Tooltip label={t("viewer.copyText", "Copy")} withArrow>
           <ActionIcon
-            variant="filled"
+            variant="secondary"
+            accent="neutral"
             size="md"
             onClick={handleCopy}
             aria-label={t("viewer.copyText", "Copy")}
             style={{
-              backgroundColor: "var(--mantine-color-body)",
-              border: "1px solid var(--mantine-color-default-border)",
-              color: "var(--text-primary)",
               boxShadow: "0 2px 12px rgba(0, 0, 0, 0.25)",
             }}
           >
diff --git a/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx b/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
index 94919eb4f2..3fb62df970 100644
--- a/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
@@ -1,5 +1,7 @@
 import { useState, useEffect, useRef } from "react";
-import { Box, ScrollArea, Text, ActionIcon } from "@mantine/core";
+import { Box, ScrollArea, Text } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { useTranslation } from "react-i18next";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { PrivateContent } from "@app/components/shared/PrivateContent";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -17,6 +19,7 @@ export function ThumbnailSidebar({
   onToggle,
   activeFileId,
 }: ThumbnailSidebarProps) {
+  const { t } = useTranslation();
   const { getScrollState, scrollActions, getThumbnailAPI } = useViewer();
   const [thumbnails, setThumbnails] = useState<{ [key: number]: string }>({});
 
@@ -182,11 +185,14 @@ export function ThumbnailSidebar({
               </Text>
             </div>
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
+              accent="neutral"
               size="sm"
-              color="gray"
               onClick={onToggle}
-              aria-label="Close thumbnails sidebar"
+              aria-label={t(
+                "viewer.thumbnails.closeSidebar",
+                "Close thumbnails sidebar",
+              )}
               title="Close thumbnails"
             >
               <LocalIcon icon="close-rounded" width="1.1rem" height="1.1rem" />
diff --git a/frontend/editor/src/core/components/viewer/ViewerAnnotationControls.tsx b/frontend/editor/src/core/components/viewer/ViewerAnnotationControls.tsx
index 78888f4188..32b4b1ce11 100644
--- a/frontend/editor/src/core/components/viewer/ViewerAnnotationControls.tsx
+++ b/frontend/editor/src/core/components/viewer/ViewerAnnotationControls.tsx
@@ -1,7 +1,7 @@
 import React, { useCallback } from "react";
-import { ActionIcon } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import { ViewerContext } from "@app/contexts/ViewerContext";
 import { useSignature } from "@app/contexts/SignatureContext";
@@ -186,12 +186,15 @@ export default function ViewerAnnotationControls({
         portalTarget={document.body}
       >
         <ActionIcon
-          variant={isRedactMode ? "filled" : "subtle"}
-          color={isRedactMode ? "blue" : undefined}
-          radius="md"
+          variant={isRedactMode ? "primary" : "tertiary"}
           className="workbench-bar-action-icon"
           onClick={handleRedactionToggle}
           disabled={disabled || currentView !== "viewer"}
+          aria-label={
+            isRedactMode
+              ? t("workbenchBar.exitRedaction", "Exit Redaction Mode")
+              : t("workbenchBar.redact", "Redact")
+          }
         >
           <LocalIcon
             icon="scan-delete-rounded"
@@ -212,9 +215,7 @@ export default function ViewerAnnotationControls({
         portalTarget={document.body}
       >
         <ActionIcon
-          variant={annotationsHidden ? "filled" : "subtle"}
-          color={annotationsHidden ? "blue" : undefined}
-          radius="md"
+          variant={annotationsHidden ? "primary" : "tertiary"}
           className="workbench-bar-action-icon"
           onClick={handleToggleAnnotationsVisibility}
           disabled={
@@ -225,6 +226,10 @@ export default function ViewerAnnotationControls({
           }
           data-active={annotationsHidden ? "true" : undefined}
           aria-pressed={annotationsHidden}
+          aria-label={t(
+            "workbenchBar.toggleAnnotations",
+            "Toggle Annotations Visibility",
+          )}
         >
           <LocalIcon
             icon={
diff --git a/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx b/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
index 36a2701d14..bb3f8aa909 100644
--- a/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
+++ b/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
@@ -1,5 +1,7 @@
 import { useState } from "react";
-import { ActionIcon, Button, Group, Modal, Stack, Text } from "@mantine/core";
+import { Group, Modal, Stack, Text } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ShareIcon from "@mui/icons-material/Share";
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
@@ -131,8 +133,7 @@ export default function ViewerShareButton({
       >
         <div className="workbench-bar-tooltip-wrapper">
           <ActionIcon
-            variant="subtle"
-            radius="md"
+            variant="tertiary"
             className="workbench-bar-action-icon"
             onClick={handleClick}
             disabled={isDisabled}
@@ -172,17 +173,17 @@ export default function ViewerShareButton({
           </Stack>
           <Group justify="center" gap="sm">
             <Button
-              variant="light"
-              color="var(--mantine-color-gray-8)"
-              w={BUTTON_WIDTH}
+              variant="secondary"
+              accent="neutral"
+              style={{ width: BUTTON_WIDTH }}
               onClick={() => setConfirmOpen(false)}
               disabled={saving}
             >
               {t("cancel", "Cancel")}
             </Button>
             <Button
-              variant="filled"
-              w={BUTTON_WIDTH}
+              variant="primary"
+              style={{ width: BUTTON_WIDTH }}
               leftSection={<CloudUploadIcon fontSize="small" />}
               onClick={handleSaveAndShare}
               loading={saving}
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/MarkdownRenderer.tsx b/frontend/editor/src/core/components/viewer/nonpdf/MarkdownRenderer.tsx
index 5856326096..7cd69a2330 100644
--- a/frontend/editor/src/core/components/viewer/nonpdf/MarkdownRenderer.tsx
+++ b/frontend/editor/src/core/components/viewer/nonpdf/MarkdownRenderer.tsx
@@ -2,11 +2,13 @@ import React, { useState } from "react";
 import ReactMarkdown from "react-markdown";
 import type { Components } from "react-markdown";
 import remarkGfm from "remark-gfm";
+import { Button } from "@app/ui/Button";
 
 function CopyButton({ text }: { text: string }) {
   const [copied, setCopied] = useState(false);
   return (
-    <button
+    <Button
+      variant="tertiary"
       onClick={() =>
         navigator.clipboard.writeText(text).then(() => {
           setCopied(true);
@@ -31,7 +33,7 @@ function CopyButton({ text }: { text: string }) {
       }}
     >
       {copied ? "✓ Copied" : "Copy"}
-    </button>
+    </Button>
   );
 }
 
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.tsx b/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.tsx
index e1f169b85b..2d73a0f558 100644
--- a/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.tsx
+++ b/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.tsx
@@ -1,4 +1,4 @@
-import { Button } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import { useTranslation } from "react-i18next";
 
@@ -13,9 +13,9 @@ export function NonPdfBanner({ onConvertToPdf }: NonPdfBannerProps) {
 
   return (
     <Button
-      size="xs"
-      variant="light"
-      color="orange"
+      size="sm"
+      variant="secondary"
+      accent="warning"
       leftSection={<PictureAsPdfIcon style={{ fontSize: "0.9rem" }} />}
       onClick={onConvertToPdf}
       style={{
diff --git a/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx b/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
index 4960672dd9..14a308e0f3 100644
--- a/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
+++ b/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
@@ -1,5 +1,6 @@
 import { useMemo, useState, useEffect, useCallback } from "react";
-import { ActionIcon, Slider, Popover, Select } from "@mantine/core";
+import { Slider, Popover, Select } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { supportedLanguages } from "@app/i18n";
 import { useViewer } from "@app/contexts/ViewerContext";
@@ -169,14 +170,13 @@ export function useViewerWorkbenchBarButtons(
               <Popover.Target>
                 <div style={{ display: "inline-flex" }}>
                   <ActionIcon
-                    variant="subtle"
-                    radius="md"
+                    variant="tertiary"
                     className="workbench-bar-action-icon"
                     disabled={disabled}
                     aria-label={searchLabel}
                     onClick={viewer.searchInterfaceActions.toggle}
                   >
-                    <LocalIcon icon="search" width="1.25rem" height="1.25rem" />
+                    <LocalIcon icon="search" width="1rem" height="1rem" />
                   </ActionIcon>
                 </div>
               </Popover.Target>
@@ -194,9 +194,7 @@ export function useViewerWorkbenchBarButtons(
       },
       {
         id: "viewer-pan-mode",
-        icon: (
-          <LocalIcon icon="pan-tool-rounded" width="1.25rem" height="1.25rem" />
-        ),
+        icon: <LocalIcon icon="pan-tool-rounded" width="1rem" height="1rem" />,
         tooltip:
           !isPanning && pendingCount > 0 && redactionActiveType !== null
             ? applyRedactionsLabel
@@ -221,7 +219,7 @@ export function useViewerWorkbenchBarButtons(
       },
       {
         id: "viewer-ruler",
-        icon: <StraightenIcon sx={{ fontSize: "1.25rem" }} />,
+        icon: <StraightenIcon sx={{ fontSize: "1rem" }} />,
         tooltip: rulerLabel,
         ariaLabel: rulerLabel,
         section: "top" as const,
@@ -238,7 +236,7 @@ export function useViewerWorkbenchBarButtons(
       },
       {
         id: "viewer-rotate-left",
-        icon: <LocalIcon icon="rotate-left" width="1.25rem" height="1.25rem" />,
+        icon: <LocalIcon icon="rotate-left" width="1rem" height="1rem" />,
         tooltip: rotateLeftLabel,
         ariaLabel: rotateLeftLabel,
         section: "top" as const,
@@ -249,9 +247,7 @@ export function useViewerWorkbenchBarButtons(
       },
       {
         id: "viewer-rotate-right",
-        icon: (
-          <LocalIcon icon="rotate-right" width="1.25rem" height="1.25rem" />
-        ),
+        icon: <LocalIcon icon="rotate-right" width="1rem" height="1rem" />,
         tooltip: rotateRightLabel,
         ariaLabel: rotateRightLabel,
         section: "top" as const,
@@ -262,7 +258,7 @@ export function useViewerWorkbenchBarButtons(
       },
       {
         id: "viewer-toggle-sidebar",
-        icon: <LocalIcon icon="view-list" width="1.25rem" height="1.25rem" />,
+        icon: <LocalIcon icon="view-list" width="1rem" height="1rem" />,
         tooltip: sidebarLabel,
         ariaLabel: sidebarLabel,
         section: "top" as const,
@@ -312,7 +308,7 @@ export function useViewerWorkbenchBarButtons(
         ? [
             {
               id: "viewer-toggle-layers",
-              icon: <LayersIcon sx={{ fontSize: "1.25rem" }} />,
+              icon: <LayersIcon sx={{ fontSize: "1rem" }} />,
               tooltip: layersLabel,
               ariaLabel: layersLabel,
               section: "top" as const,
@@ -326,7 +322,7 @@ export function useViewerWorkbenchBarButtons(
         : []),
       {
         id: "viewer-toggle-comments",
-        icon: <LocalIcon icon="comment" width="1.25rem" height="1.25rem" />,
+        icon: <LocalIcon icon="comment" width="1rem" height="1rem" />,
         tooltip: commentsLabel,
         ariaLabel: commentsLabel,
         section: "top" as const,
@@ -363,8 +359,7 @@ export function useViewerWorkbenchBarButtons(
                   portalTarget={document.body}
                 >
                   <ActionIcon
-                    variant={isReadingAloud ? "filled" : "subtle"}
-                    radius="md"
+                    variant={isReadingAloud ? "primary" : "tertiary"}
                     className="workbench-bar-action-icon"
                     disabled={
                       disabled ||
@@ -373,12 +368,11 @@ export function useViewerWorkbenchBarButtons(
                     }
                     aria-label={readAloudLabel}
                     onClick={handleReadAloud}
-                    color={isReadingAloud ? "blue" : undefined}
                   >
                     {isReadingAloud ? (
-                      <StopIcon sx={{ fontSize: "1.25rem" }} />
+                      <StopIcon sx={{ fontSize: "1rem" }} />
                     ) : (
-                      <VolumeUpIcon sx={{ fontSize: "1.25rem" }} />
+                      <VolumeUpIcon sx={{ fontSize: "1rem" }} />
                     )}
                   </ActionIcon>
                 </Tooltip>
@@ -451,8 +445,7 @@ export function useViewerWorkbenchBarButtons(
             portalTarget={document.body}
           >
             <ActionIcon
-              variant={isAnnotationsActive ? "filled" : "subtle"}
-              radius="md"
+              variant={isAnnotationsActive ? "primary" : "tertiary"}
               className="workbench-bar-action-icon"
               onClick={() => {
                 if (disabled || isAnnotationsActive) return;
@@ -479,9 +472,9 @@ export function useViewerWorkbenchBarButtons(
               }}
               disabled={disabled}
               aria-pressed={isAnnotationsActive}
-              color={isAnnotationsActive ? "blue" : undefined}
+              aria-label={annotationsLabel}
             >
-              <LocalIcon icon="edit" width="1.25rem" height="1.25rem" />
+              <LocalIcon icon="edit" width="1rem" height="1rem" />
             </ActionIcon>
           </Tooltip>
         ),
@@ -509,8 +502,7 @@ export function useViewerWorkbenchBarButtons(
             portalTarget={document.body}
           >
             <ActionIcon
-              variant={isFormFillActive ? "filled" : "subtle"}
-              radius="md"
+              variant={isFormFillActive ? "primary" : "tertiary"}
               className="workbench-bar-action-icon"
               onClick={() => {
                 if (disabled) return;
@@ -522,9 +514,9 @@ export function useViewerWorkbenchBarButtons(
               }}
               disabled={disabled}
               aria-pressed={isFormFillActive}
-              color={isFormFillActive ? "blue" : undefined}
+              aria-label={formFillLabel}
             >
-              <TextFieldsIcon sx={{ fontSize: "1.25rem" }} />
+              <TextFieldsIcon sx={{ fontSize: "1rem" }} />
             </ActionIcon>
           </Tooltip>
         ),
diff --git a/frontend/editor/src/core/contexts/FileManagerContext.tsx b/frontend/editor/src/core/contexts/FileManagerContext.tsx
index 5e8bcf93ca..a557a9d31b 100644
--- a/frontend/editor/src/core/contexts/FileManagerContext.tsx
+++ b/frontend/editor/src/core/contexts/FileManagerContext.tsx
@@ -7,7 +7,8 @@ import React, {
   useEffect,
   useMemo,
 } from "react";
-import { Button, Group, Modal, Stack, Text } from "@mantine/core";
+import { Group, Modal, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { fileStorage } from "@app/services/fileStorage";
 import { useFileActions, useFileManagement } from "@app/contexts/FileContext";
 import { zipFileService } from "@app/services/zipFileService";
@@ -1210,14 +1211,14 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
           </Text>
           <Group justify="flex-end" gap="sm">
             <Button
-              variant="default"
+              variant="secondary"
               onClick={() => resolveDeleteChoice("cancel")}
             >
               {t("cancel", "Cancel")}
             </Button>
             {!deletePromptIsServerOnly && (
               <Button
-                variant="light"
+                variant="secondary"
                 onClick={() => resolveDeleteChoice("local")}
               >
                 {t("fileManager.removeLocalOnly", "This device only")}
@@ -1225,7 +1226,7 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
             )}
             {deletePromptCanLeaveShare && (
               <Button
-                variant="light"
+                variant="secondary"
                 onClick={() => resolveDeleteChoice("leave")}
               >
                 {t("fileManager.leaveShare", "Remove from my list")}
@@ -1234,14 +1235,14 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
             {deletePromptFile?.remoteOwnedByCurrentUser !== false && (
               <>
                 <Button
-                  variant="light"
+                  variant="secondary"
                   onClick={() => resolveDeleteChoice("server")}
                 >
                   {t("fileManager.removeServerOnly", "Server only")}
                 </Button>
                 {!deletePromptIsServerOnly && (
                   <Button
-                    color="red"
+                    accent="danger"
                     onClick={() => resolveDeleteChoice("both")}
                   >
                     {t("fileManager.removeBoth", "Remove from both")}
diff --git a/frontend/editor/src/core/contexts/UnsavedChangesContext.tsx b/frontend/editor/src/core/contexts/UnsavedChangesContext.tsx
index 51ca85371d..8497731d6d 100644
--- a/frontend/editor/src/core/contexts/UnsavedChangesContext.tsx
+++ b/frontend/editor/src/core/contexts/UnsavedChangesContext.tsx
@@ -5,7 +5,8 @@ import React, {
   useCallback,
   ReactNode,
 } from "react";
-import { Modal, Text, Button, Group, Stack } from "@mantine/core";
+import { Modal, Text, Group, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 interface UnsavedChangesContextType {
@@ -89,10 +90,10 @@ export function UnsavedChangesProvider({
             )}
           </Text>
           <Group justify="flex-end" gap="sm">
-            <Button variant="default" onClick={handleCancel}>
+            <Button variant="secondary" onClick={handleCancel}>
               {t("admin.settings.unsavedChanges.cancel", "Keep Editing")}
             </Button>
-            <Button color="red" onClick={handleDiscard}>
+            <Button accent="danger" onClick={handleDiscard}>
               {t("admin.settings.unsavedChanges.discard", "Discard Changes")}
             </Button>
           </Group>
diff --git a/frontend/editor/src/core/pages/HomePage.tsx b/frontend/editor/src/core/pages/HomePage.tsx
index 2e5d2aa08d..c1b4f572bc 100644
--- a/frontend/editor/src/core/pages/HomePage.tsx
+++ b/frontend/editor/src/core/pages/HomePage.tsx
@@ -38,6 +38,7 @@ import { useFileHandler } from "@app/hooks/useFileHandler";
 import { FolderTreePanel } from "@app/components/filesPage/FolderTreePanel";
 import type { FileSidebarProps } from "@app/components/shared/FileSidebar";
 
+import { Button } from "@app/ui/Button";
 import "@app/pages/HomePage.css";
 
 const SIDEBAR_COLLAPSED_STORAGE_KEY = "stirling.fileSidebarCollapsed";
@@ -404,7 +405,8 @@ export default function HomePage() {
               </div>
             )}
             <div className="mobile-bottom-bar">
-              <button
+              <Button
+                variant="tertiary"
                 className="mobile-bottom-button"
                 aria-label={t("quickAccess.allTools", "Tools")}
                 onClick={() => {
@@ -418,9 +420,10 @@ export default function HomePage() {
                 <span className="mobile-bottom-button-label">
                   {t("quickAccess.allTools", "Tools")}
                 </span>
-              </button>
+              </Button>
               {toolAvailability["automate"]?.available !== false && (
-                <button
+                <Button
+                  variant="tertiary"
                   className="mobile-bottom-button"
                   aria-label={t("quickAccess.automate", "Automate")}
                   onClick={() => {
@@ -438,9 +441,10 @@ export default function HomePage() {
                   <span className="mobile-bottom-button-label">
                     {t("quickAccess.automate", "Automate")}
                   </span>
-                </button>
+                </Button>
               )}
-              <button
+              <Button
+                variant="tertiary"
                 className="mobile-bottom-button"
                 aria-label={t("home.mobile.openFiles", "Open files")}
                 onClick={() => navigate("/files")}
@@ -453,8 +457,9 @@ export default function HomePage() {
                 <span className="mobile-bottom-button-label">
                   {t("quickAccess.files", "Files")}
                 </span>
-              </button>
-              <button
+              </Button>
+              <Button
+                variant="tertiary"
                 className="mobile-bottom-button"
                 aria-label={t("quickAccess.config", "Config")}
                 onClick={() => setConfigModalOpen(true)}
@@ -467,7 +472,7 @@ export default function HomePage() {
                 <span className="mobile-bottom-button-label">
                   {t("quickAccess.config", "Config")}
                 </span>
-              </button>
+              </Button>
             </div>
             <FileManager selectedTool={selectedTool} />
             <AppConfigModal
diff --git a/frontend/editor/src/core/pages/MobileScannerPage.tsx b/frontend/editor/src/core/pages/MobileScannerPage.tsx
index 0d14ce7ee8..cf4e3e3564 100644
--- a/frontend/editor/src/core/pages/MobileScannerPage.tsx
+++ b/frontend/editor/src/core/pages/MobileScannerPage.tsx
@@ -2,7 +2,6 @@ import { useState, useRef, useEffect, useCallback } from "react";
 import { useSearchParams, useNavigate } from "react-router-dom";
 import {
   Box,
-  Button,
   Stack,
   Text,
   Group,
@@ -11,6 +10,7 @@ import {
   Switch,
   Card,
 } from "@mantine/core";
+import { Button as DSButton } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { LogoIcon } from "@app/components/shared/LogoIcon";
 import { Wordmark } from "@app/components/shared/Wordmark";
@@ -1172,9 +1172,9 @@ export default function MobileScannerPage() {
           }}
         >
           {/* Back button - floating top left */}
-          <Button
+          <DSButton
             onClick={() => setMode("choice")}
-            variant="filled"
+            variant="primary"
             size="sm"
             style={{
               position: "absolute",
@@ -1187,8 +1187,7 @@ export default function MobileScannerPage() {
             }}
           >
             ← {t("mobileScanner.back", "Back")}
-          </Button>
-
+          </DSButton>
           {/* Video feed - fills available space */}
           <Box
             style={{
@@ -1266,18 +1265,17 @@ export default function MobileScannerPage() {
               </Group>
 
               {/* Capture button */}
-              <Button
+              <DSButton
                 fullWidth
-                size="lg"
+                size="md"
                 onClick={captureImage}
                 loading={isProcessing}
-                variant="filled"
-                radius="xl"
+                variant="primary"
               >
                 {isProcessing
                   ? t("mobileScanner.processing", "Processing...")
                   : t("mobileScanner.capture", "Capture")}
-              </Button>
+              </DSButton>
             </Stack>
           </Box>
         </Box>
@@ -1291,15 +1289,14 @@ export default function MobileScannerPage() {
           align="center"
           style={{ maxWidth: "500px", margin: "0 auto" }}
         >
-          <Button
+          <DSButton
             onClick={() => setMode("choice")}
-            variant="subtle"
+            variant="tertiary"
             size="sm"
             style={{ alignSelf: "flex-start" }}
           >
             ← {t("mobileScanner.back", "Back")}
-          </Button>
-
+          </DSButton>
           <Card
             shadow="sm"
             padding="xl"
@@ -1325,15 +1322,14 @@ export default function MobileScannerPage() {
                 style={{ display: "none" }}
                 onChange={handleFileSelect}
               />
-              <Button
+              <DSButton
                 size="lg"
-                variant="filled"
                 fullWidth
                 onClick={() => fileInputRef.current?.click()}
                 leftSection={<AddPhotoAlternateRoundedIcon />}
               >
                 {t("mobileScanner.selectImage", "Select Image")}
-              </Button>
+              </DSButton>
             </Stack>
           </Card>
         </Stack>
@@ -1383,23 +1379,22 @@ export default function MobileScannerPage() {
           >
             <Stack gap="sm">
               <Group grow>
-                <Button variant="default" onClick={retake} size="lg">
+                <DSButton variant="secondary" onClick={retake} size="md">
                   {t("mobileScanner.retake", "Retake")}
-                </Button>
-                <Button variant="filled" onClick={addToBatch} size="lg">
+                </DSButton>
+                <DSButton variant="primary" onClick={addToBatch} size="md">
                   {t("mobileScanner.addToBatch", "Add to Batch")}
-                </Button>
+                </DSButton>
               </Group>
-              <Button
+              <DSButton
                 fullWidth
-                variant="filled"
-                size="lg"
+                variant="primary"
+                size="md"
                 onClick={uploadImages}
                 loading={isUploading}
-                radius="xl"
               >
                 {t("mobileScanner.upload", "Upload")}
-              </Button>
+              </DSButton>
             </Stack>
           </Box>
         </Box>
@@ -1413,17 +1408,22 @@ export default function MobileScannerPage() {
               )
             </Text>
             <Group gap="xs">
-              <Button
-                size="xs"
-                variant="outline"
+              <DSButton
+                size="sm"
+                variant="secondary"
+                accent="danger"
                 onClick={clearBatch}
-                color="red"
               >
                 {t("mobileScanner.clearBatch", "Clear")}
-              </Button>
-              <Button size="xs" onClick={uploadImages} loading={isUploading}>
+              </DSButton>
+              <DSButton
+                variant="primary"
+                size="sm"
+                onClick={uploadImages}
+                loading={isUploading}
+              >
                 {t("mobileScanner.uploadAll", "Upload All")}
-              </Button>
+              </DSButton>
             </Group>
           </Group>
           <Box
diff --git a/frontend/editor/src/core/styles/cookieconsent.css b/frontend/editor/src/core/styles/cookieconsent.css
index 0f51c768cb..4c226e6d0d 100644
--- a/frontend/editor/src/core/styles/cookieconsent.css
+++ b/frontend/editor/src/core/styles/cookieconsent.css
@@ -11,41 +11,30 @@
   z-index: 999999 !important;
 }
 
-/* Dark mode styling */
-.cc--darkmode .cm {
-  background: #2d2d2d !important;
-  color: #ffffff !important;
-  border-top: 1px solid #444 !important;
-}
-
+/* Dark mode styling — use the app's dark-theme design tokens so the banner
+ * matches the rest of the UI (navy-indigo surfaces) instead of a flat grey. */
+.cc--darkmode .cm,
 .cc--darkmode .pm {
-  background: #2d2d2d !important;
-  color: #ffffff !important;
+  background: var(--bg-surface) !important;
+  color: var(--text-primary) !important;
+  border: 1px solid var(--border-subtle) !important;
 }
 
 .cc--darkmode .pm-overlay {
-  background: rgba(0, 0, 0, 0.7) !important;
-}
-
-/* Button styling */
-.cc--darkmode .cm__btn {
-  background: #444 !important;
-  color: #ffffff !important;
-  border: 1px solid #666 !important;
-}
-
-.cc--darkmode .cm__btn:hover {
-  background: #555 !important;
+  background: rgba(0, 0, 0, 0.6) !important;
 }
 
+/* Buttons — match the shared neutral surface treatment. */
+.cc--darkmode .cm__btn,
 .cc--darkmode .pm__btn {
-  background: #444 !important;
-  color: #ffffff !important;
-  border: 1px solid #666 !important;
+  background: var(--bg-muted) !important;
+  color: var(--text-primary) !important;
+  border: 1px solid var(--border-default) !important;
 }
 
+.cc--darkmode .cm__btn:hover,
 .cc--darkmode .pm__btn:hover {
-  background: #555 !important;
+  background: var(--hover-bg) !important;
 }
 
 /* Ensure ScrollArea doesn't interfere */
diff --git a/frontend/editor/src/core/styles/theme.css b/frontend/editor/src/core/styles/theme.css
index 0e5242e362..e5b744695e 100644
--- a/frontend/editor/src/core/styles/theme.css
+++ b/frontend/editor/src/core/styles/theme.css
@@ -185,6 +185,7 @@
   --border-subtle: #e5e7eb;
   --border-default: #e2e8f0;
   --border-strong: #9ca3af;
+  --border-hover: #9ca3af;
   --hover-bg: #f9fafb;
   --active-bg: #f3f4f6;
   --automation-entry-hover-bg: var(--color-gray-100);
@@ -344,8 +345,6 @@
   --api-keys-card-shadow: rgba(0, 0, 0, 0.06);
   --api-keys-input-bg: #f8f8f8;
   --api-keys-input-border: #e0e0e0;
-  --api-keys-button-bg: #f5f5f5;
-  --api-keys-button-color: #333333;
 
   /* PDF Report Colors (always light) */
   --pdf-light-header-bg: 239 246 255;
@@ -410,32 +409,27 @@
 :root {
   --onboarding-title: #0a0a0a;
   --onboarding-body: #4a5565;
-  --onboarding-primary-button-bg: #101828;
-  --onboarding-primary-button-text: #ffffff;
-  --onboarding-secondary-button-bg: #ffffff;
-  --onboarding-secondary-button-text: #6a7282;
-  --onboarding-secondary-button-border: #e5e5e5;
   --onboarding-step-active: #1e2939;
   --onboarding-step-inactive: #d1d5dc;
 }
 
 [data-mantine-color-scheme="dark"] {
-  /* Dark theme gray scale (inverted) */
-  --gray-50: 17 24 39;
-  --gray-100: 31 35 41;
-  --gray-200: 42 47 54;
-  --gray-300: 55 65 81;
-  --gray-400: 75 85 99;
-  --gray-500: 107 114 128;
-  --gray-600: 156 163 175;
-  --gray-700: 209 213 219;
-  --gray-800: 229 231 235;
-  --gray-900: 243 244 246;
+  /* Dark theme gray scale (inverted) — navy-indigo tinted */
+  --gray-50: 9 11 24;
+  --gray-100: 13 16 32;
+  --gray-200: 19 23 41;
+  --gray-300: 28 35 64;
+  --gray-400: 45 55 96;
+  --gray-500: 90 98 128;
+  --gray-600: 144 153 185;
+  --gray-700: 195 200 230;
+  --gray-800: 218 222 245;
+  --gray-900: 238 241 252;
 
   /* Dark semantic colors for Tailwind */
-  --surface: 31 35 41;
-  --background: 42 47 54;
-  --border: 55 65 81;
+  --surface: 19 23 41;
+  --background: 9 11 24;
+  --border: 28 35 64;
 
   /* Dark theme Mantine colors */
   --color-red-50: #2d1b1b;
@@ -500,61 +494,62 @@
   --color-yellow-800: #fef08a;
   --color-yellow-900: #fef9c3;
 
-  /* Dark theme semantic colors */
-  --bg-surface: #2a2f36;
-  --bg-raised: #1f2329;
-  --bg-muted: #1f2329;
-  --bg-background: #2a2f36;
-  --bg-toolbar: #1f2329;
-  --bg-file-manager: #1f2329;
-  --bg-file-list: #2a2f36;
-  --btn-open-file: #0a8bff;
-  --text-primary: #f9fafb;
-  --text-secondary: #d1d5db;
-  --text-muted: #9ca3af;
+  /* Dark theme semantic colors — deep navy/indigo palette */
+  --bg-surface: #131729;
+  --bg-raised: #0d1020;
+  --bg-muted: #0d1020;
+  --bg-background: #090b18;
+  --bg-toolbar: #090b18;
+  --bg-file-manager: #090b18;
+  --bg-file-list: #131729;
+  --btn-open-file: #4f8ef5;
+  --text-primary: #e8eaf6;
+  --text-secondary: #9299b0;
+  --text-muted: #5b6280;
   /* Always-dark text (for use on light backgrounds like alerts) - does not change in dark mode */
   --text-always-dark: #1f2937;
   --text-always-dark-muted: #6b7280;
-  --border-subtle: rgba(255, 255, 255, 0.08);
-  --border-default: #3a4047;
-  --border-strong: #4b5563;
-  --hover-bg: #374151;
-  --active-bg: #4b5563;
+  --border-subtle: rgba(255, 255, 255, 0.05);
+  --border-default: #1c2340;
+  --border-strong: #2d3560;
+  --border-hover: #3a4680;
+  --hover-bg: #181d38;
+  --active-bg: #232a50;
   --automation-entry-hover-bg: var(--color-gray-200);
 
   /* Icon colors for dark mode */
-  --icon-user-bg: #2a2f36;
-  --icon-user-color: #6e7581;
-  --icon-notifications-bg: #2a2f36;
-  --icon-notifications-color: #6e7581;
-  --icon-tools-bg: #4b525a;
-  --icon-tools-color: #eaeaea;
-  --icon-read-bg: #4b525a;
-  --icon-read-color: #eaeaea;
-  --icon-sign-bg: #4b525a;
-  --icon-sign-color: #eaeaea;
-  --icon-automate-bg: #4b525a;
-  --icon-automate-color: #eaeaea;
-  --icon-files-bg: #4b525a;
-  --icon-files-color: #eaeaea;
-  --icon-activity-bg: #4b525a;
-  --icon-activity-color: #eaeaea;
-  --icon-config-bg: #4b525a;
-  --icon-config-color: #eaeaea;
+  --icon-user-bg: #131729;
+  --icon-user-color: #6e7898;
+  --icon-notifications-bg: #131729;
+  --icon-notifications-color: #6e7898;
+  --icon-tools-bg: #1c2340;
+  --icon-tools-color: #e0e3f8;
+  --icon-read-bg: #1c2340;
+  --icon-read-color: #e0e3f8;
+  --icon-sign-bg: #1c2340;
+  --icon-sign-color: #e0e3f8;
+  --icon-automate-bg: #1c2340;
+  --icon-automate-color: #e0e3f8;
+  --icon-files-bg: #1c2340;
+  --icon-files-color: #e0e3f8;
+  --icon-activity-bg: #1c2340;
+  --icon-activity-color: #e0e3f8;
+  --icon-config-bg: #1c2340;
+  --icon-config-color: #e0e3f8;
 
   /* Inactive icon colors for dark mode */
-  --icon-inactive-bg: #2a2f36;
-  --icon-inactive-color: #6e7581;
+  --icon-inactive-bg: #131729;
+  --icon-inactive-color: #6e7898;
 
   /* Dark mode tooltip colors */
-  --tooltip-title-bg: #4b525a;
-  --tooltip-title-color: #fff;
+  --tooltip-title-bg: #1c2340;
+  --tooltip-title-color: #e8eaf6;
   --tooltip-header-bg: var(--bg-raised);
   --tooltip-header-color: var(--text-primary);
   --tooltip-border: var(--border-default);
 
-  --accent-interactive: #ffffff;
-  --text-instruction: #ffffff;
+  --accent-interactive: #e8eaf6;
+  --text-instruction: #e8eaf6;
   --text-brand: var(--color-gray-800);
   --text-brand-accent: #ef4444;
 
@@ -563,77 +558,77 @@
   --spdf-compare-added-badge-fg: var(--color-green-500);
 
   /* container */
-  --landing-paper-bg: #171a1f;
+  --landing-paper-bg: #090b18;
   --landing-inner-paper-bg: var(--bg-raised);
-  --landing-inner-paper-border: #2d3237;
+  --landing-inner-paper-border: #1c2340;
 
   /* landing dark overrides */
   --landing-stack-glow-bg: radial-gradient(
     circle,
-    rgba(30, 136, 229, 0.22) 0%,
+    rgba(50, 90, 210, 0.22) 0%,
     transparent 70%
   );
   --landing-doc-shadow-back-idle:
-    0 4px 20px rgba(0, 0, 0, 0.35), 0 1px 3px rgba(0, 0, 0, 0.25);
+    0 4px 20px rgba(0, 0, 0, 0.45), 0 1px 3px rgba(0, 0, 0, 0.35);
   --landing-doc-shadow-back-hover:
-    0 14px 44px rgba(0, 0, 0, 0.55), 0 6px 16px rgba(0, 0, 0, 0.35);
+    0 14px 44px rgba(0, 0, 0, 0.65), 0 6px 16px rgba(0, 0, 0, 0.45);
   --landing-doc-shadow-front-idle:
-    0 8px 30px rgba(0, 0, 0, 0.45), 0 4px 12px rgba(0, 0, 0, 0.3),
+    0 8px 30px rgba(0, 0, 0, 0.55), 0 4px 12px rgba(0, 0, 0, 0.4),
     0 0 0 1px rgba(255, 255, 255, 0.04);
   --landing-doc-shadow-front-hover:
-    0 20px 52px rgba(0, 0, 0, 0.6), 0 10px 24px rgba(0, 0, 0, 0.4),
+    0 20px 52px rgba(0, 0, 0, 0.7), 0 10px 24px rgba(0, 0, 0, 0.5),
     0 0 0 1px rgba(255, 255, 255, 0.06);
-  --landing-button-color: #ffffff;
+  --landing-button-color: #e8eaf6;
   --landing-button-hover-bg: var(--bg-raised);
 
   /* selected file header colors for dark */
-  --header-selected-bg: #1e88e5;
+  --header-selected-bg: #2040a0;
   --header-selected-fg: #ffffff;
   /* file card background (dark) */
-  --file-card-bg: #1f2329;
-  --accordion-item-bg: #373d45; /* accordion item background - more distinguishable */
+  --file-card-bg: #0d1020;
+  --accordion-item-bg: #1c2340; /* accordion item background - more distinguishable */
 
   /* shadows */
-  --drop-shadow-color: rgba(255, 255, 255, 0.08);
-  --drop-shadow-color-strong: rgba(255, 255, 255, 0.04);
-  --drop-shadow-filter: drop-shadow(0 0.2rem 0.4rem rgba(200, 200, 200, 0.08))
-    drop-shadow(0 0.6rem 0.6rem rgba(200, 200, 200, 0.06))
-    drop-shadow(0 1.2rem 1rem rgba(200, 200, 200, 0.04));
+  --drop-shadow-color: rgba(255, 255, 255, 0.05);
+  --drop-shadow-color-strong: rgba(255, 255, 255, 0.03);
+  --drop-shadow-filter: drop-shadow(0 0.2rem 0.4rem rgba(0, 0, 0, 0.3))
+    drop-shadow(0 0.6rem 0.6rem rgba(0, 0, 0, 0.2))
+    drop-shadow(0 1.2rem 1rem rgba(0, 0, 0, 0.15));
 
   /* Adjust shadows for dark mode */
-  --shadow-xs: 0 1px 2px rgba(0, 0, 0, 0.3);
-  --shadow-sm: 0 1px 3px rgba(0, 0, 0, 0.4);
-  --shadow-md: 0 4px 6px rgba(0, 0, 0, 0.4);
-  --shadow-lg: 0 10px 15px rgba(0, 0, 0, 0.4);
-  --shadow-xl: 0 20px 25px rgba(0, 0, 0, 0.4);
+  --shadow-xs: 0 1px 2px rgba(0, 0, 0, 0.4);
+  --shadow-sm: 0 1px 3px rgba(0, 0, 0, 0.5);
+  --shadow-md: 0 4px 6px rgba(0, 0, 0, 0.5);
+  --shadow-lg: 0 10px 15px rgba(0, 0, 0, 0.5);
+  --shadow-xl: 0 20px 25px rgba(0, 0, 0, 0.5);
 
   --tools-text-and-icon-color: var(--text-primary);
 
   /* Tool picker sticky header variables (dark mode) */
-  --tool-header-bg: #2a2f36;
-  --tool-header-border: #3a4047;
-  --tool-header-text: #d0d6dc;
-  --tool-header-badge-bg: #4b525a;
-  --tool-header-badge-text: #ffffff;
+  --tool-header-bg: #131729;
+  --tool-header-border: #1c2340;
+  --tool-header-text: #c2c8e0;
+  --tool-header-badge-bg: #1c2340;
+  --tool-header-badge-text: #e8eaf6;
 
   /* Subcategory title styling (dark mode) */
-  --tool-subcategory-text-color: #9ca3af; /* lighter text in dark mode as well */
-  --tool-subcategory-rule-color: #3a4047; /* doubly lighter (relative) line in dark */
+  --tool-subcategory-text-color: #5b6280;
+  --tool-subcategory-rule-color: #1c2340;
 
   /* PDF text selection colors (dark mode) */
-  --pdf-selection-bg: rgba(96, 165, 250, 0.25);
-  --pdf-selection-ring: rgba(96, 165, 250, 0.28);
+  --pdf-selection-bg: rgba(96, 130, 250, 0.25);
+  --pdf-selection-ring: rgba(96, 130, 250, 0.28);
 
   /* Placeholder text colors (dark mode) */
-  --search-text-and-icon-color: #ffffff !important;
-  --input-bg: #4b525a;
+  --search-text-and-icon-color: #e8eaf6 !important;
+  --input-bg: #1c2340;
 
   /* Tool panel search bar background colors (dark mode) */
-  --tool-panel-search-bg: #1f2329;
-  --tool-panel-search-border-bottom: #4b525a;
+  --tool-panel-search-bg: #0d1020;
+  --tool-panel-search-border-bottom: #1c2340;
 
-  --information-text-bg: #292e34;
-  --information-text-color: #ececec;
+  --information-text-bg: #131729;
+  --information-text-color: #e0e3f8;
 
   /* Bulk selection panel specific colors (dark mode) */
   --bulk-panel-bg: var(--bg-raised); /* dark background for parent container */
@@ -642,36 +637,29 @@
     --border-default
   ); /* default border for cards and buttons */
   --bulk-card-hover-border: var(--border-strong); /* stronger border on hover */
-  --unsupported-bar-bg: #1f2329;
-  --unsupported-bar-border: #4b525a;
+  --unsupported-bar-bg: #0d1020;
+  --unsupported-bar-border: #1c2340;
 
   /* Config Modal colors (dark mode) */
-  --modal-nav-bg: #1f2329;
-  --modal-nav-section-title: #9ca3af;
-  --modal-nav-item: #d0d6dc;
-  --modal-nav-item-active: #0a8bff;
-  --modal-nav-item-active-bg: rgba(10, 139, 255, 0.15);
-  --modal-content-bg: #2a2f36;
-  --modal-header-border: rgba(255, 255, 255, 0.08);
+  --modal-nav-bg: #0d1020;
+  --modal-nav-section-title: #5b6280;
+  --modal-nav-item: #c2c8e0;
+  --modal-nav-item-active: #4f8ef5;
+  --modal-nav-item-active-bg: rgba(79, 142, 245, 0.15);
+  --modal-content-bg: #131729;
+  --modal-header-border: rgba(255, 255, 255, 0.05);
 
   /* Onboarding (dark mode) */
-  --onboarding-title: #f9fafb;
-  --onboarding-body: #d1d5db;
-  --onboarding-primary-button-bg: #ffffff;
-  --onboarding-primary-button-text: #0b1220;
-  --onboarding-secondary-button-bg: transparent;
-  --onboarding-secondary-button-text: #e5e7eb;
-  --onboarding-secondary-button-border: #3a4047;
-  --onboarding-step-active: #e5e7eb;
-  --onboarding-step-inactive: #4b5563;
+  --onboarding-title: #e8eaf6;
+  --onboarding-body: #9299b0;
+  --onboarding-step-active: #d8dcf0;
+  --onboarding-step-inactive: #2d3560;
   /* API Keys section colors (dark mode) */
-  --api-keys-card-bg: #2a2f36;
-  --api-keys-card-border: #3a4047;
+  --api-keys-card-bg: #131729;
+  --api-keys-card-border: #1c2340;
   --api-keys-card-shadow: none;
-  --api-keys-input-bg: #1f2329;
-  --api-keys-input-border: #3a4047;
-  --api-keys-button-bg: #3a4047;
-  --api-keys-button-color: #d0d6dc;
+  --api-keys-input-bg: #0d1020;
+  --api-keys-input-border: #1c2340;
 
   /* Code token colors (dark mode - Cursor-like) */
   --code-kw-color: #c792ea; /* purple */
@@ -679,21 +667,21 @@
   --code-num-color: #f78c6c; /* orange */
   --code-com-color: #697098; /* muted gray-blue */
   /* Compare tool specific colors (dark mode) - only for colors that don't have existing theme pairs */
-  --compare-upload-dropzone-bg: rgba(31, 35, 41, 0.45);
-  --compare-upload-dropzone-border: rgba(75, 85, 99, 0.6);
-  --compare-upload-icon-bg: rgba(75, 85, 99, 0.2);
-  --compare-upload-icon-color: rgba(243, 244, 246, 0.75);
-  --compare-upload-divider: rgba(75, 85, 99, 0.5);
+  --compare-upload-dropzone-bg: rgba(9, 11, 24, 0.45);
+  --compare-upload-dropzone-border: rgba(28, 35, 64, 0.6);
+  --compare-upload-icon-bg: rgba(28, 35, 64, 0.2);
+  --compare-upload-icon-color: rgba(232, 234, 246, 0.75);
+  --compare-upload-divider: rgba(28, 35, 64, 0.5);
 
   /* Compare page label chip (dark mode): slightly darker than surrounding rows */
-  --compare-page-label-bg: #1f2329;
+  --compare-page-label-bg: #0d1020;
   --compare-page-label-fg: var(--text-secondary);
 
   /* Status indicator dot ring shadow (dark) */
-  --status-dot-ring: 0 0 0 2px rgba(255, 255, 255, 0.18);
+  --status-dot-ring: 0 0 0 2px rgba(255, 255, 255, 0.15);
 
   /* Input element styling (dark) */
-  --input-bg: #4b525a;
+  --input-bg: #1c2340;
 
   /* Select/dropdown placeholder state (dark) */
   --select-placeholder-bg: var(--mantine-color-dark-5);
@@ -717,11 +705,11 @@
 
 /* Plan section card borders - only override in dark mode */
 [data-mantine-color-scheme="dark"] .plan-card {
-  --paper-border-color: rgb(158, 158, 158) !important;
+  --paper-border-color: rgb(44, 52, 120) !important;
 }
 
 [data-mantine-color-scheme="dark"] .plan-card [data-size="sm"] {
-  color: rgb(221, 221, 221) !important;
+  color: rgb(194, 200, 224) !important;
 }
 
 /* Current plan badge - use light mode green in dark mode */
@@ -736,7 +724,7 @@
 
 [data-mantine-color-scheme="dark"]
   .plan-button:not(:disabled):not([data-disabled]) {
-  background-color: #1c598e !important;
+  background-color: #2040a0 !important;
 }
 
 /* Lighter grey for disabled plan buttons */
@@ -810,16 +798,15 @@
 }
 
 [data-mantine-color-scheme="dark"] {
-  --link-hover-bg: rgba(59, 170, 255, 0.14);
-  --link-hover-border: rgba(59, 170, 255, 0.38);
+  --link-hover-bg: rgba(79, 130, 245, 0.14);
+  --link-hover-border: rgba(79, 130, 245, 0.38);
   --link-hover-shadow:
-    inset 0 0 0 1px rgba(255, 255, 255, 0.14),
-    0 1px 4px rgba(10, 139, 255, 0.18);
-  --link-focus-ring: rgba(59, 170, 255, 0.3);
-  --link-toolbar-bg: rgba(15, 23, 42, 0.92);
-  --link-toolbar-border: rgba(255, 255, 255, 0.08);
+    inset 0 0 0 1px rgba(255, 255, 255, 0.1), 0 1px 4px rgba(79, 142, 245, 0.18);
+  --link-focus-ring: rgba(79, 130, 245, 0.3);
+  --link-toolbar-bg: rgba(9, 11, 24, 0.94);
+  --link-toolbar-border: rgba(255, 255, 255, 0.07);
   --link-toolbar-shadow:
-    0 12px 40px rgba(0, 0, 0, 0.35), 0 4px 12px rgba(0, 0, 0, 0.25),
+    0 12px 40px rgba(0, 0, 0, 0.5), 0 4px 12px rgba(0, 0, 0, 0.35),
     0 0 0 0.5px rgba(255, 255, 255, 0.04);
 }
 
@@ -1004,7 +991,7 @@
 }
 
 [data-theme="dark"] {
-  --shadow-color: rgba(0, 0, 0, 0.75);
+  --shadow-color: rgba(0, 0, 0, 0.88);
 }
 
 /* ---- Wordmark light/dark switching (use instead of JS colorScheme checks) ---- */
diff --git a/frontend/editor/src/core/tests/live/viewer-sidebar-add-buttons.spec.ts b/frontend/editor/src/core/tests/live/viewer-sidebar-add-buttons.spec.ts
index 0f97121b66..df3ce94b23 100644
--- a/frontend/editor/src/core/tests/live/viewer-sidebar-add-buttons.spec.ts
+++ b/frontend/editor/src/core/tests/live/viewer-sidebar-add-buttons.spec.ts
@@ -126,7 +126,9 @@ test.describe("Viewer sidebar add buttons - real PDF round-trip", () => {
     });
     const attachments = doc.getAttachments();
     expect(attachments.length).toBeGreaterThan(0);
-    expect(attachments.map((a) => a.name)).toContain(attachmentName);
+    expect(attachments.map((a: { name?: string }) => a.name)).toContain(
+      attachmentName,
+    );
   });
 
   test("Add bookmark from viewer sidebar adds the bookmark to the produced PDF outline", async ({
diff --git a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
index f72d642a8e..9b66fec1d9 100644
--- a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
@@ -59,7 +59,7 @@ async function mockHardwareEndpoints(page: Page) {
 }
 
 test.describe("CertSign tool - certificate source model", () => {
-  test("renders, accepts a PDF, and exposes the Upload source", async ({
+  test("renders, accepts a PDF, and defaults to upload when no other sources exist", async ({
     page,
   }) => {
     await page.route("**/api/v1/security/cert-sign", (route) =>
@@ -76,10 +76,14 @@ test.describe("CertSign tool - certificate source model", () => {
     await uploadFiles(page, SAMPLE_PDF);
 
     await expect(page).toHaveURL(/\/cert-sign/);
-    // Source step always offers "Upload" (the former "Manual" mode).
+    // With no server/hardware sources, the picker collapses to a hint and the
+    // flow proceeds in the default MANUAL (upload) mode — no lone Upload CTA.
     await expect(
-      page.getByRole("button", { name: /^upload$/i }).first(),
-    ).toBeAttached({ timeout: 10_000 });
+      page.getByText(/no other certificate sources are available/i).first(),
+    ).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole("button", { name: /^upload$/i })).toHaveCount(
+      0,
+    );
   });
 
   test("does NOT offer 'This device' when not running as desktop", async ({
@@ -89,9 +93,10 @@ test.describe("CertSign tool - certificate source model", () => {
     await page.waitForLoadState("domcontentloaded");
     await uploadFiles(page, SAMPLE_PDF);
 
+    // No alternative sources: the picker is a hint, and hardware is never offered.
     await expect(
-      page.getByRole("button", { name: /^upload$/i }).first(),
-    ).toBeAttached({ timeout: 10_000 });
+      page.getByText(/no other certificate sources are available/i).first(),
+    ).toBeVisible({ timeout: 10_000 });
     await expect(
       page.getByRole("button", { name: /this device/i }),
     ).toHaveCount(0);
diff --git a/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts b/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
index aeb6eb0de2..f24e13f312 100644
--- a/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/page-editor-rotation.spec.ts
@@ -93,7 +93,11 @@ test.describe("PageEditor (multitool) rotation save", () => {
     // 4. The exported /Rotate must match what the editor showed: page 3 upright
     //    (0), the untouched pages keeping their source rotation.
     const outDoc = await PDFDocument.load(fs.readFileSync(tmpOut));
-    const outRotations = outDoc.getPages().map((p) => p.getRotation().angle);
+    const outRotations = outDoc
+      .getPages()
+      .map(
+        (p: { getRotation: () => { angle: number } }) => p.getRotation().angle,
+      );
     fs.rmSync(tmpOut, { force: true });
     expect(outRotations).toEqual([0, 90, 0, 180]);
   });
diff --git a/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts b/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
index e2d3ffcb71..c72fbadba0 100644
--- a/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/watermark-tool.spec.ts
@@ -33,11 +33,11 @@ test.describe("Watermark tool — mode selection after upload", () => {
   test("post-upload UI renders mode cards or settings (whatever the chooser is)", async ({
     page,
   }) => {
-    // The chooser may render as Mantine cards or buttons depending on the build.
-    // Either flavour is fine; what we want to catch is "post-upload watermark
-    // page is empty / errored".
+    // The chooser may render as Mantine cards, buttons, or a segmented control
+    // depending on the build. Either flavour is fine; what we want to catch is
+    // "post-upload watermark page is empty / errored".
     const choices = page.locator(
-      '.mantine-Card-root, button:has-text("Text"), button:has-text("Image"), button:has-text("File")',
+      '.mantine-Card-root, .mantine-SegmentedControl-root label, button:has-text("Text"), button:has-text("Image"), button:has-text("File")',
     );
     await expect
       .poll(async () => choices.count(), { timeout: 10_000 })
diff --git a/frontend/editor/src/core/theme/mantineTheme.ts b/frontend/editor/src/core/theme/mantineTheme.ts
index 061ac0e819..374c3c1a79 100644
--- a/frontend/editor/src/core/theme/mantineTheme.ts
+++ b/frontend/editor/src/core/theme/mantineTheme.ts
@@ -58,6 +58,23 @@ const gray: MantineColorsTuple = [
   "var(--color-gray-900)",
 ];
 
+// Navy-indigo dark scale — replaces Mantine's neutral gray defaults so all
+// dark-mode components (SegmentedControl, inputs, dropdowns, etc.) use the
+// portal palette automatically via --mantine-color-dark-*.
+// dark-0..3 = text/icon shades, dark-4..7 = surface elevations, dark-8..9 = deepest bg.
+const dark: MantineColorsTuple = [
+  "#c2c8e0", // dark-0  — primary text on dark bg
+  "#9299b0", // dark-1  — secondary text
+  "#6e7898", // dark-2  — muted text / icons
+  "#4a5282", // dark-3  — subtle text / dividers
+  "#1c2340", // dark-4  — elevated surface / selected bg (e.g. SegmentedControl indicator)
+  "#131729", // dark-5  — card / panel surface
+  "#0d1020", // dark-6  — toolbar / sidebar bg (e.g. SegmentedControl root)
+  "#090b18", // dark-7  — page background (deepest reachable surface)
+  "#07091a", // dark-8
+  "#050714", // dark-9
+];
+
 export const mantineTheme = createTheme({
   // Primary color
   primaryColor: "primary",
@@ -68,6 +85,7 @@ export const mantineTheme = createTheme({
     green,
     yellow,
     gray,
+    dark,
   },
 
   // Spacing system - uses CSS variables
diff --git a/frontend/editor/src/core/tokens/tokens.css b/frontend/editor/src/core/tokens/tokens.css
index c8ba2171a0..189b88cb8e 100644
--- a/frontend/editor/src/core/tokens/tokens.css
+++ b/frontend/editor/src/core/tokens/tokens.css
@@ -117,6 +117,8 @@
   --color-toggle-off: #cbd5e1;
   --color-badge-red: #ef4444;
 
+  /* Segmented control — semantic tokens so dark mode can decouple from blue surfaces */
+
   /* Shadows */
   --shadow-sm: inset 0 0 0 1px #e3e8ee;
   --shadow-md: inset 0 0 0 1px #e3e8ee, 0 1px 2px rgba(15, 23, 42, 0.04);
@@ -241,6 +243,8 @@
 
   --color-toggle-off: #3d4f6a;
 
+  /* Segmented control — blue-toned dark to match app surface colors */
+
   --shadow-sm: inset 0 0 0 1px #283248;
   --shadow-md: inset 0 0 0 1px #283248, 0 1px 3px rgba(0, 0, 0, 0.3);
   --shadow-lg: inset 0 0 0 1px #283248, 0 8px 24px rgba(0, 0, 0, 0.4);
@@ -405,6 +409,15 @@
   }
 }
 
+/* Default transition set (avoids text-colour transitions); not !important so components can override. */
+*,
+*::before,
+*::after {
+  transition-property:
+    background, background-color, border, border-color, box-shadow, opacity,
+    transform, fill, stroke, outline-color;
+}
+
 /* Visually-hidden utility for content meant only for screen readers. */
 .sr-only {
   position: absolute;
diff --git a/frontend/editor/src/core/tools/AddStamp.tsx b/frontend/editor/src/core/tools/AddStamp.tsx
index 9a7422188e..6070ae5e89 100644
--- a/frontend/editor/src/core/tools/AddStamp.tsx
+++ b/frontend/editor/src/core/tools/AddStamp.tsx
@@ -126,7 +126,6 @@ const AddStamp = ({ onPreviewFile, onComplete, onError }: BaseToolProps) => {
                 },
               ]}
               disabled={endpointLoading}
-              buttonClassName={styles.modeToggleButton}
               textClassName={styles.modeToggleButtonText}
             />
           )}
diff --git a/frontend/editor/src/core/tools/Compare.tsx b/frontend/editor/src/core/tools/Compare.tsx
index 81cf263ded..b555ecfb9b 100644
--- a/frontend/editor/src/core/tools/Compare.tsx
+++ b/frontend/editor/src/core/tools/Compare.tsx
@@ -2,15 +2,9 @@ import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import CompareRoundedIcon from "@mui/icons-material/CompareRounded";
 import CloseIcon from "@mui/icons-material/Close";
-import {
-  Box,
-  Group,
-  Stack,
-  Text,
-  Button,
-  Modal,
-  ActionIcon,
-} from "@mantine/core";
+import { Box, Group, Stack, Text, Modal } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import SwapVertRoundedIcon from "@mui/icons-material/SwapVertRounded";
 import { createToolFlow } from "@app/components/tools/shared/createToolFlow";
 import { useBaseTool } from "@app/hooks/tools/shared/useBaseTool";
@@ -33,7 +27,7 @@ import type { CompareWorkbenchData } from "@app/types/compare";
 import { getDefaultWorkbench } from "@app/types/workbench";
 import { truncateCenter } from "@app/utils/textUtils";
 import {
-  FileSelectorPicker,
+  FileSelectorPicker as PopoverFileSelector,
   FileSelectorResult,
 } from "@app/components/shared/FileSelectorPicker";
 import "@app/components/tools/compare/compareView.css";
@@ -373,9 +367,14 @@ const Compare = (props: BaseToolProps) => {
             }}
           >
             <ActionIcon
-              variant="subtle"
-              size="xs"
-              style={{ position: "absolute", top: "0.5rem", right: "0.5rem" }}
+              variant="tertiary"
+              accent="neutral"
+              size="sm"
+              style={{
+                position: "absolute",
+                top: "0.5rem",
+                right: "0.5rem",
+              }}
               onClick={() => clearSlot(role)}
               aria-label={t("compare.clearSlot", "Remove file")}
             >
@@ -421,7 +420,7 @@ const Compare = (props: BaseToolProps) => {
           data-slot-state="empty"
           style={{ width: "100%" }}
         >
-          <FileSelectorPicker
+          <PopoverFileSelector
             testId={`compare-slot-${role}-add`}
             placeholder={
               isDisabled
@@ -479,12 +478,12 @@ const Compare = (props: BaseToolProps) => {
           <Stack gap="sm" className="compare-step-selection">
             <div className="compare-step-selection__clear-row">
               <Button
-                variant="subtle"
-                size="compact-xs"
+                variant="tertiary"
+                size="sm"
                 onClick={() => setClearConfirmOpen(true)}
                 disabled={!hasAnySelected}
-                styles={{ root: { textDecoration: "underline" } }}
                 style={{
+                  textDecoration: "underline",
                   background: !hasAnySelected ? "transparent" : undefined,
                   color: !hasAnySelected
                     ? "var(--spdf-clear-disabled-text)"
@@ -509,8 +508,7 @@ const Compare = (props: BaseToolProps) => {
               </Stack>
 
               {hasBothSelected && (
-                <button
-                  type="button"
+                <Button
                   className="compare-step-selection__swap"
                   onClick={handleSwap}
                   disabled={base.operation.isLoading}
@@ -523,7 +521,7 @@ const Compare = (props: BaseToolProps) => {
                   <span className="compare-step-selection__swap-label">
                     {t("compare.swap.label", "Swap")}
                   </span>
-                </button>
+                </Button>
               )}
             </div>
 
@@ -543,13 +541,12 @@ const Compare = (props: BaseToolProps) => {
                 </Text>
                 <Group justify="flex-end" gap="sm">
                   <Button
-                    variant="light"
+                    variant="secondary"
                     onClick={() => setSwapConfirmOpen(false)}
                   >
                     {t("cancel", "Cancel")}
                   </Button>
                   <Button
-                    variant="filled"
                     onClick={() => {
                       setSwapConfirmOpen(false);
                       performSwap();
@@ -577,13 +574,13 @@ const Compare = (props: BaseToolProps) => {
                 </Text>
                 <Group justify="flex-end" gap="sm">
                   <Button
-                    variant="light"
+                    variant="secondary"
                     onClick={() => setClearConfirmOpen(false)}
                   >
                     {t("cancel", "Cancel")}
                   </Button>
                   <Button
-                    variant="filled"
+                    accent="danger"
                     onClick={() => {
                       setClearConfirmOpen(false);
                       performClearSelected();
diff --git a/frontend/editor/src/core/tools/GetPdfInfo.tsx b/frontend/editor/src/core/tools/GetPdfInfo.tsx
index 9a9d4b4b63..7407c064ec 100644
--- a/frontend/editor/src/core/tools/GetPdfInfo.tsx
+++ b/frontend/editor/src/core/tools/GetPdfInfo.tsx
@@ -2,7 +2,8 @@ import { useEffect, useMemo, useRef } from "react";
 import { useTranslation } from "react-i18next";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import LinkIcon from "@mui/icons-material/Link";
-import { Stack, Group, Divider, Text, UnstyledButton } from "@mantine/core";
+import { Stack, Divider, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { createToolFlow } from "@app/components/tools/shared/createToolFlow";
 import { useBaseTool } from "@app/hooks/tools/shared/useBaseTool";
 import { BaseToolProps, ToolComponent } from "@app/types/tool";
@@ -177,7 +178,10 @@ const GetPdfInfo = (props: BaseToolProps) => {
           <Stack gap={0}>
             {CHAPTERS.map((c, idx) => (
               <Stack key={c.id} gap={0}>
-                <UnstyledButton
+                <Button
+                  variant="tertiary"
+                  fullWidth
+                  justify="start"
                   onClick={() => {
                     if (!reportData) return;
                     setCustomWorkbenchViewData(REPORT_VIEW_ID, {
@@ -188,19 +192,15 @@ const GetPdfInfo = (props: BaseToolProps) => {
                       navigationActions.setWorkbench(REPORT_WORKBENCH_ID);
                     }
                   }}
-                  style={{
-                    width: "100%",
-                    textAlign: "left",
-                    padding: "8px 4px",
-                  }}
-                >
-                  <Group justify="flex-start" gap="sm">
+                  style={{ padding: "8px 4px" }}
+                  leftSection={
                     <LinkIcon fontSize="small" style={{ opacity: 0.7 }} />
-                    <Text size="md" c="dimmed">
-                      {t(c.labelKey, c.fallback)}
-                    </Text>
-                  </Group>
-                </UnstyledButton>
+                  }
+                >
+                  <Text size="md" c="dimmed">
+                    {t(c.labelKey, c.fallback)}
+                  </Text>
+                </Button>
                 {idx < CHAPTERS.length - 1 && <Divider my={6} />}
               </Stack>
             ))}
diff --git a/frontend/editor/src/core/tools/Merge.tsx b/frontend/editor/src/core/tools/Merge.tsx
index 9138dfa4f0..ae2bed26fe 100644
--- a/frontend/editor/src/core/tools/Merge.tsx
+++ b/frontend/editor/src/core/tools/Merge.tsx
@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useRef } from "react";
 import { useTranslation } from "react-i18next";
-import { Button, Stack, Text } from "@mantine/core";
+import { Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { createToolFlow } from "@app/components/tools/shared/createToolFlow";
 import MergeSettings from "@app/components/tools/merge/MergeSettings";
 import MergeFileSorter from "@app/components/tools/merge/MergeFileSorter";
@@ -181,8 +182,8 @@ const Merge = (props: BaseToolProps) => {
             )}
           </Text>
           <Button
-            variant="light"
-            size="xs"
+            variant="secondary"
+            size="sm"
             onClick={() => navActions.setWorkbench("fileEditor")}
           >
             {t("merge.goToFileEditor", "Go to file editor")}
diff --git a/frontend/editor/src/core/tools/SharedSign.tsx b/frontend/editor/src/core/tools/SharedSign.tsx
index 82b5787c41..5131db40c3 100644
--- a/frontend/editor/src/core/tools/SharedSign.tsx
+++ b/frontend/editor/src/core/tools/SharedSign.tsx
@@ -2,16 +2,16 @@ import { useMemo, useState } from "react";
 import {
   Alert,
   Badge,
-  Button,
   Center,
-  Chip,
   Group,
   Loader,
   Paper,
-  SegmentedControl,
   Stack,
   Text,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { Chip } from "@app/ui/Chip";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import AddIcon from "@mui/icons-material/Add";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
@@ -164,8 +164,8 @@ const SharedSign = (_props: BaseToolProps) => {
       <Stack p="md" gap="md">
         <Group>
           <Button
-            variant="subtle"
-            size="compact-sm"
+            variant="tertiary"
+            size="sm"
             leftSection={<ArrowBackIcon sx={{ fontSize: "1rem" }} />}
             onClick={() => setShowCreate(false)}
           >
@@ -248,7 +248,7 @@ const SharedSign = (_props: BaseToolProps) => {
         fullWidth
         value={tab}
         onChange={(value) => changeTab(value as Tab)}
-        data={[
+        options={[
           { label: t("sharedSign.tab.active", "Active"), value: "active" },
           {
             label: t("sharedSign.tab.completed", "Completed"),
@@ -258,22 +258,34 @@ const SharedSign = (_props: BaseToolProps) => {
       />
 
       <Button
-        variant="light"
+        variant="tertiary"
         leftSection={<AddIcon sx={{ fontSize: "1.1rem" }} />}
         onClick={() => setShowCreate(true)}
       >
         {t("sharedSign.newRequest", "Request signatures")}
       </Button>
 
-      <Chip.Group multiple value={filters} onChange={setFilters}>
-        <Group gap="xs">
-          {filterOptions.map((f) => (
-            <Chip key={f.key} value={f.key} size="xs" radius="sm">
+      <Group gap="xs">
+        {filterOptions.map((f) => {
+          const active = filters.includes(f.key);
+          return (
+            <Chip
+              key={f.key}
+              size="xs"
+              variant={active ? "primary" : "secondary"}
+              onClick={() =>
+                setFilters((prev) =>
+                  prev.includes(f.key)
+                    ? prev.filter((k) => k !== f.key)
+                    : [...prev, f.key],
+                )
+              }
+            >
               {f.label}
             </Chip>
-          ))}
-        </Group>
-      </Chip.Group>
+          );
+        })}
+      </Group>
 
       {controller.loading && items.length === 0 ? (
         <Center py="xl">
diff --git a/frontend/editor/src/core/tools/annotate/AnnotationPanel.tsx b/frontend/editor/src/core/tools/annotate/AnnotationPanel.tsx
index 17f2e028c0..6986f4d7e4 100644
--- a/frontend/editor/src/core/tools/annotate/AnnotationPanel.tsx
+++ b/frontend/editor/src/core/tools/annotate/AnnotationPanel.tsx
@@ -4,17 +4,17 @@ import { useTranslation } from "react-i18next";
 import {
   Text,
   Group,
-  ActionIcon,
   Stack,
   Slider,
   Box,
   Tooltip as MantineTooltip,
-  Button,
   Tooltip,
   Paper,
   Menu,
   Modal,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import {
   ColorPicker,
@@ -365,12 +365,10 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
         <MantineTooltip key={tool.id} label={tool.label} withArrow>
           <ActionIcon
             variant={
-              activeTool === tool.id && annotationsVisible ? "filled" : "subtle"
+              activeTool === tool.id && annotationsVisible
+                ? "primary"
+                : "tertiary"
             }
-            color={
-              activeTool === tool.id && annotationsVisible ? "blue" : undefined
-            }
-            radius="md"
             onClick={() => activateAnnotationTool(tool.id)}
             disabled={!annotationsVisible}
             aria-label={tool.label}
@@ -641,9 +639,12 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                   </Text>
                   <Group gap="xs">
                     <ActionIcon
-                      variant={textAlignment === "left" ? "filled" : "default"}
+                      variant={
+                        textAlignment === "left" ? "primary" : "secondary"
+                      }
                       onClick={() => setTextAlignment("left")}
                       size="md"
+                      aria-label={t("annotation.alignLeft", "Align left")}
                     >
                       <LocalIcon
                         icon="format-align-left"
@@ -653,10 +654,11 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                     </ActionIcon>
                     <ActionIcon
                       variant={
-                        textAlignment === "center" ? "filled" : "default"
+                        textAlignment === "center" ? "primary" : "secondary"
                       }
                       onClick={() => setTextAlignment("center")}
                       size="md"
+                      aria-label={t("annotation.alignCenter", "Align center")}
                     >
                       <LocalIcon
                         icon="format-align-center"
@@ -665,9 +667,12 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                       />
                     </ActionIcon>
                     <ActionIcon
-                      variant={textAlignment === "right" ? "filled" : "default"}
+                      variant={
+                        textAlignment === "right" ? "primary" : "secondary"
+                      }
                       onClick={() => setTextAlignment("right")}
                       size="md"
+                      aria-label={t("annotation.alignRight", "Align right")}
                     >
                       <LocalIcon
                         icon="format-align-right"
@@ -691,8 +696,8 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                       }}
                     />
                     <Button
-                      size="xs"
-                      variant={textBackgroundColor ? "light" : "default"}
+                      size="sm"
+                      variant="secondary"
                       onClick={() => {
                         setTextBackgroundColor("");
                         annotationApiRef?.current?.setAnnotationStyle?.(
@@ -739,8 +744,8 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                     }}
                   />
                   <Button
-                    size="xs"
-                    variant={noteBackgroundColor ? "light" : "default"}
+                    size="sm"
+                    variant="secondary"
                     onClick={() => {
                       setNoteBackgroundColor("");
                       annotationApiRef?.current?.setAnnotationStyle?.(
@@ -814,8 +819,8 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
                         />
                       </Box>
                       <Button
-                        size="xs"
-                        variant={shapeThickness === 0 ? "filled" : "light"}
+                        size="sm"
+                        variant={shapeThickness === 0 ? "primary" : "tertiary"}
                         onClick={() =>
                           setShapeThickness(shapeThickness === 0 ? 1 : 0)
                         }
@@ -1179,30 +1184,22 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
         <Tooltip
           label={t("annotation.selectAndMove", "Select and edit annotations")}
         >
-          <ActionIcon
+          <Button
             variant={
               activeTool === "select" && annotationsVisible
-                ? "filled"
-                : "default"
+                ? "primary"
+                : "secondary"
             }
-            size="lg"
             disabled={!annotationsVisible}
             onClick={() => {
               activateAnnotationTool("select");
             }}
-            style={{
-              width: "auto",
-              paddingInline: "0.75rem",
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-            }}
+            leftSection={
+              <LocalIcon icon="touch-app-rounded" width={20} height={20} />
+            }
           >
-            <LocalIcon icon="touch-app-rounded" width={20} height={20} />
-            <Text component="span" size="sm" fw={500}>
-              {t("annotation.selectAndMove", "Select and Edit")}
-            </Text>
-          </ActionIcon>
+            {t("annotation.selectAndMove", "Select and Edit")}
+          </Button>
         </Tooltip>
 
         <DrawingControls
@@ -1216,7 +1213,7 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
               <Menu.Target>
                 <Tooltip label={t("annotation.moreActions", "More actions")}>
                   <ActionIcon
-                    variant="subtle"
+                    variant="tertiary"
                     size="lg"
                     disabled={isApplyingChanges}
                     aria-label={t("annotation.moreActions", "More actions")}
@@ -1287,15 +1284,12 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
       <Button
         fullWidth
         size="md"
-        radius="md"
-        mt="sm"
-        variant="filled"
-        color="blue"
         disabled={
           applyDisabled || isApplyingChanges || isClearingDocumentAnnotations
         }
         loading={isApplyingChanges}
         onClick={() => void handleApplyChangesClick()}
+        style={{ marginTop: "0.75rem" }}
       >
         {t("annotation.saveChanges", "Save Changes")}
       </Button>
@@ -1324,14 +1318,13 @@ export function AnnotationPanel(props: AnnotationPanelProps) {
           </Text>
           <Group justify="flex-end">
             <Button
-              variant="default"
               disabled={isClearingDocumentAnnotations}
               onClick={() => setIsClearDocumentModalOpen(false)}
             >
               {t("common.cancel", "Cancel")}
             </Button>
             <Button
-              color="red"
+              accent="danger"
               loading={isClearingDocumentAnnotations}
               disabled={isApplyingChanges}
               leftSection={
diff --git a/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx b/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
index 3623757c66..2e49991ceb 100644
--- a/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
@@ -8,14 +8,8 @@
  * - Better visual hierarchy and spacing
  */
 import React, { useCallback, useEffect, useRef } from "react";
-import {
-  Box,
-  Text,
-  ScrollArea,
-  Badge,
-  Tooltip,
-  ActionIcon,
-} from "@mantine/core";
+import { Box, Text, ScrollArea, Badge, Tooltip } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { useFormFill } from "@app/tools/formFill/FormFillContext";
 import { FieldInput } from "@app/tools/formFill/FieldInput";
@@ -116,7 +110,7 @@ export function FormFieldSidebar({ visible, onToggle }: FormFieldSidebarProps) {
           </Badge>
         </div>
         <ActionIcon
-          variant="subtle"
+          variant="tertiary"
           size="sm"
           onClick={onToggle}
           aria-label={t("formFill.sidebar.close", "Close sidebar")}
diff --git a/frontend/editor/src/core/tools/formFill/FormFill.tsx b/frontend/editor/src/core/tools/formFill/FormFill.tsx
index 0e4829df69..a99f990f33 100644
--- a/frontend/editor/src/core/tools/formFill/FormFill.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormFill.tsx
@@ -17,7 +17,6 @@ import React, {
   useMemo,
 } from "react";
 import {
-  Button,
   Text,
   Alert,
   Switch,
@@ -25,8 +24,9 @@ import {
   ScrollArea,
   Progress,
   Tooltip,
-  ActionIcon,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import { isAxiosError } from "axios";
 import {
@@ -510,7 +510,7 @@ const FormFill = (_props: BaseToolProps) => {
                   <div className={styles.primaryActions}>
                     <Button
                       leftSection={<SaveIcon sx={{ fontSize: 14 }} />}
-                      size="xs"
+                      size="sm"
                       onClick={handleSave}
                       loading={saving}
                       disabled={!formState.isDirty && !flattenChanged}
@@ -524,7 +524,7 @@ const FormFill = (_props: BaseToolProps) => {
                       position="bottom"
                     >
                       <ActionIcon
-                        variant="light"
+                        variant="secondary"
                         size="md"
                         onClick={handleRefresh}
                         aria-label={t(
@@ -539,34 +539,31 @@ const FormFill = (_props: BaseToolProps) => {
 
                   <div className={styles.secondaryActions}>
                     <Button
-                      variant="light"
-                      color="blue"
+                      variant="secondary"
                       leftSection={<FileDownloadIcon sx={{ fontSize: 14 }} />}
                       loading={extracting}
                       onClick={handleExtractJson}
-                      size="xs"
+                      size="sm"
                     >
                       JSON
                     </Button>
 
                     <Button
-                      variant="light"
-                      color="blue"
+                      variant="secondary"
                       leftSection={<FileDownloadIcon sx={{ fontSize: 14 }} />}
                       loading={extracting}
                       onClick={handleExtractCsv}
-                      size="xs"
+                      size="sm"
                     >
                       CSV
                     </Button>
 
                     <Button
-                      variant="light"
-                      color="blue"
+                      variant="secondary"
                       leftSection={<FileDownloadIcon sx={{ fontSize: 14 }} />}
                       loading={extracting}
                       onClick={handleExtractXlsx}
-                      size="xs"
+                      size="sm"
                     >
                       XLSX
                     </Button>
diff --git a/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx b/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
index d6186af566..da8cfc785a 100644
--- a/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
@@ -10,20 +10,14 @@
  * save UX that users expect from browser PDF viewers.
  */
 import React, { useCallback, useState } from "react";
-import {
-  Stack,
-  Group,
-  Text,
-  Button,
-  Transition,
-  CloseButton,
-  Paper,
-  Badge,
-} from "@mantine/core";
+import { Stack, Group, Text, Transition, Paper, Badge } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import DownloadIcon from "@mui/icons-material/Download";
 import SaveIcon from "@mui/icons-material/Save";
 import EditNoteIcon from "@mui/icons-material/EditNote";
+import CloseIcon from "@mui/icons-material/Close";
 import { useFormFill } from "@app/tools/formFill/FormFillContext";
 import { downloadFileWithPolicy } from "@app/services/exportWithPolicy";
 
@@ -160,37 +154,36 @@ export function FormSaveBar({
                     </Text>
                   </div>
                 </Group>
-                <CloseButton
+                <ActionIcon
                   size="sm"
-                  variant="subtle"
+                  variant="tertiary"
                   onClick={() => setDismissed(true)}
                   aria-label={t("viewer.formBar.dismiss", "Dismiss")}
-                />
+                >
+                  <CloseIcon sx={{ fontSize: 16 }} />
+                </ActionIcon>
               </Group>
 
               {isDirty && (
                 <Group gap="xs" mt="xs">
                   <Button
                     size="sm"
-                    variant="light"
-                    color="blue"
+                    variant="secondary"
                     leftSection={<SaveIcon sx={{ fontSize: 18 }} />}
                     loading={applying}
                     disabled={saving}
                     onClick={handleApply}
-                    flex={1}
+                    style={{ flex: 1 }}
                   >
                     {t("viewer.formBar.apply", "Apply Changes")}
                   </Button>
                   <Button
                     size="sm"
-                    variant="filled"
-                    color="blue"
                     leftSection={<DownloadIcon sx={{ fontSize: 18 }} />}
                     loading={saving}
                     disabled={applying}
                     onClick={handleDownload}
-                    flex={1}
+                    style={{ flex: 1 }}
                   >
                     {t("viewer.formBar.download", "Download PDF")}
                   </Button>
diff --git a/frontend/editor/src/core/ui/ActionIcon.css b/frontend/editor/src/core/ui/ActionIcon.css
new file mode 100644
index 0000000000..1a56a484e2
--- /dev/null
+++ b/frontend/editor/src/core/ui/ActionIcon.css
@@ -0,0 +1,21 @@
+/* Mantine ActionIcon-backed — colour driven by the shared accent palette (accents.css). */
+@import "./accents.css";
+
+/* ---- shape ---- */
+.sui-ai--circle.mantine-ActionIcon-root {
+  --ai-radius: 50%;
+}
+.sui-ai--pill.mantine-ActionIcon-root {
+  --ai-radius: 9999px;
+}
+
+/* ---- gradient accents: brighten on hover instead of a hard bg swap ---- */
+.sui-acc-ai.sui-ai--primary:not([data-disabled]):hover,
+.sui-acc-premium.sui-ai--primary:not([data-disabled]):hover {
+  filter: brightness(1.06);
+}
+
+/* no-hover: !important to beat Mantine's own :hover background rule. */
+.sui-ai--no-hover:not([data-disabled]):hover {
+  background: var(--ai-bg, transparent) !important;
+}
diff --git a/frontend/editor/src/core/ui/ActionIcon.stories.tsx b/frontend/editor/src/core/ui/ActionIcon.stories.tsx
new file mode 100644
index 0000000000..a4df1359dc
--- /dev/null
+++ b/frontend/editor/src/core/ui/ActionIcon.stories.tsx
@@ -0,0 +1,132 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { ActionIcon } from "@app/ui/ActionIcon";
+
+const Plus = () => (
+  <svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" aria-hidden>
+    <path
+      d="M12 5v14M5 12h14"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+    />
+  </svg>
+);
+const Trash = () => (
+  <svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" aria-hidden>
+    <path
+      d="M5 7h14M10 7V5h4v2m-8 0 1 13h6l1-13"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+
+const ACCENTS = [
+  "default",
+  "neutral",
+  "brand",
+  "ai",
+  "premium",
+  "danger",
+  "success",
+  "warning",
+] as const;
+
+const meta: Meta<typeof ActionIcon> = {
+  title: "Primitives/ActionIcon",
+  component: ActionIcon,
+  parameters: { layout: "centered" },
+  args: {
+    variant: "primary",
+    accent: "default",
+    size: "md",
+    "aria-label": "Add",
+  },
+  argTypes: {
+    variant: {
+      control: "inline-radio",
+      options: ["primary", "secondary", "tertiary", "quiet"],
+    },
+    accent: { control: "inline-radio", options: ACCENTS },
+    size: { control: "inline-radio", options: ["sm", "md", "lg", "xl"] },
+    shape: { control: "inline-radio", options: ["default", "circle", "pill"] },
+  },
+};
+export default meta;
+type Story = StoryObj<typeof ActionIcon>;
+
+const Wrap = ({ children }: { children: React.ReactNode }) => (
+  <div style={{ display: "flex", gap: 12, alignItems: "center" }}>
+    {children}
+  </div>
+);
+
+export const Playground: Story = {
+  render: (args) => (
+    <ActionIcon {...args}>
+      <Plus />
+    </ActionIcon>
+  ),
+};
+
+/** The three variants × every accent. */
+export const Accents: Story = {
+  render: () => (
+    <div
+      style={{
+        display: "grid",
+        gridTemplateColumns: "repeat(8, auto)",
+        gap: 10,
+      }}
+    >
+      {(["primary", "secondary", "tertiary"] as const).flatMap((variant) =>
+        ACCENTS.map((accent) => (
+          <ActionIcon
+            key={`${variant}-${accent}`}
+            variant={variant}
+            accent={accent}
+            aria-label={accent}
+          >
+            <Plus />
+          </ActionIcon>
+        )),
+      )}
+    </div>
+  ),
+};
+
+/** Square at every size; the icon scales with `1em`. */
+export const Sizes: Story = {
+  render: () => (
+    <Wrap>
+      {(["sm", "md", "lg", "xl"] as const).map((size) => (
+        <ActionIcon key={size} size={size} aria-label={`Add ${size}`}>
+          <Plus />
+        </ActionIcon>
+      ))}
+    </Wrap>
+  ),
+};
+
+export const Shapes: Story = {
+  render: () => (
+    <Wrap>
+      <ActionIcon shape="default" aria-label="Add">
+        <Plus />
+      </ActionIcon>
+      <ActionIcon shape="circle" variant="secondary" aria-label="Add">
+        <Plus />
+      </ActionIcon>
+      <ActionIcon
+        shape="circle"
+        variant="tertiary"
+        accent="danger"
+        aria-label="Delete"
+      >
+        <Trash />
+      </ActionIcon>
+    </Wrap>
+  ),
+};
diff --git a/frontend/editor/src/core/ui/ActionIcon.tsx b/frontend/editor/src/core/ui/ActionIcon.tsx
new file mode 100644
index 0000000000..44584be569
--- /dev/null
+++ b/frontend/editor/src/core/ui/ActionIcon.tsx
@@ -0,0 +1,140 @@
+import { ActionIcon as MantineActionIcon } from "@mantine/core";
+import { forwardRef } from "react";
+import type {
+  ComponentPropsWithoutRef,
+  CSSProperties,
+  ElementType,
+  ReactNode,
+} from "react";
+import { CONTROL_HEIGHT } from "@app/ui/controlSizes";
+import "@app/ui/ActionIcon.css";
+
+/** Icon-only button (square) — same variant/accent dials as Button. */
+export type ActionIconVariant = "primary" | "secondary" | "tertiary" | "quiet";
+export type ActionIconAccent =
+  | "default"
+  | "neutral"
+  | "brand"
+  | "ai"
+  | "premium"
+  | "danger"
+  | "success"
+  | "warning";
+export type ActionIconSize = "sm" | "md" | "lg" | "xl";
+export type ActionIconShape = "default" | "circle" | "pill";
+
+type ActionIconOwnProps = {
+  variant?: ActionIconVariant;
+  accent?: ActionIconAccent;
+  size?: ActionIconSize;
+  shape?: ActionIconShape;
+  /** Required — an icon-only control must have an accessible name. */
+  "aria-label": string;
+  loading?: boolean;
+  /** false = no hover background change. */
+  hover?: boolean;
+  /** Polymorphic root element (e.g. `"a"` or a router Link). */
+  as?: ElementType;
+  style?: CSSProperties;
+  /** The icon. */
+  children?: ReactNode;
+};
+
+export type ActionIconProps = ActionIconOwnProps &
+  Omit<
+    ComponentPropsWithoutRef<"button">,
+    keyof ActionIconOwnProps | "color"
+  > & {
+    href?: string;
+    target?: string;
+    rel?: string;
+  };
+
+const MANTINE_VARIANT: Record<ActionIconVariant, string> = {
+  primary: "filled",
+  secondary: "outline",
+  tertiary: "subtle",
+  quiet: "subtle",
+};
+
+export const ActionIcon = forwardRef<HTMLButtonElement, ActionIconProps>(
+  function ActionIcon(
+    {
+      variant = "primary",
+      accent = "default",
+      size = "md",
+      shape = "default",
+      loading = false,
+      hover = true,
+      as,
+      disabled,
+      className,
+      style,
+      children,
+      ...rest
+    },
+    ref,
+  ) {
+    const classes = [
+      "sui-ai",
+      `sui-acc-${accent}`,
+      `sui-ai--${variant}`,
+      shape !== "default" ? `sui-ai--${shape}` : "",
+      !hover ? "sui-ai--no-hover" : "",
+      className ?? "",
+    ]
+      .filter(Boolean)
+      .join(" ");
+
+    // Accent palette → Mantine ActionIcon vars (inline to win). --ai-bd is a full `border` shorthand.
+    const accentVars =
+      variant === "primary"
+        ? {
+            "--ai-bg": "var(--_solid)",
+            "--ai-hover": "var(--_solid-hover)",
+            "--ai-color": "var(--_on)",
+            "--ai-bd": "1px solid transparent",
+          }
+        : variant === "quiet"
+          ? {
+              "--ai-bg": "transparent",
+              "--ai-hover": "transparent",
+              "--ai-color": "var(--_text)",
+              "--ai-hover-color": "var(--color-text-1)",
+              "--ai-bd": "1px solid transparent",
+            }
+          : {
+              "--ai-bg": "transparent",
+              "--ai-hover": "var(--_tint)",
+              "--ai-color": "var(--_text)",
+              "--ai-bd":
+                variant === "secondary"
+                  ? "1px solid var(--_bd)"
+                  : "1px solid transparent",
+            };
+
+    // Loosely-typed alias so the polymorphic `component={as}` doesn't fight Mantine's typing.
+    const Comp = MantineActionIcon as ElementType;
+
+    return (
+      <Comp
+        {...rest}
+        ref={ref}
+        component={as}
+        variant={MANTINE_VARIANT[variant]}
+        size={size}
+        loading={loading}
+        disabled={disabled}
+        className={classes}
+        style={{
+          ...(accentVars as CSSProperties),
+          // Match Button's height per size (inline so it beats Mantine's --ai-size).
+          ...({ "--ai-size": CONTROL_HEIGHT[size] } as CSSProperties),
+          ...style,
+        }}
+      >
+        {children}
+      </Comp>
+    );
+  },
+);
diff --git a/frontend/editor/src/proprietary/ui/Avatar.css b/frontend/editor/src/core/ui/Avatar.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Avatar.css
rename to frontend/editor/src/core/ui/Avatar.css
diff --git a/frontend/editor/src/proprietary/ui/Avatar.stories.tsx b/frontend/editor/src/core/ui/Avatar.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Avatar.stories.tsx
rename to frontend/editor/src/core/ui/Avatar.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Avatar.tsx b/frontend/editor/src/core/ui/Avatar.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Avatar.tsx
rename to frontend/editor/src/core/ui/Avatar.tsx
diff --git a/frontend/editor/src/proprietary/ui/Banner.css b/frontend/editor/src/core/ui/Banner.css
similarity index 85%
rename from frontend/editor/src/proprietary/ui/Banner.css
rename to frontend/editor/src/core/ui/Banner.css
index 7d249295b4..937905a915 100644
--- a/frontend/editor/src/proprietary/ui/Banner.css
+++ b/frontend/editor/src/core/ui/Banner.css
@@ -76,19 +76,10 @@
   align-items: center;
 }
 
+/* Sizing/background/hover are owned by the ActionIcon; this just keeps it from
+ * stretching and sizes the × glyph. */
 .sui-banner__close {
   flex: 0 0 auto;
-  width: 1.5rem;
-  height: 1.5rem;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: var(--radius-sm);
-  color: var(--color-text-4);
-  font-size: 1rem;
+  font-size: 1.125rem;
   line-height: 1;
 }
-.sui-banner__close:hover {
-  background: rgba(0, 0, 0, 0.06);
-  color: var(--color-text-1);
-}
diff --git a/frontend/editor/src/proprietary/ui/Banner.stories.tsx b/frontend/editor/src/core/ui/Banner.stories.tsx
similarity index 96%
rename from frontend/editor/src/proprietary/ui/Banner.stories.tsx
rename to frontend/editor/src/core/ui/Banner.stories.tsx
index c6b8ddfd1e..891cf66b78 100644
--- a/frontend/editor/src/proprietary/ui/Banner.stories.tsx
+++ b/frontend/editor/src/core/ui/Banner.stories.tsx
@@ -39,7 +39,7 @@ export const WithAction: Story = {
     title: "Approaching cap",
     description: "389k of 500k docs processed.",
     action: (
-      <Button size="sm" variant="outline" accent="amber">
+      <Button size="sm" variant="secondary" accent="warning">
         Upgrade
       </Button>
     ),
diff --git a/frontend/editor/src/proprietary/ui/Banner.tsx b/frontend/editor/src/core/ui/Banner.tsx
similarity index 71%
rename from frontend/editor/src/proprietary/ui/Banner.tsx
rename to frontend/editor/src/core/ui/Banner.tsx
index b7db925740..ca89f57aab 100644
--- a/frontend/editor/src/proprietary/ui/Banner.tsx
+++ b/frontend/editor/src/core/ui/Banner.tsx
@@ -1,4 +1,5 @@
 import type { ReactNode } from "react";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import "@app/ui/Banner.css";
 
 export type BannerTone = "info" | "success" | "warning" | "danger" | "neutral";
@@ -7,21 +8,15 @@ export interface BannerProps {
   tone?: BannerTone;
   title?: ReactNode;
   description?: ReactNode;
-  /** Right-aligned action — typically a button. */
   action?: ReactNode;
-  /** When set, shows an × button that calls this handler. */
   onDismiss?: () => void;
-  /** Optional leading icon (caller supplies — keeps the primitive icon-set-agnostic). */
+  /** Caller-supplied icon keeps this component icon-set-agnostic. */
   icon?: ReactNode;
   className?: string;
   children?: ReactNode;
 }
 
-/**
- * Inline alert. Use `tone` to convey severity; pair with `action` for
- * "Approaching cap → Upgrade" style flows. Use `Toast` (separate primitive)
- * for transient/dismissible notifications layered over the UI.
- */
+/** Inline alert. Use Toast for transient overlay notifications instead. */
 export function Banner({
   tone = "info",
   title,
@@ -51,14 +46,17 @@ export function Banner({
       </div>
       {action && <div className="sui-banner__action">{action}</div>}
       {onDismiss && (
-        <button
-          type="button"
+        <ActionIcon
+          variant="tertiary"
+          accent="neutral"
+          size="sm"
+          shape="circle"
           className="sui-banner__close"
           onClick={onDismiss}
           aria-label="Dismiss"
         >
-          ×
-        </button>
+          <span aria-hidden>×</span>
+        </ActionIcon>
       )}
     </div>
   );
diff --git a/frontend/editor/src/core/ui/Button.css b/frontend/editor/src/core/ui/Button.css
new file mode 100644
index 0000000000..5592711979
--- /dev/null
+++ b/frontend/editor/src/core/ui/Button.css
@@ -0,0 +1,41 @@
+/* Mantine-backed Button — colour driven by the shared accent palette (accents.css). */
+@import "./accents.css";
+
+/* ---- icon-only: square, no horizontal padding ---- */
+.sui-btn--icon.mantine-Button-root {
+  --button-padding-x: 0;
+  width: var(--button-height);
+  min-width: var(--button-height);
+}
+/* Zero the section margin / hide the empty label so the lone icon centres. */
+.sui-btn--icon .mantine-Button-section {
+  margin-inline: 0;
+}
+.sui-btn--icon .mantine-Button-label {
+  display: none;
+}
+
+/* ---- shape ---- */
+.sui-btn--circle.mantine-Button-root {
+  --button-radius: 50%;
+}
+.sui-btn--pill.mantine-Button-root {
+  --button-radius: 9999px;
+}
+
+/* ---- gradient accents: brighten on hover instead of a hard bg swap ---- */
+/* [data-disabled] too: :disabled never matches polymorphic (as="a") roots. */
+.sui-acc-ai.sui-btn--primary:not(:disabled):not([data-disabled]):hover,
+.sui-acc-premium.sui-btn--primary:not(:disabled):not([data-disabled]):hover {
+  filter: brightness(1.06);
+}
+
+/* ---- overflow: default wraps the label; Mantine's label is nowrap ---- */
+.sui-btn--wrap .mantine-Button-label {
+  white-space: normal;
+}
+
+/* no-hover: !important to beat Mantine's own :hover background rule. */
+.sui-btn--no-hover:not(:disabled):not([data-disabled]):hover {
+  background: var(--button-bg, transparent) !important;
+}
diff --git a/frontend/editor/src/core/ui/Button.stories.tsx b/frontend/editor/src/core/ui/Button.stories.tsx
new file mode 100644
index 0000000000..2def9e099f
--- /dev/null
+++ b/frontend/editor/src/core/ui/Button.stories.tsx
@@ -0,0 +1,293 @@
+import type { ReactNode } from "react";
+import type { Meta, StoryObj } from "@storybook/react";
+import { Button } from "@app/ui/Button";
+
+/* tiny inline icons for the demos */
+const Plus = () => (
+  <svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" aria-hidden>
+    <path
+      d="M12 5v14M5 12h14"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+    />
+  </svg>
+);
+const Arrow = () => (
+  <svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" aria-hidden>
+    <path
+      d="M5 12h14m0 0-5-5m5 5-5 5"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+const Trash = () => (
+  <svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" aria-hidden>
+    <path
+      d="M5 7h14M10 7V5h4v2m-8 0 1 13h6l1-13"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+const Sparkle = () => (
+  <svg
+    width="1em"
+    height="1em"
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    aria-hidden
+  >
+    <path d="M12 2l1.9 5.1L19 9l-5.1 1.9L12 16l-1.9-5.1L5 9l5.1-1.9L12 2z" />
+    <path d="M19 14l.9 2.4L22 17l-2.1.8L19 20l-.9-2.2L16 17l2.1-.6L19 14z" />
+  </svg>
+);
+
+const meta: Meta<typeof Button> = {
+  title: "Primitives/Button",
+  component: Button,
+  parameters: { layout: "centered" },
+  args: { text: "Button", variant: "primary", accent: "default", size: "md" },
+  argTypes: {
+    variant: {
+      control: "inline-radio",
+      options: ["primary", "secondary", "tertiary", "quiet"],
+    },
+    accent: {
+      control: "inline-radio",
+      options: [
+        "default",
+        "neutral",
+        "brand",
+        "ai",
+        "premium",
+        "danger",
+        "success",
+        "warning",
+      ],
+    },
+    size: { control: "inline-radio", options: ["sm", "md", "lg", "xl"] },
+    justify: {
+      control: "inline-radio",
+      options: ["center", "start", "end", "between"],
+    },
+    shape: { control: "inline-radio", options: ["default", "circle", "pill"] },
+    text: { control: "text" },
+  },
+};
+export default meta;
+type Story = StoryObj<typeof Button>;
+
+const Wrap = ({ children }: { children: ReactNode }) => (
+  <div
+    style={{ display: "flex", flexWrap: "wrap", gap: 12, alignItems: "center" }}
+  >
+    {children}
+  </div>
+);
+
+/** Tweak every prop live with the controls. */
+export const Playground: Story = {};
+
+/** The three fill treatments. */
+export const Variants: Story = {
+  render: (args) => (
+    <Wrap>
+      <Button {...args} variant="primary" text="Primary" />
+      <Button {...args} variant="secondary" text="Secondary" />
+      <Button {...args} variant="tertiary" text="Tertiary" />
+    </Wrap>
+  ),
+};
+
+/** Every accent × the three variants. Unset = `default` (blue). */
+export const Accents: Story = {
+  render: () => (
+    <div
+      style={{
+        display: "grid",
+        gridTemplateColumns: "repeat(8, auto)",
+        gap: 10,
+        justifyContent: "start",
+      }}
+    >
+      {(["primary", "secondary", "tertiary"] as const).flatMap((variant) =>
+        (
+          [
+            "default",
+            "neutral",
+            "brand",
+            "ai",
+            "premium",
+            "danger",
+            "success",
+            "warning",
+          ] as const
+        ).map((accent) => (
+          <Button
+            key={`${variant}-${accent}`}
+            variant={variant}
+            accent={accent}
+            text={accent}
+          />
+        )),
+      )}
+    </div>
+  ),
+};
+
+/** Real size differences. */
+export const Sizes: Story = {
+  render: (args) => (
+    <Wrap>
+      {(["sm", "md", "lg", "xl"] as const).map((size) => (
+        <Button key={size} {...args} size={size} text={size} />
+      ))}
+    </Wrap>
+  ),
+};
+
+/** Icons are optional and positional: `leftSection`, `rightSection`, or both. */
+export const WithIcons: Story = {
+  render: (args) => (
+    <Wrap>
+      <Button {...args} leftSection={<Plus />} text="Left icon" />
+      <Button {...args} rightSection={<Arrow />} text="Right icon" />
+      <Button
+        {...args}
+        leftSection={<Plus />}
+        rightSection={<Arrow />}
+        text="Both"
+      />
+    </Wrap>
+  ),
+};
+
+/** Pass an icon and NO text — that's all an "icon-only" button is. No separate component. */
+export const IconOnly: Story = {
+  render: () => (
+    <Wrap>
+      {(["sm", "md", "lg", "xl"] as const).map((size) => (
+        <Button
+          key={size}
+          size={size}
+          leftSection={<Plus />}
+          aria-label="Add"
+        />
+      ))}
+      <Button variant="secondary" leftSection={<Plus />} aria-label="Add" />
+      <Button
+        variant="tertiary"
+        accent="danger"
+        leftSection={<Trash />}
+        aria-label="Delete"
+      />
+    </Wrap>
+  ),
+};
+
+/** How content sits across the width (only visible when wider than the content,
+ * e.g. `fullWidth`). `between` pins icons to the edges and keeps the label dead-
+ * centre — the toolbar/nav row pattern. */
+export const Justify: Story = {
+  render: () => (
+    <div
+      style={{ display: "flex", flexDirection: "column", gap: 12, width: 280 }}
+    >
+      {(["center", "start", "end", "between"] as const).map((justify) => (
+        <Button
+          key={justify}
+          fullWidth
+          justify={justify}
+          variant="secondary"
+          leftSection={<Plus />}
+          rightSection={<Arrow />}
+          text={justify}
+        />
+      ))}
+    </div>
+  ),
+};
+
+/** `circle` makes a round control (pair it with an icon-only button); `pill` fully rounds a text button. */
+export const Shape: Story = {
+  render: () => (
+    <Wrap>
+      <Button
+        shape="circle"
+        variant="secondary"
+        leftSection={<Plus />}
+        aria-label="Add"
+      />
+      <Button
+        shape="circle"
+        variant="tertiary"
+        leftSection={<Arrow />}
+        aria-label="Next"
+      />
+      <Button
+        shape="circle"
+        variant="primary"
+        leftSection={<Trash />}
+        aria-label="Delete"
+      />
+      <Button shape="pill" variant="primary" text="Pill" />
+      <Button shape="default" variant="secondary" text="Default" />
+    </Wrap>
+  ),
+};
+
+/** `accent="premium"` — a gradient CTA for upgrade moments. The gradient lives
+ * on the `filled` variant (subtle brighten on hover, nothing flashy);
+ * outlined/ghost fall back to a calm violet. */
+export const Premium: Story = {
+  render: () => (
+    <div
+      style={{ display: "flex", flexDirection: "column", gap: 16, width: 320 }}
+    >
+      <Button
+        accent="premium"
+        size="lg"
+        fullWidth
+        leftSection={<Sparkle />}
+        text="Upgrade to Processor Plan"
+      />
+      <Wrap>
+        <Button accent="premium" text="Upgrade" />
+        <Button accent="premium" leftSection={<Sparkle />} text="Go Pro" />
+        <Button
+          accent="premium"
+          shape="pill"
+          rightSection={<Arrow />}
+          text="Get Pro"
+        />
+        <Button
+          accent="premium"
+          leftSection={<Sparkle />}
+          aria-label="Upgrade"
+        />
+      </Wrap>
+      <Wrap>
+        <Button accent="premium" variant="secondary" text="Outlined" />
+        <Button accent="premium" variant="tertiary" text="Ghost" />
+        <Button accent="premium" disabled text="Disabled" />
+      </Wrap>
+      <Wrap>
+        {(["sm", "md", "lg", "xl"] as const).map((size) => (
+          <Button
+            key={size}
+            accent="premium"
+            size={size}
+            leftSection={<Sparkle />}
+            text={size}
+          />
+        ))}
+      </Wrap>
+    </div>
+  ),
+};
diff --git a/frontend/editor/src/core/ui/Button.tsx b/frontend/editor/src/core/ui/Button.tsx
new file mode 100644
index 0000000000..08dbeeddd8
--- /dev/null
+++ b/frontend/editor/src/core/ui/Button.tsx
@@ -0,0 +1,205 @@
+import { Button as MantineButton } from "@mantine/core";
+import { forwardRef } from "react";
+import type {
+  ComponentPropsWithoutRef,
+  CSSProperties,
+  ElementType,
+  ReactNode,
+} from "react";
+import { CONTROL_HEIGHT } from "@app/ui/controlSizes";
+import "@app/ui/Button.css";
+
+/** primary=solid, secondary=outlined, tertiary=ghost (tinted hover), quiet=plain (no bg, hovers to text colour). */
+export type ButtonVariant = "primary" | "secondary" | "tertiary" | "quiet";
+/** default(blue) | neutral | brand | ai | premium | danger | success | warning. */
+export type ButtonAccent =
+  | "default"
+  | "neutral"
+  | "brand"
+  | "ai"
+  | "premium"
+  | "danger"
+  | "success"
+  | "warning";
+export type ButtonSize = "sm" | "md" | "lg" | "xl";
+/** `between` pins leftSection/label/rightSection to left/center/right (toolbar rows). */
+export type ButtonJustify = "center" | "start" | "end" | "between";
+export type ButtonShape = "default" | "circle" | "pill";
+
+type ButtonOwnProps = {
+  variant?: ButtonVariant;
+  accent?: ButtonAccent;
+  size?: ButtonSize;
+  justify?: ButtonJustify;
+  shape?: ButtonShape;
+  /** Alternative to children; use one or the other. */
+  text?: ReactNode;
+  leftSection?: ReactNode;
+  rightSection?: ReactNode;
+  loading?: boolean;
+  fullWidth?: boolean;
+  /** false = no hover background change. */
+  hover?: boolean;
+  overflow?: "wrap" | "hidden";
+  /** Polymorphic root element (e.g. `"a"` or a router Link). */
+  as?: ElementType;
+  style?: CSSProperties;
+  children?: ReactNode;
+};
+
+export type ButtonProps = ButtonOwnProps &
+  Omit<ComponentPropsWithoutRef<"button">, keyof ButtonOwnProps | "color"> & {
+    href?: string;
+    target?: string;
+    rel?: string;
+    htmlFor?: string;
+  };
+
+export interface ButtonGroupProps {
+  children?: ReactNode;
+  className?: string;
+  style?: CSSProperties;
+  orientation?: "horizontal" | "vertical";
+  /** Border width between attached buttons (Mantine `--button-border-width`). */
+  borderWidth?: number | string;
+}
+
+function ButtonGroup({
+  children,
+  className,
+  style,
+  orientation,
+  borderWidth,
+}: ButtonGroupProps) {
+  return (
+    <MantineButton.Group
+      className={className}
+      style={style}
+      orientation={orientation}
+      borderWidth={borderWidth}
+    >
+      {children}
+    </MantineButton.Group>
+  );
+}
+
+const MANTINE_VARIANT: Record<ButtonVariant, string> = {
+  primary: "filled",
+  secondary: "outline",
+  tertiary: "subtle",
+  quiet: "subtle",
+};
+
+const MANTINE_JUSTIFY: Record<ButtonJustify, string> = {
+  center: "center",
+  start: "flex-start",
+  end: "flex-end",
+  between: "space-between",
+};
+
+const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
+  function ButtonRoot(
+    {
+      variant = "primary",
+      accent = "default",
+      size = "md",
+      justify = "center",
+      shape = "default",
+      text,
+      leftSection,
+      rightSection,
+      loading = false,
+      fullWidth = false,
+      hover = true,
+      overflow = "wrap",
+      as,
+      disabled,
+      className,
+      style,
+      children,
+      ...rest
+    },
+    ref,
+  ) {
+    const label = text ?? children;
+    const hasLabel = label != null && label !== false && label !== "";
+    const iconOnly = !hasLabel && (!!leftSection || !!rightSection || loading);
+
+    // Sections flank a label → spread them without requiring justify="between".
+    const effectiveJustify =
+      justify === "center" && hasLabel && !!leftSection && !!rightSection
+        ? "between"
+        : justify;
+
+    const classes = [
+      "sui-btn",
+      `sui-acc-${accent}`,
+      `sui-btn--${variant}`,
+      iconOnly ? "sui-btn--icon" : "",
+      shape !== "default" ? `sui-btn--${shape}` : "",
+      overflow === "wrap" ? "sui-btn--wrap" : "",
+      !hover ? "sui-btn--no-hover" : "",
+      className ?? "",
+    ]
+      .filter(Boolean)
+      .join(" ");
+
+    // Accent palette → Mantine button vars (inline to win). --button-bd is a full `border` shorthand.
+    const accentVars =
+      variant === "primary"
+        ? {
+            "--button-bg": "var(--_solid)",
+            "--button-hover": "var(--_solid-hover)",
+            "--button-color": "var(--_on)",
+            "--button-bd": "1px solid transparent",
+          }
+        : variant === "quiet"
+          ? {
+              "--button-bg": "transparent",
+              "--button-hover": "transparent",
+              "--button-color": "var(--_text)",
+              "--button-hover-color": "var(--color-text-1)",
+              "--button-bd": "1px solid transparent",
+            }
+          : {
+              "--button-bg": "transparent",
+              "--button-hover": "var(--_tint)",
+              "--button-color": "var(--_text)",
+              "--button-bd":
+                variant === "secondary"
+                  ? "1px solid var(--_bd)"
+                  : "1px solid transparent",
+            };
+
+    // Loosely-typed alias so the polymorphic `component={as}` doesn't fight Mantine's typing.
+    const Comp = MantineButton as ElementType;
+
+    return (
+      <Comp
+        {...rest}
+        ref={ref}
+        component={as}
+        variant={MANTINE_VARIANT[variant]}
+        size={size}
+        justify={MANTINE_JUSTIFY[effectiveJustify]}
+        leftSection={leftSection}
+        rightSection={rightSection}
+        loading={loading}
+        fullWidth={fullWidth}
+        disabled={disabled}
+        className={classes}
+        style={{
+          ...(accentVars as CSSProperties),
+          ...({ "--button-height": CONTROL_HEIGHT[size] } as CSSProperties),
+          // Icon-only: zero the size padding inline so the lone icon centres.
+          ...(iconOnly ? ({ "--button-padding-x": "0" } as CSSProperties) : {}),
+          ...style,
+        }}
+      >
+        {label}
+      </Comp>
+    );
+  },
+);
+
+export const Button = Object.assign(ButtonRoot, { Group: ButtonGroup });
diff --git a/frontend/editor/src/proprietary/ui/Card.css b/frontend/editor/src/core/ui/Card.css
similarity index 74%
rename from frontend/editor/src/proprietary/ui/Card.css
rename to frontend/editor/src/core/ui/Card.css
index f38e2adac4..bfc49be935 100644
--- a/frontend/editor/src/proprietary/ui/Card.css
+++ b/frontend/editor/src/core/ui/Card.css
@@ -32,11 +32,11 @@
   transform: translateY(-0.0625rem);
 }
 
-.sui-card--accent-blue::before,
-.sui-card--accent-purple::before,
-.sui-card--accent-green::before,
-.sui-card--accent-amber::before,
-.sui-card--accent-red::before {
+.sui-card--accent-default::before,
+.sui-card--accent-premium::before,
+.sui-card--accent-success::before,
+.sui-card--accent-warning::before,
+.sui-card--accent-danger::before {
   content: "";
   position: absolute;
   top: 0;
@@ -45,18 +45,18 @@
   width: 0.25rem;
   border-radius: var(--radius-lg) 0 0 var(--radius-lg);
 }
-.sui-card--accent-blue::before {
+.sui-card--accent-default::before {
   background: var(--color-blue);
 }
-.sui-card--accent-purple::before {
+.sui-card--accent-premium::before {
   background: var(--color-purple);
 }
-.sui-card--accent-green::before {
+.sui-card--accent-success::before {
   background: var(--color-green);
 }
-.sui-card--accent-amber::before {
+.sui-card--accent-warning::before {
   background: var(--color-amber);
 }
-.sui-card--accent-red::before {
+.sui-card--accent-danger::before {
   background: var(--color-red);
 }
diff --git a/frontend/editor/src/proprietary/ui/Card.stories.tsx b/frontend/editor/src/core/ui/Card.stories.tsx
similarity index 82%
rename from frontend/editor/src/proprietary/ui/Card.stories.tsx
rename to frontend/editor/src/core/ui/Card.stories.tsx
index df445fd89a..8f480e2bf3 100644
--- a/frontend/editor/src/proprietary/ui/Card.stories.tsx
+++ b/frontend/editor/src/core/ui/Card.stories.tsx
@@ -36,7 +36,14 @@ const meta: Meta<typeof Card> = {
   argTypes: {
     accent: {
       control: "inline-radio",
-      options: [undefined, "blue", "purple", "green", "amber", "red"],
+      options: [
+        undefined,
+        "default",
+        "premium",
+        "success",
+        "warning",
+        "danger",
+      ],
     },
     padding: {
       control: "inline-radio",
@@ -79,13 +86,20 @@ export const AccentMatrix: Story = {
         gap: 12,
       }}
     >
-      {(["blue", "purple", "green", "amber", "red", undefined] as const).map(
-        (accent) => (
-          <Card key={accent ?? "none"} accent={accent}>
-            <CardBody color={accent ?? "neutral"} />
-          </Card>
-        ),
-      )}
+      {(
+        [
+          "default",
+          "premium",
+          "success",
+          "warning",
+          "danger",
+          undefined,
+        ] as const
+      ).map((accent) => (
+        <Card key={accent ?? "none"} accent={accent}>
+          <CardBody color={accent ?? "neutral"} />
+        </Card>
+      ))}
     </div>
   ),
 };
@@ -106,7 +120,7 @@ export const InContext_ProductGrid: Story = {
         gap: 14,
       }}
     >
-      <Card accent="purple" padding="loose" interactive>
+      <Card accent="premium" padding="loose" interactive>
         <h3 style={{ margin: 0, fontSize: 16 }}>Sources</h3>
         <p
           style={{
@@ -117,11 +131,11 @@ export const InContext_ProductGrid: Story = {
         >
           Attach pipelines where PDFs already live.
         </p>
-        <Button variant="outline" accent="purple" size="sm">
+        <Button variant="secondary" accent="neutral" size="sm">
           Connect a source
         </Button>
       </Card>
-      <Card accent="blue" padding="loose" interactive>
+      <Card accent="default" padding="loose" interactive>
         <div
           style={{
             display: "flex",
@@ -144,11 +158,11 @@ export const InContext_ProductGrid: Story = {
         >
           Compose document workflows from typed operations.
         </p>
-        <Button variant="outline" accent="blue" size="sm">
+        <Button variant="secondary" accent="neutral" size="sm">
           Build a pipeline
         </Button>
       </Card>
-      <Card accent="purple" padding="loose" interactive>
+      <Card accent="premium" padding="loose" interactive>
         <h3 style={{ margin: 0, fontSize: 16 }}>Agents</h3>
         <p
           style={{
@@ -159,7 +173,7 @@ export const InContext_ProductGrid: Story = {
         >
           Wire your agent via MCP, REST, or tool definitions.
         </p>
-        <Button variant="outline" accent="purple" size="sm">
+        <Button variant="secondary" accent="neutral" size="sm">
           Connect an agent
         </Button>
       </Card>
diff --git a/frontend/editor/src/proprietary/ui/Card.tsx b/frontend/editor/src/core/ui/Card.tsx
similarity index 86%
rename from frontend/editor/src/proprietary/ui/Card.tsx
rename to frontend/editor/src/core/ui/Card.tsx
index 27eb7aed62..dbdb1a393a 100644
--- a/frontend/editor/src/proprietary/ui/Card.tsx
+++ b/frontend/editor/src/core/ui/Card.tsx
@@ -1,9 +1,17 @@
 import type { HTMLAttributes, ReactNode } from "react";
 import "@app/ui/Card.css";
 
+/** Subset of the shared accent dial that has a styled strip (see Card.css). */
+export type CardAccent =
+  | "default"
+  | "premium"
+  | "danger"
+  | "success"
+  | "warning";
+
 export interface CardProps extends HTMLAttributes<HTMLDivElement> {
   /** Adds an accent strip on the left edge of the card. */
-  accent?: "blue" | "purple" | "green" | "amber" | "red";
+  accent?: CardAccent;
   /**
    * Padding profile. `tight` = 0.75rem, `default` = 1.125rem, `loose` = 1.5rem.
    * `none` removes padding so the card surface can host edge-to-edge content
diff --git a/frontend/editor/src/proprietary/ui/ChatFABButton.css b/frontend/editor/src/core/ui/ChatFABButton.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ChatFABButton.css
rename to frontend/editor/src/core/ui/ChatFABButton.css
diff --git a/frontend/editor/src/proprietary/ui/ChatFABButton.stories.tsx b/frontend/editor/src/core/ui/ChatFABButton.stories.tsx
similarity index 90%
rename from frontend/editor/src/proprietary/ui/ChatFABButton.stories.tsx
rename to frontend/editor/src/core/ui/ChatFABButton.stories.tsx
index c6986dad14..5e85738b57 100644
--- a/frontend/editor/src/proprietary/ui/ChatFABButton.stories.tsx
+++ b/frontend/editor/src/core/ui/ChatFABButton.stories.tsx
@@ -6,7 +6,7 @@ const meta: Meta<typeof ChatFABButton> = {
   component: ChatFABButton,
   parameters: { layout: "centered" },
   argTypes: {
-    isLoading: { control: "boolean" },
+    loading: { control: "boolean" },
     showTick: { control: "boolean" },
     onClick: { action: "clicked" },
   },
@@ -19,7 +19,7 @@ export const Default: Story = {};
 
 /** Agent is actively working — the logo paths animate and a green pulse dot appears. */
 export const Loading: Story = {
-  args: { isLoading: true },
+  args: { loading: true },
 };
 
 /** Agent finished while the panel was closed — tick badge pops in to signal an unread result. */
@@ -33,5 +33,5 @@ export const Tick: Story = {
  * In practice this transition is handled by the parent via `hasUnviewedResult`.
  */
 export const TickWhileLoading: Story = {
-  args: { isLoading: true, showTick: true },
+  args: { loading: true, showTick: true },
 };
diff --git a/frontend/editor/src/proprietary/ui/ChatFABButton.tsx b/frontend/editor/src/core/ui/ChatFABButton.tsx
similarity index 84%
rename from frontend/editor/src/proprietary/ui/ChatFABButton.tsx
rename to frontend/editor/src/core/ui/ChatFABButton.tsx
index 8ee8e74d7a..5ba3c8113b 100644
--- a/frontend/editor/src/proprietary/ui/ChatFABButton.tsx
+++ b/frontend/editor/src/core/ui/ChatFABButton.tsx
@@ -2,21 +2,21 @@ import type { ButtonHTMLAttributes } from "react";
 import "@app/ui/ChatFABButton.css";
 
 export interface ChatFABButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
-  /** Shows a green pulse dot to indicate the agent is actively working. */
-  isLoading?: boolean;
-  /** Shows a green tick badge to indicate an unread result is waiting. */
+  /** Green pulse dot — agent is working. */
+  loading?: boolean;
+  /** Green tick badge — unread result waiting. */
   showTick?: boolean;
 }
 
 export function ChatFABButton({
-  isLoading = false,
+  loading = false,
   showTick = false,
   className,
   ...rest
 }: ChatFABButtonProps) {
   const classes = [
     "chat-fab-btn",
-    isLoading ? "chat-fab-btn--loading" : "",
+    loading ? "chat-fab-btn--loading" : "",
     showTick ? "chat-fab-btn--tick" : "",
     className ?? "",
   ]
@@ -39,7 +39,7 @@ export function ChatFABButton({
         />
         <path d="M7.26 95.83 L123.37 0 L123.37 89.5 L7.26 185.33 Z" />
       </svg>
-      {isLoading && !showTick && (
+      {loading && !showTick && (
         <span className="chat-fab-btn__pulse" aria-hidden="true" />
       )}
       {showTick && (
diff --git a/frontend/editor/src/proprietary/ui/ChatFABWindow.css b/frontend/editor/src/core/ui/ChatFABWindow.css
similarity index 93%
rename from frontend/editor/src/proprietary/ui/ChatFABWindow.css
rename to frontend/editor/src/core/ui/ChatFABWindow.css
index 1f59d2444f..b5dbb4f451 100644
--- a/frontend/editor/src/proprietary/ui/ChatFABWindow.css
+++ b/frontend/editor/src/core/ui/ChatFABWindow.css
@@ -15,7 +15,7 @@
 
   /* Closed state: collapsed toward bottom-right origin */
   opacity: 0;
-  transform: scale(0.9) translateY(14px);
+  transform: scale(0.9);
   pointer-events: none;
   transform-origin: bottom right;
   transition:
@@ -25,7 +25,7 @@
 
 .chat-fab-window--open {
   opacity: 1;
-  transform: scale(1) translateY(0);
+  transform: scale(1);
   pointer-events: auto;
 }
 
diff --git a/frontend/editor/src/proprietary/ui/ChatFABWindow.stories.tsx b/frontend/editor/src/core/ui/ChatFABWindow.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ChatFABWindow.stories.tsx
rename to frontend/editor/src/core/ui/ChatFABWindow.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/ChatFABWindow.tsx b/frontend/editor/src/core/ui/ChatFABWindow.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ChatFABWindow.tsx
rename to frontend/editor/src/core/ui/ChatFABWindow.tsx
diff --git a/frontend/editor/src/proprietary/ui/Checkbox.css b/frontend/editor/src/core/ui/Checkbox.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Checkbox.css
rename to frontend/editor/src/core/ui/Checkbox.css
diff --git a/frontend/editor/src/proprietary/ui/Checkbox.tsx b/frontend/editor/src/core/ui/Checkbox.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Checkbox.tsx
rename to frontend/editor/src/core/ui/Checkbox.tsx
diff --git a/frontend/editor/src/core/ui/Chip.css b/frontend/editor/src/core/ui/Chip.css
new file mode 100644
index 0000000000..c341bb8e5c
--- /dev/null
+++ b/frontend/editor/src/core/ui/Chip.css
@@ -0,0 +1,49 @@
+/* Mantine Pill-backed chip/tag — colour from the shared accent palette (accents.css). */
+@import "./accents.css";
+
+.sui-chip.mantine-Pill-root {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35em;
+  border: 1px solid transparent;
+  font-weight: 500;
+  width: auto;
+}
+.sui-chip--primary.mantine-Pill-root {
+  background: var(--_solid);
+  color: var(--_on);
+}
+.sui-chip--secondary.mantine-Pill-root {
+  background: var(--_tint);
+  color: var(--_text);
+  border-color: var(--_bd);
+}
+.sui-chip--interactive {
+  cursor: pointer;
+}
+.sui-chip--loading {
+  opacity: 0.6;
+  pointer-events: none;
+}
+
+.sui-chip__dot {
+  width: 0.5em;
+  height: 0.5em;
+  border-radius: 50%;
+  background: currentColor;
+}
+.sui-chip__icon {
+  display: inline-flex;
+  align-items: center;
+}
+.sui-chip__label {
+  display: inline-block;
+}
+.sui-chip__spinner {
+  width: 0.75em;
+  height: 0.75em;
+  border-radius: 50%;
+  border: 2px solid currentColor;
+  border-right-color: transparent;
+  animation: spin 0.7s linear infinite;
+}
diff --git a/frontend/editor/src/core/ui/Chip.stories.tsx b/frontend/editor/src/core/ui/Chip.stories.tsx
new file mode 100644
index 0000000000..0d54da3891
--- /dev/null
+++ b/frontend/editor/src/core/ui/Chip.stories.tsx
@@ -0,0 +1,91 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Chip } from "@app/ui/Chip";
+
+const ACCENTS = [
+  "default",
+  "neutral",
+  "brand",
+  "ai",
+  "premium",
+  "danger",
+  "success",
+  "warning",
+] as const;
+
+const meta: Meta<typeof Chip> = {
+  title: "Primitives/Chip",
+  component: Chip,
+  tags: ["autodocs"],
+  parameters: { layout: "centered" },
+  args: {
+    children: "us-east-1",
+    accent: "default",
+    variant: "secondary",
+    size: "md",
+    showDot: false,
+  },
+  argTypes: {
+    accent: { control: "inline-radio", options: ACCENTS },
+    variant: { control: "inline-radio", options: ["primary", "secondary"] },
+    size: { control: "inline-radio", options: ["xs", "sm", "md", "lg"] },
+    showDot: { control: "boolean" },
+    onClick: { action: "clicked" },
+    onRemove: { action: "removed" },
+  },
+};
+export default meta;
+type Story = StoryObj<typeof Chip>;
+
+/** Flip accent / variant / size / dot / interactive / removable in controls. */
+export const Playground: Story = {};
+
+export const Accents: Story = {
+  render: () => (
+    <div style={{ display: "flex", flexDirection: "column", gap: 8 }}>
+      {(["secondary", "primary"] as const).map((variant) => (
+        <div key={variant} style={{ display: "flex", gap: 8 }}>
+          {ACCENTS.map((a) => (
+            <Chip key={a} accent={a} variant={variant}>
+              {a}
+            </Chip>
+          ))}
+        </div>
+      ))}
+    </div>
+  ),
+};
+
+export const InContext_OpChain: Story = {
+  render: () => (
+    <div
+      style={{
+        display: "flex",
+        flexWrap: "wrap",
+        gap: 6,
+        maxWidth: "32rem",
+      }}
+    >
+      <Chip accent="success" showDot>
+        ocr
+      </Chip>
+      <Chip accent="success" showDot>
+        classify
+      </Chip>
+      <Chip accent="success" showDot>
+        extract
+      </Chip>
+      <Chip accent="default" showDot>
+        validate
+      </Chip>
+      <Chip accent="danger" showDot>
+        redact
+      </Chip>
+      <Chip accent="danger" showDot>
+        encrypt-rest
+      </Chip>
+      <Chip accent="premium" showDot>
+        store-primary
+      </Chip>
+    </div>
+  ),
+};
diff --git a/frontend/editor/src/core/ui/Chip.tsx b/frontend/editor/src/core/ui/Chip.tsx
new file mode 100644
index 0000000000..49478d84c6
--- /dev/null
+++ b/frontend/editor/src/core/ui/Chip.tsx
@@ -0,0 +1,113 @@
+import { Pill as MantinePill } from "@mantine/core";
+import type {
+  CSSProperties,
+  HTMLAttributes,
+  KeyboardEvent,
+  ReactNode,
+} from "react";
+import "@app/ui/Chip.css";
+
+/** Same accent dial as Button. */
+export type ChipAccent =
+  | "default"
+  | "neutral"
+  | "brand"
+  | "ai"
+  | "premium"
+  | "danger"
+  | "success"
+  | "warning";
+export type ChipSize = "xs" | "sm" | "md" | "lg";
+/** primary = solid fill; secondary = soft tinted tag (the default tag look). */
+export type ChipVariant = "primary" | "secondary";
+
+export interface ChipProps extends Omit<
+  HTMLAttributes<HTMLElement>,
+  "onClick"
+> {
+  accent?: ChipAccent;
+  variant?: ChipVariant;
+  size?: ChipSize;
+  leadingIcon?: ReactNode;
+  trailingIcon?: ReactNode;
+  /** Shows a spinner and dims the chip. */
+  loading?: boolean;
+  onRemove?: () => void;
+  onClick?: () => void;
+  /** Leading status dot. Use for status-style chips. */
+  showDot?: boolean;
+  style?: CSSProperties;
+  children?: ReactNode;
+  className?: string;
+}
+
+/** Open-ended chip/tag (Mantine Pill-backed). For semantic status use StatusBadge. */
+export function Chip({
+  accent = "default",
+  variant = "secondary",
+  size = "md",
+  leadingIcon,
+  trailingIcon,
+  loading = false,
+  onRemove,
+  onClick,
+  showDot,
+  style,
+  children,
+  className,
+  ...rest
+}: ChipProps) {
+  const classes = [
+    "sui-chip",
+    `sui-acc-${accent}`,
+    `sui-chip--${variant}`,
+    onClick ? "sui-chip--interactive" : "",
+    loading ? "sui-chip--loading" : "",
+    className ?? "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+
+  // Interactive chips are a <span>, so add button semantics + Enter/Space activation.
+  const interactive = !!onClick && !loading;
+  const interactiveProps = interactive
+    ? {
+        role: "button",
+        tabIndex: 0,
+        onClick,
+        onKeyDown: (e: KeyboardEvent<HTMLElement>) => {
+          if (e.key === "Enter" || e.key === " ") {
+            e.preventDefault();
+            onClick();
+          }
+        },
+      }
+    : {};
+
+  return (
+    <MantinePill
+      {...rest}
+      className={classes}
+      style={style}
+      size={size}
+      withRemoveButton={!!onRemove && !loading}
+      onRemove={onRemove}
+      {...interactiveProps}
+    >
+      {showDot && <span className="sui-chip__dot" aria-hidden />}
+      {loading ? (
+        <span className="sui-chip__spinner" aria-hidden />
+      ) : leadingIcon ? (
+        <span className="sui-chip__icon" aria-hidden>
+          {leadingIcon}
+        </span>
+      ) : null}
+      <span className="sui-chip__label">{children}</span>
+      {trailingIcon && !onRemove && (
+        <span className="sui-chip__icon" aria-hidden>
+          {trailingIcon}
+        </span>
+      )}
+    </MantinePill>
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/ChipFlow.css b/frontend/editor/src/core/ui/ChipFlow.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ChipFlow.css
rename to frontend/editor/src/core/ui/ChipFlow.css
diff --git a/frontend/editor/src/proprietary/ui/ChipFlow.stories.tsx b/frontend/editor/src/core/ui/ChipFlow.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ChipFlow.stories.tsx
rename to frontend/editor/src/core/ui/ChipFlow.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/ChipFlow.tsx b/frontend/editor/src/core/ui/ChipFlow.tsx
similarity index 65%
rename from frontend/editor/src/proprietary/ui/ChipFlow.tsx
rename to frontend/editor/src/core/ui/ChipFlow.tsx
index 4af337e308..528796ece8 100644
--- a/frontend/editor/src/proprietary/ui/ChipFlow.tsx
+++ b/frontend/editor/src/core/ui/ChipFlow.tsx
@@ -1,24 +1,18 @@
 import { Fragment } from "react";
 import type { ReactNode } from "react";
 import { Chip } from "@app/ui/Chip";
-import type { ChipTone, ChipSize } from "@app/ui/Chip";
+import type { ChipAccent, ChipSize } from "@app/ui/Chip";
 import "@app/ui/ChipFlow.css";
 
 export interface ChipFlowProps {
-  /** Items rendered as chips, in order. */
   items: ReactNode[];
-  /** `arrow` joins chips with a → connector (pipeline look); `none` just wraps. */
+  /** `arrow` joins chips with a → connector. */
   separator?: "arrow" | "none";
-  tone?: ChipTone;
+  tone?: ChipAccent;
   size?: ChipSize;
   className?: string;
 }
 
-/**
- * A sequence of {@link Chip}s, optionally joined by arrows to read as a
- * pipeline (A → B → C). Use `separator="arrow"` for flows, `none` for a plain
- * wrapped chip list.
- */
 export function ChipFlow({
   items,
   separator = "none",
@@ -37,7 +31,7 @@ export function ChipFlow({
               →
             </span>
           )}
-          <Chip tone={tone} size={size}>
+          <Chip accent={tone} size={size}>
             {item}
           </Chip>
         </Fragment>
diff --git a/frontend/editor/src/proprietary/ui/CodeBlock.css b/frontend/editor/src/core/ui/CodeBlock.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/CodeBlock.css
rename to frontend/editor/src/core/ui/CodeBlock.css
diff --git a/frontend/editor/src/proprietary/ui/CodeBlock.stories.tsx b/frontend/editor/src/core/ui/CodeBlock.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/CodeBlock.stories.tsx
rename to frontend/editor/src/core/ui/CodeBlock.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/CodeBlock.tsx b/frontend/editor/src/core/ui/CodeBlock.tsx
similarity index 66%
rename from frontend/editor/src/proprietary/ui/CodeBlock.tsx
rename to frontend/editor/src/core/ui/CodeBlock.tsx
index 4e0dc645e1..1a05b23e4f 100644
--- a/frontend/editor/src/proprietary/ui/CodeBlock.tsx
+++ b/frontend/editor/src/core/ui/CodeBlock.tsx
@@ -1,4 +1,5 @@
 import { useState, type ReactNode } from "react";
+import { Button } from "@app/ui/Button";
 import "@app/ui/CodeBlock.css";
 
 export type CodeLang =
@@ -12,27 +13,18 @@ export type CodeLang =
   | "plain";
 
 export interface CodeBlockProps {
-  /** The code content. */
   code: string;
-  /** Language label shown in the chrome bar. Highlight wiring is out of scope here — bring Shiki/Prism. */
+  /** Shown in the chrome bar. Syntax highlighting is not included — wire Shiki/Prism at the call site. */
   lang?: CodeLang;
-  /** Optional caption text shown in the chrome bar (e.g. a file path). */
+  /** Caption in the chrome bar (e.g. a file path). */
   caption?: ReactNode;
-  /** Show a copy-to-clipboard button. Defaults to true. */
+  /** Defaults to true. */
   copyable?: boolean;
-  /** Max height in pixels; longer content scrolls. */
+  /** Longer content scrolls vertically. */
   maxHeight?: number;
   className?: string;
 }
 
-/**
- * Always-dark code block, matched to the prototype's CODE palette.
- *
- * Highlighting is intentionally not wired here — drop in Shiki at the call
- * site and feed pre-highlighted HTML through `dangerouslySetInnerHTML` on a
- * fork of this component if you need it. For most surfaces the raw
- * monospaced text plus copy button is sufficient (and ~80% lighter).
- */
 export function CodeBlock({
   code,
   lang = "plain",
@@ -64,14 +56,16 @@ export function CodeBlock({
         {caption && <span className="sui-code__caption">{caption}</span>}
         <span className="sui-code__lang">{lang}</span>
         {copyable && (
-          <button
-            type="button"
+          <Button
+            variant="tertiary"
+            size="sm"
+            shape="pill"
             className="sui-code__copy"
             onClick={copy}
             aria-label="Copy code"
           >
             {copied ? "Copied" : "Copy"}
-          </button>
+          </Button>
         )}
       </div>
       <pre className="sui-code__pre" style={{ maxHeight }}>
diff --git a/frontend/editor/src/proprietary/ui/Collapsible.css b/frontend/editor/src/core/ui/Collapsible.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Collapsible.css
rename to frontend/editor/src/core/ui/Collapsible.css
diff --git a/frontend/editor/src/proprietary/ui/Collapsible.stories.tsx b/frontend/editor/src/core/ui/Collapsible.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Collapsible.stories.tsx
rename to frontend/editor/src/core/ui/Collapsible.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Collapsible.tsx b/frontend/editor/src/core/ui/Collapsible.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Collapsible.tsx
rename to frontend/editor/src/core/ui/Collapsible.tsx
diff --git a/frontend/editor/src/proprietary/ui/ColorInput.tsx b/frontend/editor/src/core/ui/ColorInput.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ColorInput.tsx
rename to frontend/editor/src/core/ui/ColorInput.tsx
diff --git a/frontend/editor/src/proprietary/ui/DataRow.css b/frontend/editor/src/core/ui/DataRow.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/DataRow.css
rename to frontend/editor/src/core/ui/DataRow.css
diff --git a/frontend/editor/src/proprietary/ui/DataRow.stories.tsx b/frontend/editor/src/core/ui/DataRow.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/DataRow.stories.tsx
rename to frontend/editor/src/core/ui/DataRow.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/DataRow.tsx b/frontend/editor/src/core/ui/DataRow.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/DataRow.tsx
rename to frontend/editor/src/core/ui/DataRow.tsx
diff --git a/frontend/editor/src/proprietary/ui/Drawer.css b/frontend/editor/src/core/ui/Drawer.css
similarity index 83%
rename from frontend/editor/src/proprietary/ui/Drawer.css
rename to frontend/editor/src/core/ui/Drawer.css
index d2b90f26a7..8972bbefc2 100644
--- a/frontend/editor/src/proprietary/ui/Drawer.css
+++ b/frontend/editor/src/core/ui/Drawer.css
@@ -75,22 +75,10 @@
   color: var(--color-text-4);
 }
 
+/* Sizing/background/hover are owned by the Button; this just keeps it from
+ * stretching. */
 .sui-drawer__close {
   flex: 0 0 auto;
-  width: 1.75rem;
-  height: 1.75rem;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: var(--radius-sm);
-  color: var(--color-text-4);
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-.sui-drawer__close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
 }
 
 .sui-drawer__body {
diff --git a/frontend/editor/src/proprietary/ui/Drawer.stories.tsx b/frontend/editor/src/core/ui/Drawer.stories.tsx
similarity index 91%
rename from frontend/editor/src/proprietary/ui/Drawer.stories.tsx
rename to frontend/editor/src/core/ui/Drawer.stories.tsx
index 3600d774a2..c1df90536b 100644
--- a/frontend/editor/src/proprietary/ui/Drawer.stories.tsx
+++ b/frontend/editor/src/core/ui/Drawer.stories.tsx
@@ -71,11 +71,11 @@ export const WithFooter: Story = {
             subtitle="COI Compliance · us-east-1"
             footer={
               <>
-                <Button variant="ghost" onClick={() => setOpen(false)}>
+                <Button variant="tertiary" onClick={() => setOpen(false)}>
                   Close
                 </Button>
-                <Button variant="outline">Edit composition</Button>
-                <Button variant="gradient">View runs</Button>
+                <Button variant="secondary">Edit composition</Button>
+                <Button>View runs</Button>
               </>
             }
           >
diff --git a/frontend/editor/src/proprietary/ui/Drawer.tsx b/frontend/editor/src/core/ui/Drawer.tsx
similarity index 75%
rename from frontend/editor/src/proprietary/ui/Drawer.tsx
rename to frontend/editor/src/core/ui/Drawer.tsx
index 20279c3c59..7327b854dc 100644
--- a/frontend/editor/src/proprietary/ui/Drawer.tsx
+++ b/frontend/editor/src/core/ui/Drawer.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useId, type ReactNode } from "react";
 import { createPortal } from "react-dom";
 import { FocusTrap } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import "@app/ui/Drawer.css";
 
 export type DrawerSide = "right" | "left";
@@ -10,11 +11,10 @@ export interface DrawerProps {
   open: boolean;
   onClose: () => void;
   side?: DrawerSide;
-  /** Width preset. sm=22rem, md=27.5rem, lg=36rem. */
+  /** sm=22rem, md=27.5rem, lg=36rem. */
   width?: DrawerWidth;
   title?: ReactNode;
   subtitle?: ReactNode;
-  /** Sticky footer slot below the body. */
   footer?: ReactNode;
   disableBackdropClose?: boolean;
   disableEscapeClose?: boolean;
@@ -23,12 +23,7 @@ export interface DrawerProps {
   children?: ReactNode;
 }
 
-/**
- * Side drawer — sibling to {@link Modal}, with our own brand shell. Tab focus
- * trapping, initial focus, and focus restoration on close are delegated to
- * Mantine's <FocusTrap>; we keep the slide-in chrome, scroll lock, and ESC /
- * backdrop dismissal.
- */
+/** Tab focus trapping and restoration are delegated to Mantine's FocusTrap. */
 export function Drawer({
   open,
   onClose,
@@ -104,27 +99,31 @@ export function Drawer({
                 )}
                 {subtitle && <div className="sui-drawer__sub">{subtitle}</div>}
               </div>
-              <button
-                type="button"
+              <Button
+                variant="tertiary"
+                accent="neutral"
+                size="sm"
+                shape="circle"
                 className="sui-drawer__close"
                 onClick={onClose}
                 aria-label="Close"
-              >
-                <svg
-                  viewBox="0 0 24 24"
-                  width="16"
-                  height="16"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth={1.75}
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                  aria-hidden
-                >
-                  <line x1="18" y1="6" x2="6" y2="18" />
-                  <line x1="6" y1="6" x2="18" y2="18" />
-                </svg>
-              </button>
+                leftSection={
+                  <svg
+                    viewBox="0 0 24 24"
+                    width="16"
+                    height="16"
+                    fill="none"
+                    stroke="currentColor"
+                    strokeWidth={1.75}
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                    aria-hidden
+                  >
+                    <line x1="18" y1="6" x2="6" y2="18" />
+                    <line x1="6" y1="6" x2="18" y2="18" />
+                  </svg>
+                }
+              />
             </header>
           )}
           <div className="sui-drawer__body">{children}</div>
diff --git a/frontend/editor/src/proprietary/ui/Dropdown.css b/frontend/editor/src/core/ui/Dropdown.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Dropdown.css
rename to frontend/editor/src/core/ui/Dropdown.css
diff --git a/frontend/editor/src/proprietary/ui/Dropdown.stories.tsx b/frontend/editor/src/core/ui/Dropdown.stories.tsx
similarity index 90%
rename from frontend/editor/src/proprietary/ui/Dropdown.stories.tsx
rename to frontend/editor/src/core/ui/Dropdown.stories.tsx
index 7e05785ee6..ad84a09fb1 100644
--- a/frontend/editor/src/proprietary/ui/Dropdown.stories.tsx
+++ b/frontend/editor/src/core/ui/Dropdown.stories.tsx
@@ -20,7 +20,7 @@ export const Basic: Story = {
   render: () => (
     <Dropdown.Root>
       <Dropdown.Trigger>
-        <Button variant="outline">Open menu</Button>
+        <Button variant="secondary">Open menu</Button>
       </Dropdown.Trigger>
       <Dropdown.Menu>
         <Dropdown.Item onSelect={() => console.log("a")}>Item A</Dropdown.Item>
@@ -37,7 +37,7 @@ export const WithDivider: Story = {
   render: () => (
     <Dropdown.Root>
       <Dropdown.Trigger>
-        <Button variant="outline">Account</Button>
+        <Button variant="secondary">Account</Button>
       </Dropdown.Trigger>
       <Dropdown.Menu width="13rem">
         <Dropdown.Item>Profile</Dropdown.Item>
@@ -53,7 +53,7 @@ export const WithTrailingHints: Story = {
   render: () => (
     <Dropdown.Root>
       <Dropdown.Trigger>
-        <Button variant="outline">Commands</Button>
+        <Button variant="secondary">Commands</Button>
       </Dropdown.Trigger>
       <Dropdown.Menu width="16rem">
         <Dropdown.Item trailing="⌘ K">Search</Dropdown.Item>
@@ -71,7 +71,7 @@ export const AlignStart: Story = {
   render: () => (
     <Dropdown.Root align="start">
       <Dropdown.Trigger>
-        <Button variant="outline">Aligned to start</Button>
+        <Button variant="secondary">Aligned to start</Button>
       </Dropdown.Trigger>
       <Dropdown.Menu>
         <Dropdown.Item>One</Dropdown.Item>
diff --git a/frontend/editor/src/proprietary/ui/Dropdown.tsx b/frontend/editor/src/core/ui/Dropdown.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Dropdown.tsx
rename to frontend/editor/src/core/ui/Dropdown.tsx
diff --git a/frontend/editor/src/proprietary/ui/EmptyState.css b/frontend/editor/src/core/ui/EmptyState.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/EmptyState.css
rename to frontend/editor/src/core/ui/EmptyState.css
diff --git a/frontend/editor/src/proprietary/ui/EmptyState.stories.tsx b/frontend/editor/src/core/ui/EmptyState.stories.tsx
similarity index 90%
rename from frontend/editor/src/proprietary/ui/EmptyState.stories.tsx
rename to frontend/editor/src/core/ui/EmptyState.stories.tsx
index ac153ec0b0..859b498c5f 100644
--- a/frontend/editor/src/proprietary/ui/EmptyState.stories.tsx
+++ b/frontend/editor/src/core/ui/EmptyState.stories.tsx
@@ -31,10 +31,10 @@ export const WithCTAs: Story = {
       "The fastest way in is forking a pre-bundled pipeline like PII Sweep or Compliance Pack.",
     actions: (
       <>
-        <Button variant="gradient" trailingIcon={<span aria-hidden>→</span>}>
+        <Button rightSection={<span aria-hidden>→</span>}>
           Browse templates
         </Button>
-        <Button variant="outline">Build from scratch</Button>
+        <Button variant="secondary">Build from scratch</Button>
       </>
     ),
   },
diff --git a/frontend/editor/src/proprietary/ui/EmptyState.tsx b/frontend/editor/src/core/ui/EmptyState.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/EmptyState.tsx
rename to frontend/editor/src/core/ui/EmptyState.tsx
diff --git a/frontend/editor/src/core/ui/FilePicker.tsx b/frontend/editor/src/core/ui/FilePicker.tsx
new file mode 100644
index 0000000000..3e33b20e46
--- /dev/null
+++ b/frontend/editor/src/core/ui/FilePicker.tsx
@@ -0,0 +1,55 @@
+import { FileButton as MantineFileButton } from "@mantine/core";
+import type { ForwardedRef, ReactNode } from "react";
+import { Button } from "@app/ui/Button";
+import type { ButtonProps } from "@app/ui/Button";
+
+type TriggerButtonProps = Omit<
+  ButtonProps,
+  "onClick" | "onChange" | "children"
+>;
+
+export interface FilePickerProps<
+  Multiple extends boolean = false,
+> extends TriggerButtonProps {
+  /** Called with the picked file(s); null when the dialog is dismissed. */
+  onChange: (payload: Multiple extends true ? File[] : File | null) => void;
+  accept?: string;
+  multiple?: Multiple;
+  /** Ref to a function that clears the current selection (Mantine resetRef). */
+  resetRef?: ForwardedRef<() => void>;
+  name?: string;
+  capture?: boolean | "user" | "environment";
+  /** Trigger label. */
+  children?: ReactNode;
+}
+
+/** File-picker button: a shared Button trigger over a hidden file input (Mantine FileButton). */
+export function FilePicker<Multiple extends boolean = false>({
+  onChange,
+  accept,
+  multiple,
+  resetRef,
+  name,
+  capture,
+  disabled,
+  children,
+  ...buttonProps
+}: FilePickerProps<Multiple>) {
+  return (
+    <MantineFileButton<Multiple>
+      onChange={onChange}
+      accept={accept}
+      multiple={multiple}
+      resetRef={resetRef}
+      name={name}
+      capture={capture}
+      disabled={disabled}
+    >
+      {(props) => (
+        <Button {...buttonProps} {...props} disabled={disabled}>
+          {children}
+        </Button>
+      )}
+    </MantineFileButton>
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/FormField.css b/frontend/editor/src/core/ui/FormField.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/FormField.css
rename to frontend/editor/src/core/ui/FormField.css
diff --git a/frontend/editor/src/proprietary/ui/FormField.tsx b/frontend/editor/src/core/ui/FormField.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/FormField.tsx
rename to frontend/editor/src/core/ui/FormField.tsx
diff --git a/frontend/editor/src/proprietary/ui/Forms.stories.tsx b/frontend/editor/src/core/ui/Forms.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Forms.stories.tsx
rename to frontend/editor/src/core/ui/Forms.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/IconBadge.css b/frontend/editor/src/core/ui/IconBadge.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/IconBadge.css
rename to frontend/editor/src/core/ui/IconBadge.css
diff --git a/frontend/editor/src/proprietary/ui/IconBadge.stories.tsx b/frontend/editor/src/core/ui/IconBadge.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/IconBadge.stories.tsx
rename to frontend/editor/src/core/ui/IconBadge.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/IconBadge.tsx b/frontend/editor/src/core/ui/IconBadge.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/IconBadge.tsx
rename to frontend/editor/src/core/ui/IconBadge.tsx
diff --git a/frontend/editor/src/proprietary/ui/Inline.css b/frontend/editor/src/core/ui/Inline.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Inline.css
rename to frontend/editor/src/core/ui/Inline.css
diff --git a/frontend/editor/src/proprietary/ui/Inline.stories.tsx b/frontend/editor/src/core/ui/Inline.stories.tsx
similarity index 88%
rename from frontend/editor/src/proprietary/ui/Inline.stories.tsx
rename to frontend/editor/src/core/ui/Inline.stories.tsx
index b6e4ed54eb..10233e1371 100644
--- a/frontend/editor/src/proprietary/ui/Inline.stories.tsx
+++ b/frontend/editor/src/core/ui/Inline.stories.tsx
@@ -15,9 +15,9 @@ type Story = StoryObj<typeof Inline>;
 export const Default: Story = {
   render: () => (
     <Inline gap="2">
-      <Button variant="gradient">Primary</Button>
-      <Button variant="outline">Secondary</Button>
-      <Button variant="ghost">Cancel</Button>
+      <Button>Primary</Button>
+      <Button variant="secondary">Secondary</Button>
+      <Button variant="tertiary">Cancel</Button>
     </Inline>
   ),
 };
diff --git a/frontend/editor/src/proprietary/ui/Inline.tsx b/frontend/editor/src/core/ui/Inline.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Inline.tsx
rename to frontend/editor/src/core/ui/Inline.tsx
diff --git a/frontend/editor/src/proprietary/ui/Input.css b/frontend/editor/src/core/ui/Input.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Input.css
rename to frontend/editor/src/core/ui/Input.css
diff --git a/frontend/editor/src/proprietary/ui/Input.tsx b/frontend/editor/src/core/ui/Input.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Input.tsx
rename to frontend/editor/src/core/ui/Input.tsx
diff --git a/frontend/editor/src/proprietary/ui/ListRow.css b/frontend/editor/src/core/ui/ListRow.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ListRow.css
rename to frontend/editor/src/core/ui/ListRow.css
diff --git a/frontend/editor/src/proprietary/ui/ListRow.stories.tsx b/frontend/editor/src/core/ui/ListRow.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ListRow.stories.tsx
rename to frontend/editor/src/core/ui/ListRow.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/ListRow.tsx b/frontend/editor/src/core/ui/ListRow.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ListRow.tsx
rename to frontend/editor/src/core/ui/ListRow.tsx
diff --git a/frontend/editor/src/proprietary/ui/MantineForms.css b/frontend/editor/src/core/ui/MantineForms.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MantineForms.css
rename to frontend/editor/src/core/ui/MantineForms.css
diff --git a/frontend/editor/src/proprietary/ui/MantineForms.stories.tsx b/frontend/editor/src/core/ui/MantineForms.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MantineForms.stories.tsx
rename to frontend/editor/src/core/ui/MantineForms.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/MethodBadge.css b/frontend/editor/src/core/ui/MethodBadge.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MethodBadge.css
rename to frontend/editor/src/core/ui/MethodBadge.css
diff --git a/frontend/editor/src/proprietary/ui/MethodBadge.stories.tsx b/frontend/editor/src/core/ui/MethodBadge.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MethodBadge.stories.tsx
rename to frontend/editor/src/core/ui/MethodBadge.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/MethodBadge.tsx b/frontend/editor/src/core/ui/MethodBadge.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MethodBadge.tsx
rename to frontend/editor/src/core/ui/MethodBadge.tsx
diff --git a/frontend/editor/src/proprietary/ui/MetricCard.css b/frontend/editor/src/core/ui/MetricCard.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricCard.css
rename to frontend/editor/src/core/ui/MetricCard.css
diff --git a/frontend/editor/src/proprietary/ui/MetricCard.stories.tsx b/frontend/editor/src/core/ui/MetricCard.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricCard.stories.tsx
rename to frontend/editor/src/core/ui/MetricCard.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/MetricCard.tsx b/frontend/editor/src/core/ui/MetricCard.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricCard.tsx
rename to frontend/editor/src/core/ui/MetricCard.tsx
diff --git a/frontend/editor/src/proprietary/ui/MetricStrip.css b/frontend/editor/src/core/ui/MetricStrip.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricStrip.css
rename to frontend/editor/src/core/ui/MetricStrip.css
diff --git a/frontend/editor/src/proprietary/ui/MetricStrip.stories.tsx b/frontend/editor/src/core/ui/MetricStrip.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricStrip.stories.tsx
rename to frontend/editor/src/core/ui/MetricStrip.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/MetricStrip.tsx b/frontend/editor/src/core/ui/MetricStrip.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MetricStrip.tsx
rename to frontend/editor/src/core/ui/MetricStrip.tsx
diff --git a/frontend/editor/src/proprietary/ui/Modal.css b/frontend/editor/src/core/ui/Modal.css
similarity index 83%
rename from frontend/editor/src/proprietary/ui/Modal.css
rename to frontend/editor/src/core/ui/Modal.css
index d63985d97d..7d9ef68746 100644
--- a/frontend/editor/src/proprietary/ui/Modal.css
+++ b/frontend/editor/src/core/ui/Modal.css
@@ -67,23 +67,10 @@
   color: var(--color-text-4);
 }
 
+/* Sizing/background/hover are owned by the Button; this just keeps it from
+ * stretching. */
 .sui-modal__close {
   flex: 0 0 auto;
-  width: 1.75rem;
-  height: 1.75rem;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: var(--radius-sm);
-  color: var(--color-text-4);
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-
-.sui-modal__close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
 }
 
 .sui-modal__body {
diff --git a/frontend/editor/src/proprietary/ui/Modal.tsx b/frontend/editor/src/core/ui/Modal.tsx
similarity index 66%
rename from frontend/editor/src/proprietary/ui/Modal.tsx
rename to frontend/editor/src/core/ui/Modal.tsx
index c0de1d475c..09b019e0ef 100644
--- a/frontend/editor/src/proprietary/ui/Modal.tsx
+++ b/frontend/editor/src/core/ui/Modal.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useId, type ReactNode } from "react";
 import { createPortal } from "react-dom";
 import { FocusTrap } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import "@app/ui/Modal.css";
 
 export type ModalWidth = "sm" | "md" | "lg" | "xl";
@@ -8,31 +9,20 @@ export type ModalWidth = "sm" | "md" | "lg" | "xl";
 export interface ModalProps {
   open: boolean;
   onClose: () => void;
-  /** Optional heading slot rendered above the body. */
   title?: ReactNode;
-  /** Optional sub-heading rendered under the title. */
   subtitle?: ReactNode;
-  /** Optional footer slot rendered below the body. */
   footer?: ReactNode;
-  /** Width preset. sm=24rem, md=32rem, lg=48rem, xl=64rem. Defaults to md. */
+  /** sm=24rem, md=32rem, lg=48rem, xl=64rem. */
   width?: ModalWidth;
-  /** Disable click-on-backdrop dismissal. Defaults to false. */
   disableBackdropClose?: boolean;
-  /** Disable Escape-key dismissal. Defaults to false. */
   disableEscapeClose?: boolean;
-  /** Accessible name when no visible `title` is provided. */
+  /** Accessible name when no visible title is provided. */
   ariaLabel?: string;
   className?: string;
   children?: ReactNode;
 }
 
-/**
- * Portal-rendered modal with our own brand shell (header / body / footer,
- * width presets, backdrop). The hard part — trapping Tab focus inside the
- * dialog, initial focus, and restoring focus to the opener on close — is
- * delegated to Mantine's <FocusTrap> rather than hand-rolled. ESC and
- * backdrop click close by default; the caller owns the open state.
- */
+/** Tab focus trapping and restoration are delegated to Mantine's FocusTrap. */
 export function Modal({
   open,
   onClose,
@@ -102,27 +92,31 @@ export function Modal({
                 )}
                 {subtitle && <div className="sui-modal__sub">{subtitle}</div>}
               </div>
-              <button
-                type="button"
+              <Button
+                variant="tertiary"
+                accent="neutral"
+                size="sm"
+                shape="circle"
                 className="sui-modal__close"
                 onClick={onClose}
                 aria-label="Close"
-              >
-                <svg
-                  viewBox="0 0 24 24"
-                  width="16"
-                  height="16"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth={1.75}
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                  aria-hidden
-                >
-                  <line x1="18" y1="6" x2="6" y2="18" />
-                  <line x1="6" y1="6" x2="18" y2="18" />
-                </svg>
-              </button>
+                leftSection={
+                  <svg
+                    viewBox="0 0 24 24"
+                    width="16"
+                    height="16"
+                    fill="none"
+                    stroke="currentColor"
+                    strokeWidth={1.75}
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                    aria-hidden
+                  >
+                    <line x1="18" y1="6" x2="6" y2="18" />
+                    <line x1="6" y1="6" x2="18" y2="18" />
+                  </svg>
+                }
+              />
             </header>
           )}
           <div className="sui-modal__body">{children}</div>
diff --git a/frontend/editor/src/proprietary/ui/MultiSelect.tsx b/frontend/editor/src/core/ui/MultiSelect.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/MultiSelect.tsx
rename to frontend/editor/src/core/ui/MultiSelect.tsx
diff --git a/frontend/editor/src/proprietary/ui/NavItem.css b/frontend/editor/src/core/ui/NavItem.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/NavItem.css
rename to frontend/editor/src/core/ui/NavItem.css
diff --git a/frontend/editor/src/proprietary/ui/NavItem.stories.tsx b/frontend/editor/src/core/ui/NavItem.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/NavItem.stories.tsx
rename to frontend/editor/src/core/ui/NavItem.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/NavItem.tsx b/frontend/editor/src/core/ui/NavItem.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/NavItem.tsx
rename to frontend/editor/src/core/ui/NavItem.tsx
diff --git a/frontend/editor/src/proprietary/ui/NumberInput.tsx b/frontend/editor/src/core/ui/NumberInput.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/NumberInput.tsx
rename to frontend/editor/src/core/ui/NumberInput.tsx
diff --git a/frontend/editor/src/proprietary/ui/PanelHeader.css b/frontend/editor/src/core/ui/PanelHeader.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/PanelHeader.css
rename to frontend/editor/src/core/ui/PanelHeader.css
diff --git a/frontend/editor/src/proprietary/ui/PanelHeader.stories.tsx b/frontend/editor/src/core/ui/PanelHeader.stories.tsx
similarity index 75%
rename from frontend/editor/src/proprietary/ui/PanelHeader.stories.tsx
rename to frontend/editor/src/core/ui/PanelHeader.stories.tsx
index 36f193e1d8..715adbab65 100644
--- a/frontend/editor/src/proprietary/ui/PanelHeader.stories.tsx
+++ b/frontend/editor/src/core/ui/PanelHeader.stories.tsx
@@ -1,8 +1,8 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
-import DeleteSweepIcon from "@mui/icons-material/DeleteSweep";
 import { PanelHeader } from "@app/ui/PanelHeader";
 import { StatusBadge } from "@app/ui/StatusBadge";
+import { Button } from "@app/ui/Button";
 
 const meta: Meta<typeof PanelHeader> = {
   title: "Primitives/PanelHeader",
@@ -31,16 +31,11 @@ export const Accented: Story = {
  *  the menu (e.g. the chat header's "Clear chat"). */
 export const WithMenu: Story = {
   args: {
-    title: "Stirling",
-    menuLabel: "Stirling agent options",
     menuItems: [
-      {
-        key: "clear",
-        icon: <DeleteSweepIcon sx={{ fontSize: 18 }} />,
-        label: "Clear chat",
-        onClick: () => {},
-      },
+      { label: "Clear chat", onClick: () => {} },
+      { label: "Export history", onClick: () => {} },
     ],
+    menuLabel: "Chat options",
   },
 };
 
@@ -54,9 +49,17 @@ export const WithActions: Story = {
   args: {
     accent: "purple",
     actions: (
-      <StatusBadge tone="success" showDot pulse>
-        Active
-      </StatusBadge>
+      <>
+        <StatusBadge tone="success" pulse>
+          Healthy
+        </StatusBadge>
+        <Button size="sm" variant="secondary">
+          Edit composition
+        </Button>
+        <Button size="sm" variant="primary">
+          View runs
+        </Button>
+      </>
     ),
   },
 };
diff --git a/frontend/editor/src/proprietary/ui/PanelHeader.tsx b/frontend/editor/src/core/ui/PanelHeader.tsx
similarity index 94%
rename from frontend/editor/src/proprietary/ui/PanelHeader.tsx
rename to frontend/editor/src/core/ui/PanelHeader.tsx
index 26ba1b738c..3d9a0383ba 100644
--- a/frontend/editor/src/proprietary/ui/PanelHeader.tsx
+++ b/frontend/editor/src/core/ui/PanelHeader.tsx
@@ -69,9 +69,6 @@ export function PanelHeader({
 }: PanelHeaderProps) {
   const hasMenu = menuItems != null && menuItems.length > 0;
 
-  // Tint the icon badge with the category colour when an accent is given. Inline
-  // so it wins over the default blue treatment in both light and dark mode; the
-  // --color-* tokens are theme-aware and match the badge tint used elsewhere.
   const iconStyle: CSSProperties | undefined = accent
     ? {
         color: `var(--color-${accent})`,
diff --git a/frontend/editor/src/proprietary/ui/ProgressBar.css b/frontend/editor/src/core/ui/ProgressBar.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ProgressBar.css
rename to frontend/editor/src/core/ui/ProgressBar.css
diff --git a/frontend/editor/src/proprietary/ui/ProgressBar.stories.tsx b/frontend/editor/src/core/ui/ProgressBar.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ProgressBar.stories.tsx
rename to frontend/editor/src/core/ui/ProgressBar.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/ProgressBar.tsx b/frontend/editor/src/core/ui/ProgressBar.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ProgressBar.tsx
rename to frontend/editor/src/core/ui/ProgressBar.tsx
diff --git a/frontend/editor/src/proprietary/ui/Radio.css b/frontend/editor/src/core/ui/Radio.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Radio.css
rename to frontend/editor/src/core/ui/Radio.css
diff --git a/frontend/editor/src/proprietary/ui/Radio.tsx b/frontend/editor/src/core/ui/Radio.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Radio.tsx
rename to frontend/editor/src/core/ui/Radio.tsx
diff --git a/frontend/editor/src/proprietary/ui/SectionDivider.css b/frontend/editor/src/core/ui/SectionDivider.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionDivider.css
rename to frontend/editor/src/core/ui/SectionDivider.css
diff --git a/frontend/editor/src/proprietary/ui/SectionDivider.stories.tsx b/frontend/editor/src/core/ui/SectionDivider.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionDivider.stories.tsx
rename to frontend/editor/src/core/ui/SectionDivider.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/SectionDivider.tsx b/frontend/editor/src/core/ui/SectionDivider.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionDivider.tsx
rename to frontend/editor/src/core/ui/SectionDivider.tsx
diff --git a/frontend/editor/src/proprietary/ui/SectionHeader.css b/frontend/editor/src/core/ui/SectionHeader.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionHeader.css
rename to frontend/editor/src/core/ui/SectionHeader.css
diff --git a/frontend/editor/src/proprietary/ui/SectionHeader.stories.tsx b/frontend/editor/src/core/ui/SectionHeader.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionHeader.stories.tsx
rename to frontend/editor/src/core/ui/SectionHeader.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/SectionHeader.tsx b/frontend/editor/src/core/ui/SectionHeader.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SectionHeader.tsx
rename to frontend/editor/src/core/ui/SectionHeader.tsx
diff --git a/frontend/editor/src/core/ui/SegmentedControl.css b/frontend/editor/src/core/ui/SegmentedControl.css
new file mode 100644
index 0000000000..62e05c1941
--- /dev/null
+++ b/frontend/editor/src/core/ui/SegmentedControl.css
@@ -0,0 +1,38 @@
+/* Mantine-backed SegmentedControl — colour from the shared accent palette (accents.css). */
+@import "./accents.css";
+
+/* Compact the track and let labels fill the fixed height (matches Button/ActionIcon). */
+.sui-seg.mantine-SegmentedControl-root {
+  --sc-padding: 0.1875rem; /* 3px track inset */
+  align-items: stretch;
+}
+.sui-seg .mantine-SegmentedControl-control {
+  display: flex;
+}
+.sui-seg .mantine-SegmentedControl-label {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  height: 100%;
+  padding-block: 0;
+}
+/* Mantine wraps label content in .innerLabel; flex it so an icon + text sit
+ * centered together with a consistent gap. Without this the inline-block icon
+ * aligns to the text baseline and rides ~3px high. */
+.sui-seg .mantine-SegmentedControl-innerLabel {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.375rem;
+}
+
+/* secondary: strip the boxed track AND the inter-segment separators so only the
+ * tinted active pill reads — no track chrome at all. */
+.sui-seg--secondary.mantine-SegmentedControl-root {
+  background: transparent !important;
+  border-color: transparent !important;
+  box-shadow: none !important;
+}
+.sui-seg--secondary .mantine-SegmentedControl-control::before {
+  background-color: transparent !important;
+}
diff --git a/frontend/editor/src/core/ui/SegmentedControl.stories.tsx b/frontend/editor/src/core/ui/SegmentedControl.stories.tsx
new file mode 100644
index 0000000000..0f16141a5a
--- /dev/null
+++ b/frontend/editor/src/core/ui/SegmentedControl.stories.tsx
@@ -0,0 +1,135 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react";
+import InsertDriveFileOutlinedIcon from "@mui/icons-material/InsertDriveFileOutlined";
+import FolderOutlinedIcon from "@mui/icons-material/FolderOutlined";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
+
+const meta: Meta<typeof SegmentedControl> = {
+  title: "Primitives/SegmentedControl",
+  component: SegmentedControl,
+  parameters: { layout: "centered" },
+};
+export default meta;
+type Story = StoryObj<typeof SegmentedControl>;
+
+export const Default: Story = {
+  render: () => {
+    const [v, setV] = useState("medium");
+    return (
+      <SegmentedControl
+        value={v}
+        onChange={setV}
+        options={[
+          { label: "Low", value: "low" },
+          { label: "Medium", value: "medium" },
+          { label: "High", value: "high" },
+        ]}
+      />
+    );
+  },
+};
+
+export const FullWidth: Story = {
+  render: () => {
+    const [v, setV] = useState("pdf");
+    return (
+      <div style={{ width: 320 }}>
+        <SegmentedControl
+          fullWidth
+          value={v}
+          onChange={setV}
+          options={[
+            { label: "PDF", value: "pdf" },
+            { label: "Image", value: "image" },
+            { label: "Word", value: "word" },
+          ]}
+        />
+      </div>
+    );
+  },
+};
+
+/** `primary` (default) shows an accent-filled active pill; `secondary` drops the
+ * track chrome and tints the active pill + label in the accent colour. The
+ * highlight slides between segments. */
+export const Variants: Story = {
+  render: () => {
+    const [a, setA] = useState("viewer");
+    const [b, setB] = useState("viewer");
+    const options = [
+      { label: "Viewer", value: "viewer" },
+      { label: "Page Editor", value: "pages" },
+      { label: "Active Files", value: "files" },
+    ];
+    return (
+      <div style={{ display: "flex", flexDirection: "column", gap: 24 }}>
+        <SegmentedControl
+          variant="primary"
+          value={a}
+          onChange={setA}
+          options={options}
+        />
+        <SegmentedControl
+          variant="secondary"
+          accent="default"
+          value={b}
+          onChange={setB}
+          options={options}
+        />
+      </div>
+    );
+  },
+};
+
+export const Small: Story = {
+  render: () => {
+    const [v, setV] = useState("pages");
+    return (
+      <SegmentedControl
+        size="sm"
+        value={v}
+        onChange={setV}
+        options={[
+          { label: "Pages", value: "pages" },
+          { label: "Files", value: "files" },
+        ]}
+      />
+    );
+  },
+};
+
+/** Icon + label per segment (mirrors the workbench view switcher). Icons and
+ * labels should sit centered together in each segment. */
+export const WithIcons: Story = {
+  render: () => {
+    const [v, setV] = useState("viewer");
+    return (
+      <SegmentedControl
+        size="sm"
+        variant="secondary"
+        value={v}
+        onChange={setV}
+        options={[
+          {
+            value: "viewer",
+            label: (
+              <>
+                <InsertDriveFileOutlinedIcon fontSize="small" />
+                <span>Viewer</span>
+              </>
+            ),
+          },
+          {
+            value: "files",
+            label: (
+              <>
+                <FolderOutlinedIcon fontSize="small" />
+                <span>Active Files</span>
+              </>
+            ),
+          },
+        ]}
+      />
+    );
+  },
+};
diff --git a/frontend/editor/src/core/ui/SegmentedControl.tsx b/frontend/editor/src/core/ui/SegmentedControl.tsx
new file mode 100644
index 0000000000..a82874cc45
--- /dev/null
+++ b/frontend/editor/src/core/ui/SegmentedControl.tsx
@@ -0,0 +1,103 @@
+import { SegmentedControl as MantineSegmentedControl } from "@mantine/core";
+import type { CSSProperties, ReactNode } from "react";
+import { CONTROL_HEIGHT } from "@app/ui/controlSizes";
+import "@app/ui/SegmentedControl.css";
+
+/** Same accent dial as Button. Only the active segment is accented. */
+export type SegmentedAccent =
+  | "default"
+  | "neutral"
+  | "brand"
+  | "ai"
+  | "premium"
+  | "danger"
+  | "success"
+  | "warning";
+export type SegmentedSize = "xs" | "sm" | "md" | "lg";
+/** primary = accent-filled active pill; secondary = subtle tinted pill, no track chrome. */
+export type SegmentedVariant = "primary" | "secondary";
+
+// Overall height, in sync with Button/ActionIcon via CONTROL_HEIGHT (xs is segmented-only).
+const SEG_HEIGHT: Record<SegmentedSize, string> = {
+  xs: "26px",
+  sm: CONTROL_HEIGHT.sm,
+  md: CONTROL_HEIGHT.md,
+  lg: CONTROL_HEIGHT.lg,
+};
+
+export interface SegmentedOption<T extends string> {
+  label: ReactNode;
+  value: T;
+  disabled?: boolean;
+}
+
+export interface SegmentedControlProps<T extends string> {
+  options: SegmentedOption<T>[];
+  value: T;
+  onChange: (value: T) => void;
+  accent?: SegmentedAccent;
+  size?: SegmentedSize;
+  variant?: SegmentedVariant;
+  fullWidth?: boolean;
+  disabled?: boolean;
+  /** Alias of `disabled`; also disables the control. */
+  loading?: boolean;
+  /** Accessible name for the radiogroup. */
+  ariaLabel?: string;
+  className?: string;
+  style?: CSSProperties;
+}
+
+/** Single-select control with a sliding highlight (Mantine-backed). */
+export function SegmentedControl<T extends string>({
+  options,
+  value,
+  onChange,
+  accent = "default",
+  size = "md",
+  variant = "primary",
+  fullWidth = false,
+  disabled = false,
+  loading = false,
+  ariaLabel,
+  className,
+  style,
+}: SegmentedControlProps<T>) {
+  const classes = [
+    "sui-seg",
+    `sui-acc-${accent}`,
+    `sui-seg--${variant}`,
+    className ?? "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+
+  // Drive Mantine's indicator/label colour vars from the accent palette.
+  const accentVars =
+    variant === "primary"
+      ? { "--sc-color": "var(--_solid)", "--sc-label-color": "var(--_on)" }
+      : { "--sc-color": "var(--_tint)", "--sc-label-color": "var(--_text)" };
+
+  return (
+    <MantineSegmentedControl
+      className={classes}
+      style={{
+        ...(accentVars as CSSProperties),
+        // Fixed height (matches Button/ActionIcon per size); CSS fills the labels.
+        height: SEG_HEIGHT[size],
+        ...style,
+      }}
+      data={options.map((o) => ({
+        label: o.label,
+        value: o.value,
+        disabled: o.disabled,
+      }))}
+      value={value}
+      onChange={(v) => onChange(v as T)}
+      size={size}
+      fullWidth={fullWidth}
+      disabled={disabled || loading}
+      aria-label={ariaLabel}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/ui/Select.css b/frontend/editor/src/core/ui/Select.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Select.css
rename to frontend/editor/src/core/ui/Select.css
diff --git a/frontend/editor/src/proprietary/ui/Select.tsx b/frontend/editor/src/core/ui/Select.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Select.tsx
rename to frontend/editor/src/core/ui/Select.tsx
diff --git a/frontend/editor/src/proprietary/ui/SettingsRow.css b/frontend/editor/src/core/ui/SettingsRow.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SettingsRow.css
rename to frontend/editor/src/core/ui/SettingsRow.css
diff --git a/frontend/editor/src/proprietary/ui/SettingsRow.stories.tsx b/frontend/editor/src/core/ui/SettingsRow.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SettingsRow.stories.tsx
rename to frontend/editor/src/core/ui/SettingsRow.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/SettingsRow.tsx b/frontend/editor/src/core/ui/SettingsRow.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/SettingsRow.tsx
rename to frontend/editor/src/core/ui/SettingsRow.tsx
diff --git a/frontend/editor/src/proprietary/ui/SettingsShell.css b/frontend/editor/src/core/ui/SettingsShell.css
similarity index 88%
rename from frontend/editor/src/proprietary/ui/SettingsShell.css
rename to frontend/editor/src/core/ui/SettingsShell.css
index 5e56a7934e..5d0e591c8b 100644
--- a/frontend/editor/src/proprietary/ui/SettingsShell.css
+++ b/frontend/editor/src/core/ui/SettingsShell.css
@@ -109,24 +109,10 @@
   align-items: center;
   gap: 0.5rem;
 }
+/* Sizing/background/hover are owned by the Button; this just keeps it from
+ * stretching. */
 .sui-settings-shell__close {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.75rem;
-  height: 1.75rem;
-  border: none;
-  border-radius: var(--radius-sm);
-  background: none;
-  color: var(--color-text-3);
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-.sui-settings-shell__close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
+  flex: 0 0 auto;
 }
 
 .sui-settings-shell__body {
diff --git a/frontend/editor/src/proprietary/ui/SettingsShell.stories.tsx b/frontend/editor/src/core/ui/SettingsShell.stories.tsx
similarity index 94%
rename from frontend/editor/src/proprietary/ui/SettingsShell.stories.tsx
rename to frontend/editor/src/core/ui/SettingsShell.stories.tsx
index 4d14cd98c9..cd266c95a1 100644
--- a/frontend/editor/src/proprietary/ui/SettingsShell.stories.tsx
+++ b/frontend/editor/src/core/ui/SettingsShell.stories.tsx
@@ -58,8 +58,8 @@ export const Default: Story = {
           onClose={() => {}}
           footer={
             <>
-              <Button variant="ghost">Cancel</Button>
-              <Button variant="gradient">Save changes</Button>
+              <Button variant="tertiary">Cancel</Button>
+              <Button>Save changes</Button>
             </>
           }
         >
diff --git a/frontend/editor/src/proprietary/ui/SettingsShell.tsx b/frontend/editor/src/core/ui/SettingsShell.tsx
similarity index 65%
rename from frontend/editor/src/proprietary/ui/SettingsShell.tsx
rename to frontend/editor/src/core/ui/SettingsShell.tsx
index 77dd36e2ca..8e86715d80 100644
--- a/frontend/editor/src/proprietary/ui/SettingsShell.tsx
+++ b/frontend/editor/src/core/ui/SettingsShell.tsx
@@ -1,18 +1,17 @@
 import type { ReactNode } from "react";
+import { Button } from "@app/ui/Button";
 import "@app/ui/SettingsShell.css";
 
 export interface SettingsNavItem {
   key: string;
   label: string;
-  /** Optional leading glyph. */
   icon?: ReactNode;
-  /** Optional trailing badge (e.g. a plan gate or count). */
+  /** Trailing badge (e.g. plan gate or count). */
   badge?: ReactNode;
   disabled?: boolean;
 }
 
 export interface SettingsNavSection {
-  /** Uppercase group heading above its items. */
   title: string;
   items: SettingsNavItem[];
 }
@@ -21,28 +20,17 @@ export interface SettingsShellProps {
   sections: SettingsNavSection[];
   activeKey: string;
   onSelect: (key: string) => void;
-  /** Heading for the content pane — usually the active item's label. */
   title: ReactNode;
-  /** Renders a close button at the top-right of the content header. */
   onClose?: () => void;
-  /** Extra header controls (e.g. a search field) left of the close button. */
+  /** Rendered left of the close button. */
   headerActions?: ReactNode;
-  /** Sticky footer, e.g. Save / Cancel. */
+  /** Sticky footer (e.g. Save / Cancel). */
   footer?: ReactNode;
-  /** Active section content. */
   children: ReactNode;
   className?: string;
 }
 
-/**
- * Two-pane settings layout: a grouped left navigation rail and a content pane
- * with a sticky header (active title + actions) and an optional sticky footer.
- *
- * Layout chrome only — the caller owns section state and renders the active
- * panel as `children`. Host it inside any modal/dialog frame (it fills its
- * container's height and scrolls the two panes independently). Shared so the
- * portal and the editor can present account settings the same way.
- */
+/** Two-pane settings layout. Fills its container; both panes scroll independently. */
 export function SettingsShell({
   sections,
   activeKey,
@@ -103,27 +91,31 @@ export function SettingsShell({
           <div className="sui-settings-shell__header-actions">
             {headerActions}
             {onClose && (
-              <button
-                type="button"
+              <Button
+                variant="tertiary"
+                accent="neutral"
+                size="sm"
+                shape="circle"
                 className="sui-settings-shell__close"
                 onClick={onClose}
                 aria-label="Close"
-              >
-                <svg
-                  viewBox="0 0 24 24"
-                  width="16"
-                  height="16"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth={1.75}
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                  aria-hidden
-                >
-                  <line x1="18" y1="6" x2="6" y2="18" />
-                  <line x1="6" y1="6" x2="18" y2="18" />
-                </svg>
-              </button>
+                leftSection={
+                  <svg
+                    viewBox="0 0 24 24"
+                    width="16"
+                    height="16"
+                    fill="none"
+                    stroke="currentColor"
+                    strokeWidth={1.75}
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                    aria-hidden
+                  >
+                    <line x1="18" y1="6" x2="6" y2="18" />
+                    <line x1="6" y1="6" x2="18" y2="18" />
+                  </svg>
+                }
+              />
             )}
           </div>
         </header>
diff --git a/frontend/editor/src/proprietary/ui/Skeleton.css b/frontend/editor/src/core/ui/Skeleton.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Skeleton.css
rename to frontend/editor/src/core/ui/Skeleton.css
diff --git a/frontend/editor/src/proprietary/ui/Skeleton.stories.tsx b/frontend/editor/src/core/ui/Skeleton.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Skeleton.stories.tsx
rename to frontend/editor/src/core/ui/Skeleton.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Skeleton.tsx b/frontend/editor/src/core/ui/Skeleton.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Skeleton.tsx
rename to frontend/editor/src/core/ui/Skeleton.tsx
diff --git a/frontend/editor/src/proprietary/ui/Slider.css b/frontend/editor/src/core/ui/Slider.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Slider.css
rename to frontend/editor/src/core/ui/Slider.css
diff --git a/frontend/editor/src/proprietary/ui/Slider.tsx b/frontend/editor/src/core/ui/Slider.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Slider.tsx
rename to frontend/editor/src/core/ui/Slider.tsx
diff --git a/frontend/editor/src/proprietary/ui/Spinner.css b/frontend/editor/src/core/ui/Spinner.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Spinner.css
rename to frontend/editor/src/core/ui/Spinner.css
diff --git a/frontend/editor/src/proprietary/ui/Spinner.stories.tsx b/frontend/editor/src/core/ui/Spinner.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Spinner.stories.tsx
rename to frontend/editor/src/core/ui/Spinner.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Spinner.tsx b/frontend/editor/src/core/ui/Spinner.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Spinner.tsx
rename to frontend/editor/src/core/ui/Spinner.tsx
diff --git a/frontend/editor/src/proprietary/ui/Stack.css b/frontend/editor/src/core/ui/Stack.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Stack.css
rename to frontend/editor/src/core/ui/Stack.css
diff --git a/frontend/editor/src/proprietary/ui/Stack.stories.tsx b/frontend/editor/src/core/ui/Stack.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Stack.stories.tsx
rename to frontend/editor/src/core/ui/Stack.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Stack.tsx b/frontend/editor/src/core/ui/Stack.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Stack.tsx
rename to frontend/editor/src/core/ui/Stack.tsx
diff --git a/frontend/editor/src/proprietary/ui/StatTile.css b/frontend/editor/src/core/ui/StatTile.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatTile.css
rename to frontend/editor/src/core/ui/StatTile.css
diff --git a/frontend/editor/src/proprietary/ui/StatTile.stories.tsx b/frontend/editor/src/core/ui/StatTile.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatTile.stories.tsx
rename to frontend/editor/src/core/ui/StatTile.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/StatTile.tsx b/frontend/editor/src/core/ui/StatTile.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatTile.tsx
rename to frontend/editor/src/core/ui/StatTile.tsx
diff --git a/frontend/editor/src/proprietary/ui/StatusBadge.css b/frontend/editor/src/core/ui/StatusBadge.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatusBadge.css
rename to frontend/editor/src/core/ui/StatusBadge.css
diff --git a/frontend/editor/src/proprietary/ui/StatusBadge.stories.tsx b/frontend/editor/src/core/ui/StatusBadge.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatusBadge.stories.tsx
rename to frontend/editor/src/core/ui/StatusBadge.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/StatusBadge.tsx b/frontend/editor/src/core/ui/StatusBadge.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StatusBadge.tsx
rename to frontend/editor/src/core/ui/StatusBadge.tsx
diff --git a/frontend/editor/src/proprietary/ui/StepIndicator.css b/frontend/editor/src/core/ui/StepIndicator.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StepIndicator.css
rename to frontend/editor/src/core/ui/StepIndicator.css
diff --git a/frontend/editor/src/proprietary/ui/StepIndicator.stories.tsx b/frontend/editor/src/core/ui/StepIndicator.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StepIndicator.stories.tsx
rename to frontend/editor/src/core/ui/StepIndicator.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/StepIndicator.tsx b/frontend/editor/src/core/ui/StepIndicator.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/StepIndicator.tsx
rename to frontend/editor/src/core/ui/StepIndicator.tsx
diff --git a/frontend/editor/src/proprietary/ui/Table.css b/frontend/editor/src/core/ui/Table.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Table.css
rename to frontend/editor/src/core/ui/Table.css
diff --git a/frontend/editor/src/proprietary/ui/Table.stories.tsx b/frontend/editor/src/core/ui/Table.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Table.stories.tsx
rename to frontend/editor/src/core/ui/Table.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Table.tsx b/frontend/editor/src/core/ui/Table.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Table.tsx
rename to frontend/editor/src/core/ui/Table.tsx
diff --git a/frontend/editor/src/proprietary/ui/Tabs.css b/frontend/editor/src/core/ui/Tabs.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Tabs.css
rename to frontend/editor/src/core/ui/Tabs.css
diff --git a/frontend/editor/src/proprietary/ui/Tabs.stories.tsx b/frontend/editor/src/core/ui/Tabs.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Tabs.stories.tsx
rename to frontend/editor/src/core/ui/Tabs.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Tabs.tsx b/frontend/editor/src/core/ui/Tabs.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Tabs.tsx
rename to frontend/editor/src/core/ui/Tabs.tsx
diff --git a/frontend/editor/src/proprietary/ui/Toast.css b/frontend/editor/src/core/ui/Toast.css
similarity index 81%
rename from frontend/editor/src/proprietary/ui/Toast.css
rename to frontend/editor/src/core/ui/Toast.css
index ab52d37d3e..a1ca3a67bf 100644
--- a/frontend/editor/src/proprietary/ui/Toast.css
+++ b/frontend/editor/src/core/ui/Toast.css
@@ -52,19 +52,10 @@
   line-height: 1.45;
 }
 
+/* Sizing/background/hover are owned by the Button; this just keeps it from
+ * stretching and sizes the × glyph. */
 .sui-toast__close {
   flex: 0 0 auto;
-  width: 1.25rem;
-  height: 1.25rem;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: var(--radius-sm);
-  color: var(--color-text-4);
   font-size: 1rem;
   line-height: 1;
 }
-.sui-toast__close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-}
diff --git a/frontend/editor/src/proprietary/ui/Toast.stories.tsx b/frontend/editor/src/core/ui/Toast.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/Toast.stories.tsx
rename to frontend/editor/src/core/ui/Toast.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/Toast.tsx b/frontend/editor/src/core/ui/Toast.tsx
similarity index 90%
rename from frontend/editor/src/proprietary/ui/Toast.tsx
rename to frontend/editor/src/core/ui/Toast.tsx
index 055f5ec08d..12dcc16990 100644
--- a/frontend/editor/src/proprietary/ui/Toast.tsx
+++ b/frontend/editor/src/core/ui/Toast.tsx
@@ -9,6 +9,7 @@ import {
   type ReactNode,
 } from "react";
 import { createPortal } from "react-dom";
+import { Button } from "@app/ui/Button";
 import "@app/ui/Toast.css";
 
 export type ToastTone = "info" | "success" | "warning" | "danger";
@@ -84,8 +85,7 @@ function ToastViewport({
   entries: ToastEntry[];
   onDismiss: (id: number) => void;
 }) {
-  // Render through a portal so toasts always sit above any in-flow stacking
-  // context. SSR-safe by checking for document existence.
+  // Portal keeps toasts above any stacking context; document check is SSR safety.
   if (typeof document === "undefined") return null;
   return createPortal(
     <div
@@ -109,7 +109,7 @@ function ToastItem({
   onDismiss: (id: number) => void;
 }) {
   useEffect(() => {
-    // Allow Escape to dismiss the most recently focused toast.
+    // Escape dismisses the focused toast.
     function onKey(e: KeyboardEvent) {
       if (e.key === "Escape") onDismiss(entry.id);
     }
@@ -128,14 +128,16 @@ function ToastItem({
           <div className="sui-toast__desc">{entry.description}</div>
         )}
       </div>
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
+        accent="neutral"
+        size="sm"
+        shape="circle"
         className="sui-toast__close"
         onClick={() => onDismiss(entry.id)}
         aria-label="Dismiss"
-      >
-        ×
-      </button>
+        leftSection={<span>×</span>}
+      />
     </div>
   );
 }
diff --git a/frontend/editor/src/proprietary/ui/ToggleSwitch.css b/frontend/editor/src/core/ui/ToggleSwitch.css
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ToggleSwitch.css
rename to frontend/editor/src/core/ui/ToggleSwitch.css
diff --git a/frontend/editor/src/proprietary/ui/ToggleSwitch.stories.tsx b/frontend/editor/src/core/ui/ToggleSwitch.stories.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ToggleSwitch.stories.tsx
rename to frontend/editor/src/core/ui/ToggleSwitch.stories.tsx
diff --git a/frontend/editor/src/proprietary/ui/ToggleSwitch.tsx b/frontend/editor/src/core/ui/ToggleSwitch.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ToggleSwitch.tsx
rename to frontend/editor/src/core/ui/ToggleSwitch.tsx
diff --git a/frontend/editor/src/core/ui/accents.css b/frontend/editor/src/core/ui/accents.css
new file mode 100644
index 0000000000..75001f6777
--- /dev/null
+++ b/frontend/editor/src/core/ui/accents.css
@@ -0,0 +1,101 @@
+/* Shared accent palette for Button/ActionIcon/SegmentedControl/Chip; standard
+ * accents derive from --color-* tokens (auto dark), neutral/brand/ai are explicit. */
+
+.sui-acc-default {
+  --_solid: var(--color-blue);
+  --_solid-hover: var(--color-blue-dark);
+  --_on: #ffffff;
+  --_text: var(--color-blue-dark);
+  --_bd: var(--color-blue-border);
+  --_tint: color-mix(in srgb, var(--color-blue) 12%, transparent);
+}
+.sui-acc-danger {
+  --_solid: var(--color-red);
+  --_solid-hover: var(--color-red-dark);
+  --_on: #ffffff;
+  --_text: var(--color-red-dark);
+  --_bd: var(--color-red-border);
+  --_tint: color-mix(in srgb, var(--color-red) 12%, transparent);
+}
+.sui-acc-success {
+  --_solid: var(--color-green);
+  --_solid-hover: var(--color-green-dark);
+  --_on: #ffffff;
+  --_text: var(--color-green-dark);
+  --_bd: var(--color-green-border);
+  --_tint: color-mix(in srgb, var(--color-green) 12%, transparent);
+}
+.sui-acc-warning {
+  --_solid: var(--color-amber);
+  --_solid-hover: var(--color-amber-dark);
+  --_on: #ffffff;
+  --_text: var(--color-amber-dark);
+  --_bd: var(--color-amber-border);
+  --_tint: color-mix(in srgb, var(--color-amber) 12%, transparent);
+}
+/* premium: purple upgrade CTA — gradient fill (token), violet text/border. */
+.sui-acc-premium {
+  --_solid: var(--grad-purple-btn);
+  --_solid-hover: var(--grad-purple-btn);
+  --_on: #ffffff;
+  --_text: var(--color-purple-dark);
+  --_bd: var(--color-purple-border);
+  --_tint: color-mix(in srgb, var(--color-purple) 12%, transparent);
+}
+
+/* neutral: low-emphasis grey — no palette token, so explicit. */
+.sui-acc-neutral {
+  --_solid: #475569;
+  --_solid-hover: #334155;
+  --_on: #ffffff;
+  --_text: #475569;
+  --_bd: #cbd5e1;
+  --_tint: rgba(71, 85, 105, 0.1);
+}
+[data-theme="dark"] .sui-acc-neutral {
+  --_solid: #64748b;
+  --_solid-hover: #475569;
+  --_text: #cbd5e1;
+  --_bd: #334155;
+  --_tint: rgba(148, 163, 184, 0.16);
+}
+/* brand: Stirling red — a bespoke brand colour, not part of the token palette. */
+.sui-acc-brand {
+  --_solid: #8e3131;
+  --_solid-hover: #7a2929;
+  --_on: #ffffff;
+  --_text: #8e3131;
+  --_bd: #d9a8a8;
+  --_tint: rgba(142, 49, 49, 0.09);
+}
+[data-theme="dark"] .sui-acc-brand {
+  --_text: #d98a8a;
+  --_bd: #5a2424;
+  --_tint: rgba(217, 138, 138, 0.16);
+}
+/* ai: multi-hue gradient for AI features — no single-colour token. */
+.sui-acc-ai {
+  --_solid: linear-gradient(
+    135deg,
+    #8b5cf6 0%,
+    #6366f1 38%,
+    #3b82f6 72%,
+    #22d3ee 100%
+  );
+  --_solid-hover: linear-gradient(
+    135deg,
+    #8b5cf6 0%,
+    #6366f1 38%,
+    #3b82f6 72%,
+    #22d3ee 100%
+  );
+  --_on: #ffffff;
+  --_text: #6366f1;
+  --_bd: #c7d2fe;
+  --_tint: rgba(99, 102, 241, 0.1);
+}
+[data-theme="dark"] .sui-acc-ai {
+  --_text: #a5b4fc;
+  --_bd: #3730a3;
+  --_tint: rgba(129, 140, 248, 0.18);
+}
diff --git a/frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx b/frontend/editor/src/core/ui/ariaForwarding.test.tsx
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ariaForwarding.test.tsx
rename to frontend/editor/src/core/ui/ariaForwarding.test.tsx
diff --git a/frontend/editor/src/proprietary/ui/ariaForwarding.ts b/frontend/editor/src/core/ui/ariaForwarding.ts
similarity index 100%
rename from frontend/editor/src/proprietary/ui/ariaForwarding.ts
rename to frontend/editor/src/core/ui/ariaForwarding.ts
diff --git a/frontend/editor/src/core/ui/controlSizes.ts b/frontend/editor/src/core/ui/controlSizes.ts
new file mode 100644
index 0000000000..44347ce99d
--- /dev/null
+++ b/frontend/editor/src/core/ui/controlSizes.ts
@@ -0,0 +1,9 @@
+/** Shared control height scale (px) — Button, ActionIcon and SegmentedControl all use it. */
+export const CONTROL_HEIGHT = {
+  sm: "30px",
+  md: "36px",
+  lg: "42px",
+  xl: "48px",
+} as const;
+
+export type ControlSize = keyof typeof CONTROL_HEIGHT;
diff --git a/frontend/editor/src/proprietary/ui/index.ts b/frontend/editor/src/core/ui/index.ts
similarity index 92%
rename from frontend/editor/src/proprietary/ui/index.ts
rename to frontend/editor/src/core/ui/index.ts
index e6c4864c52..39b305f358 100644
--- a/frontend/editor/src/proprietary/ui/index.ts
+++ b/frontend/editor/src/core/ui/index.ts
@@ -1,4 +1,7 @@
 export * from "@app/ui/Button";
+export * from "@app/ui/ActionIcon";
+export * from "@app/ui/FilePicker";
+export * from "@app/ui/SegmentedControl";
 export * from "@app/ui/StatusBadge";
 export * from "@app/ui/MethodBadge";
 export * from "@app/ui/ToggleSwitch";
diff --git a/frontend/editor/src/desktop/components/ConnectionSettings.tsx b/frontend/editor/src/desktop/components/ConnectionSettings.tsx
index aec2d2bad6..746af00b25 100644
--- a/frontend/editor/src/desktop/components/ConnectionSettings.tsx
+++ b/frontend/editor/src/desktop/components/ConnectionSettings.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useEffect } from "react";
-import { Stack, Card, Badge, Button, Text, Group } from "@mantine/core";
+import { Stack, Card, Badge, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import {
   connectionModeService,
@@ -153,14 +154,14 @@ export const ConnectionSettings: React.FC = () => {
 
           <Group mt="md">
             {config.mode === "local" ? (
-              <Button onClick={handleSignIn} color="blue" variant="light">
+              <Button onClick={handleSignIn} variant="secondary">
                 {t("settings.connection.signIn", "Sign In")}
               </Button>
             ) : (
               <Button
                 onClick={handleLogout}
-                color="red"
-                variant="light"
+                accent="danger"
+                variant="secondary"
                 disabled={loading}
               >
                 {t("settings.connection.logout", "Log Out")}
diff --git a/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx b/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
index 0a07c8127c..96bddff2af 100644
--- a/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
+++ b/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
@@ -1,5 +1,7 @@
 import { useState, useMemo } from "react";
-import { Modal, Stack, Group, Button, ActionIcon } from "@mantine/core";
+import { Modal, Stack, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import CloseIcon from "@mui/icons-material/Close";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -105,8 +107,9 @@ export function DesktopOnboardingModal() {
           />
           <ActionIcon
             onClick={handleClose}
-            radius="md"
-            size={36}
+            variant="tertiary"
+            size="md"
+            aria-label={t("close", "Close")}
             style={{
               position: "absolute",
               top: 16,
@@ -116,11 +119,6 @@ export function DesktopOnboardingModal() {
               backdropFilter: "blur(4px)",
               zIndex: 10,
             }}
-            styles={{
-              root: {
-                "&:hover": { backgroundColor: "rgba(255, 255, 255, 0.3)" },
-              },
-            }}
           >
             <CloseIcon fontSize="small" />
           </ActionIcon>
@@ -165,15 +163,7 @@ export function DesktopOnboardingModal() {
               <OnboardingStepper totalSteps={totalSteps} activeStep={step} />
               <div className={styles.buttonContainer}>
                 <Group justify="flex-end">
-                  <Button
-                    onClick={() => setStep(1)}
-                    styles={{
-                      root: {
-                        background: "var(--onboarding-primary-button-bg)",
-                        color: "var(--onboarding-primary-button-text)",
-                      },
-                    }}
-                  >
+                  <Button onClick={() => setStep(1)} accent="neutral">
                     {t("onboarding.buttons.next", "Next →")}
                   </Button>
                 </Group>
diff --git a/frontend/editor/src/desktop/components/SetupWizard/DesktopOAuthButtons.tsx b/frontend/editor/src/desktop/components/SetupWizard/DesktopOAuthButtons.tsx
index c9813d818e..6d4940e178 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/DesktopOAuthButtons.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/DesktopOAuthButtons.tsx
@@ -4,6 +4,7 @@ import { authService, UserInfo } from "@app/services/authService";
 import { buildOAuthCallbackHtml } from "@app/utils/oauthCallbackHtml";
 import { oauthIconUrl } from "@app/auth/ui/oauthIcons";
 import { STIRLING_SAAS_URL } from "@app/constants/connection";
+import { Button } from "@app/ui/Button";
 import "@app/components/SetupWizard/desktopOAuth.css";
 
 type KnownProviderId =
@@ -149,7 +150,8 @@ export const DesktopOAuthButtons: React.FC<DesktopOAuthButtonsProps> = ({
                 providerEntry.id.slice(1)
               : t("setup.login.sso", "Single Sign-On"));
           return (
-            <button
+            <Button
+              variant="secondary"
               key={providerEntry.id}
               onClick={() => handleOAuthLogin(providerEntry)}
               disabled={isDisabled || oauthLoading}
@@ -168,7 +170,7 @@ export const DesktopOAuthButtons: React.FC<DesktopOAuthButtonsProps> = ({
                 </span>
                 <span className="oauth-button-text-desktop">{label}</span>
               </span>
-            </button>
+            </Button>
           );
         })}
       {oauthLoading && (
diff --git a/frontend/editor/src/desktop/components/SetupWizard/SaaSLoginScreen.tsx b/frontend/editor/src/desktop/components/SetupWizard/SaaSLoginScreen.tsx
index dc346ef9ac..a698611d52 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/SaaSLoginScreen.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/SaaSLoginScreen.tsx
@@ -7,6 +7,7 @@ import DividerWithText from "@app/components/shared/DividerWithText";
 import { DesktopOAuthButtons } from "@app/components/SetupWizard/DesktopOAuthButtons";
 import { SelfHostedLink } from "@app/components/SetupWizard/SelfHostedLink";
 import { UserInfo } from "@app/services/authService";
+import { Button } from "@app/ui/Button";
 import "@app/auth/ui/auth.css";
 
 interface SaaSLoginScreenProps {
@@ -107,8 +108,8 @@ export const SaaSLoginScreen: React.FC<SaaSLoginScreenProps> = ({
         className="navigation-link-container"
         style={{ marginTop: "0.5rem", textAlign: "right" }}
       >
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={() => {
             setValidationError(null);
             onSwitchToSignup();
@@ -117,7 +118,7 @@ export const SaaSLoginScreen: React.FC<SaaSLoginScreenProps> = ({
           disabled={loading}
         >
           {t("signup.signUp", "Sign Up")}
-        </button>
+        </Button>
       </div>
 
       <SelfHostedLink onClick={onSelfHostedClick} disabled={loading} />
@@ -127,14 +128,14 @@ export const SaaSLoginScreen: React.FC<SaaSLoginScreenProps> = ({
           className="navigation-link-container"
           style={{ marginTop: "0.5rem", textAlign: "center" }}
         >
-          <button
-            type="button"
+          <Button
+            variant="tertiary"
             onClick={onSkipSignIn}
             className="navigation-link-button"
             disabled={loading}
           >
             {t("setup.login.skipSignIn", "Continue without signing in")}
-          </button>
+          </Button>
         </div>
       )}
     </>
diff --git a/frontend/editor/src/desktop/components/SetupWizard/SelfHostedLink.tsx b/frontend/editor/src/desktop/components/SetupWizard/SelfHostedLink.tsx
index 8d5c98fe6e..4d3f688179 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/SelfHostedLink.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/SelfHostedLink.tsx
@@ -1,5 +1,6 @@
 import React from "react";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import "@app/auth/ui/auth.css";
 
 interface SelfHostedLinkProps {
@@ -15,14 +16,14 @@ export const SelfHostedLink: React.FC<SelfHostedLinkProps> = ({
 
   return (
     <div className="navigation-link-container" style={{ marginTop: "1.5rem" }}>
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         onClick={onClick}
         disabled={disabled}
         className="navigation-link-button"
       >
         {t("setup.selfhosted.link", "or connect to a self hosted account")}
-      </button>
+      </Button>
     </div>
   );
 };
diff --git a/frontend/editor/src/desktop/components/SetupWizard/ServerSelection.tsx b/frontend/editor/src/desktop/components/SetupWizard/ServerSelection.tsx
index 10746a66ea..cda4f2f4fc 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/ServerSelection.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/ServerSelection.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Stack, Button, TextInput, Alert, Text } from "@mantine/core";
+import { Stack, TextInput, Alert, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import {
   ServerConfig,
@@ -316,8 +317,8 @@ export const ServerSelection: React.FC<ServerSelectionProps> = ({
 
         {serverUrl && (
           <div className="navigation-link-container">
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               className="navigation-link-button"
               disabled={testing || loading}
               onClick={() => {
@@ -331,7 +332,7 @@ export const ServerSelection: React.FC<ServerSelectionProps> = ({
               {t("setup.server.useLast", "Last used server: {{serverUrl}}", {
                 serverUrl: serverUrl,
               })}
-            </button>
+            </Button>
           </div>
         )}
 
@@ -339,9 +340,11 @@ export const ServerSelection: React.FC<ServerSelectionProps> = ({
           type="submit"
           loading={testing || loading}
           disabled={loading}
-          mt="md"
           fullWidth
-          color="#AF3434"
+          accent="danger"
+          style={{
+            marginTop: "var(--mantine-spacing-md)",
+          }}
         >
           {testing
             ? t("setup.server.testing", "Testing connection...")
diff --git a/frontend/editor/src/desktop/components/SetupWizard/index.tsx b/frontend/editor/src/desktop/components/SetupWizard/index.tsx
index 2f6ddaba2b..b0779e6b78 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/index.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/index.tsx
@@ -1,6 +1,7 @@
 import React, { useCallback, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Stack, Text, Button, Alert, Loader, Center } from "@mantine/core";
+import { Stack, Text, Alert, Loader, Center } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { DesktopAuthLayout } from "@app/components/SetupWizard/DesktopAuthLayout";
 import { SaaSLoginScreen } from "@app/components/SetupWizard/SaaSLoginScreen";
 import { SaaSSignupScreen } from "@app/components/SetupWizard/SaaSSignupScreen";
@@ -476,8 +477,6 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({
               </Text>
             </Alert>
             <Button
-              variant="filled"
-              color="blue"
               fullWidth
               loading={loading}
               onClick={() => void loadLockedConfig()}
@@ -498,8 +497,7 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({
               </DisabledButtonWithTooltip>
             ) : (
               <Button
-                variant="light"
-                color="blue"
+                variant="secondary"
                 fullWidth
                 loading={loading}
                 onClick={() => {
@@ -514,8 +512,8 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({
               </Button>
             )}
             <Button
-              variant="subtle"
-              color="white"
+              variant="tertiary"
+              accent="neutral"
               fullWidth
               onClick={handleLocalMode}
             >
@@ -547,14 +545,14 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({
               className="navigation-link-container"
               style={{ marginTop: "1.5rem" }}
             >
-              <button
-                type="button"
+              <Button
+                variant="tertiary"
                 onClick={handleLocalMode}
                 className="navigation-link-button"
                 disabled={loading}
               >
                 {t("setup.selfhosted.switchToLocal", "Use local tools instead")}
-              </button>
+              </Button>
             </div>
           </>
         )}
@@ -565,13 +563,13 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({
           className="navigation-link-container"
           style={{ marginTop: "1.5rem" }}
         >
-          <button
-            type="button"
+          <Button
+            variant="tertiary"
             onClick={handleBack}
             className="navigation-link-button"
           >
             {t("common.back", "Back")}
-          </button>
+          </Button>
         </div>
       )}
     </>
diff --git a/frontend/editor/src/desktop/components/shared/SelfHostedOfflineBanner.tsx b/frontend/editor/src/desktop/components/shared/SelfHostedOfflineBanner.tsx
index ca75b03ec9..9f11296b56 100644
--- a/frontend/editor/src/desktop/components/shared/SelfHostedOfflineBanner.tsx
+++ b/frontend/editor/src/desktop/components/shared/SelfHostedOfflineBanner.tsx
@@ -1,14 +1,7 @@
 import { useState, useEffect, useMemo } from "react";
-import {
-  Paper,
-  Group,
-  Text,
-  ActionIcon,
-  UnstyledButton,
-  Popover,
-  List,
-  ScrollArea,
-} from "@mantine/core";
+import { Paper, Group, Text, Popover, List, ScrollArea } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
@@ -260,7 +253,8 @@ export function SelfHostedOfflineBanner() {
             width={260}
           >
             <Popover.Target>
-              <UnstyledButton
+              <Button
+                variant="tertiary"
                 onClick={() => setExpanded((e) => !e)}
                 style={{
                   color: BANNER_LINK,
@@ -279,7 +273,7 @@ export function SelfHostedOfflineBanner() {
                       "selfHosted.offline.showTools",
                       "View unavailable tools ▾",
                     )}
-              </UnstyledButton>
+              </Button>
             </Popover.Target>
             <Popover.Dropdown p="xs">
               <ScrollArea.Autosize mah={300}>
@@ -293,8 +287,8 @@ export function SelfHostedOfflineBanner() {
           </Popover>
         )}
         <ActionIcon
-          variant="subtle"
-          size="xs"
+          variant="tertiary"
+          size="sm"
           onClick={() => setDismissed(true)}
           aria-label={t("close", "Close")}
           style={{ color: BANNER_TEXT }}
diff --git a/frontend/editor/src/desktop/components/shared/config/configSections/DefaultAppSettings.tsx b/frontend/editor/src/desktop/components/shared/config/configSections/DefaultAppSettings.tsx
index f4ca397032..247fda74d3 100644
--- a/frontend/editor/src/desktop/components/shared/config/configSections/DefaultAppSettings.tsx
+++ b/frontend/editor/src/desktop/components/shared/config/configSections/DefaultAppSettings.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Paper, Text, Button, Group } from "@mantine/core";
+import { Paper, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useDefaultApp } from "@app/hooks/useDefaultApp";
 
@@ -29,8 +30,7 @@ export const DefaultAppSettings: React.FC = () => {
           </Text>
         </div>
         <Button
-          variant={isDefault ? "light" : "filled"}
-          color="blue"
+          variant={isDefault ? "secondary" : "primary"}
           size="sm"
           onClick={handleSetDefault}
           loading={isLoading}
diff --git a/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx b/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
index 259b74e523..1dc41e9497 100644
--- a/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
+++ b/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
@@ -1,5 +1,6 @@
 import { useState, useEffect } from "react";
-import { Group, Text, Button } from "@mantine/core";
+import { Group, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import {
   connectionModeService,
@@ -48,9 +49,8 @@ export function ToolPickerFooterExtensions() {
         {t("localMode.toolPicker.message", "Sign in to unlock all tools.")}
       </Text>
       <Button
-        size="compact-xs"
-        variant="light"
-        color="blue"
+        size="sm"
+        variant="secondary"
         style={{ flexShrink: 0 }}
         onClick={() =>
           window.dispatchEvent(new CustomEvent(OPEN_SIGN_IN_EVENT))
diff --git a/frontend/editor/src/desktop/routes/login/LoginHeader.tsx b/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
index d842ff6e86..fc715e6696 100644
--- a/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
+++ b/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
@@ -1,5 +1,6 @@
-import { ActionIcon } from "@mantine/core";
 import CloseIcon from "@mui/icons-material/Close";
+import { useTranslation } from "react-i18next";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useLogoAssets } from "@app/hooks/useLogoAssets";
 
 interface LoginHeaderProps {
@@ -19,6 +20,7 @@ export default function LoginHeader({
   centerOnly = false,
   onClose,
 }: LoginHeaderProps) {
+  const { t } = useTranslation();
   const { tooltipLogo } = useLogoAssets();
 
   return (
@@ -57,9 +59,8 @@ export default function LoginHeader({
         {onClose && (
           <ActionIcon
             onClick={onClose}
-            radius="md"
-            size={32}
-            variant="subtle"
+            variant="tertiary"
+            aria-label={t("common.close", "Close")}
             style={{
               flexShrink: 0,
               color: "var(--text-secondary)",
diff --git a/frontend/editor/src/portal/components/AssistantButton.tsx b/frontend/editor/src/portal/components/AssistantButton.tsx
index 7f3586c8cc..d1d264aac4 100644
--- a/frontend/editor/src/portal/components/AssistantButton.tsx
+++ b/frontend/editor/src/portal/components/AssistantButton.tsx
@@ -1,14 +1,15 @@
 import { useTranslation } from "react-i18next";
 import { useUI } from "@portal/contexts/UIContext";
 import { SparklesIcon } from "@portal/components/icons";
+import { Button } from "@app/ui/Button";
 import "@portal/components/AssistantButton.css";
 
 export function AssistantButton() {
   const { assistantOpen, toggleAssistant } = useUI();
   const { t } = useTranslation();
   return (
-    <button
-      type="button"
+    <Button
+      variant="tertiary"
       className={"portal-assistant-btn" + (assistantOpen ? " is-active" : "")}
       onClick={toggleAssistant}
       aria-label={
@@ -35,6 +36,6 @@ export function AssistantButton() {
       ) : (
         <SparklesIcon size={22} />
       )}
-    </button>
+    </Button>
   );
 }
diff --git a/frontend/editor/src/portal/components/AssistantPanel.tsx b/frontend/editor/src/portal/components/AssistantPanel.tsx
index 521f46f621..b31e6bec86 100644
--- a/frontend/editor/src/portal/components/AssistantPanel.tsx
+++ b/frontend/editor/src/portal/components/AssistantPanel.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from "react";
+import { ActionIcon, Button } from "@app/ui";
 import { useTranslation } from "react-i18next";
 import { useUI } from "@portal/contexts/UIContext";
 import { useAsync } from "@portal/hooks/useAsync";
@@ -95,14 +96,14 @@ export function AssistantPanel() {
             {t("portal.assistant.title")}
           </span>
         </div>
-        <button
-          type="button"
+        <ActionIcon
+          variant="tertiary"
           className="portal-assistant__close"
           onClick={closeAssistant}
-          aria-label={t("portal.assistant.close")}
+          aria-label={t("portal.assistant.close", "Close assistant")}
         >
           <CloseIcon size={16} />
-        </button>
+        </ActionIcon>
       </header>
 
       <div className="portal-assistant__messages" ref={messagesRef}>
@@ -113,15 +114,16 @@ export function AssistantPanel() {
             </div>
             <div className="portal-assistant__suggestions-list">
               {suggestions.map((s) => (
-                <button
+                <Button
                   key={s}
-                  type="button"
+                  variant="secondary"
+                  size="sm"
                   className="portal-assistant__suggestion"
                   onClick={() => send(s)}
                   disabled={typing}
                 >
                   {s}
-                </button>
+                </Button>
               ))}
             </div>
           </div>
@@ -166,14 +168,14 @@ export function AssistantPanel() {
           className="portal-assistant__input"
           disabled={typing}
         />
-        <button
+        <ActionIcon
           type="submit"
           className="portal-assistant__send"
           disabled={!input.trim() || typing}
           aria-label={t("portal.assistant.send")}
         >
           <SendIcon size={14} />
-        </button>
+        </ActionIcon>
       </form>
     </aside>
   );
diff --git a/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx b/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
index db9b006173..b6124bbd25 100644
--- a/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
+++ b/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
@@ -1,5 +1,6 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { useRef, useState } from "react";
+import { Button } from "@app/ui/Button";
 import { ChatFABButton } from "@app/ui/ChatFABButton";
 import { ChatFABWindow } from "@app/ui/ChatFABWindow";
 
@@ -59,21 +60,15 @@ function MockChatContent({
         }}
       >
         <span style={{ fontWeight: 600 }}>Stirling</span>
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
+          shape="circle"
           onClick={onClose}
           aria-label="Close chat"
-          style={{
-            background: "none",
-            border: "none",
-            cursor: "pointer",
-            padding: 4,
-            borderRadius: 6,
-            color: "var(--color-text-4, #64748b)",
-          }}
+          style={{ color: "var(--color-text-4, #64748b)" }}
         >
           ✕
-        </button>
+        </Button>
       </div>
 
       {/* Messages */}
@@ -158,8 +153,10 @@ function ChatFABWidgetDemo({
       }}
     >
       {/* FAB button */}
-      <button
-        type="button"
+      <ChatFABButton
+        loading={agentLoading}
+        showTick={hasUnviewedResult && !agentLoading}
+        tabIndex={open ? -1 : 0}
         onClick={() => {
           setOpen(true);
           setHasUnviewedResult(false);
@@ -171,22 +168,13 @@ function ChatFABWidgetDemo({
           right: 16,
           bottom: 16,
           padding: 0,
-          border: "none",
-          background: "none",
-          cursor: "pointer",
           opacity: open ? 0 : 1,
           transform: open ? "scale(0.78)" : "scale(1)",
           transition:
             "opacity 160ms ease, transform 180ms cubic-bezier(0.32, 0.72, 0, 1)",
           pointerEvents: open ? "none" : "auto",
         }}
-      >
-        <ChatFABButton
-          isLoading={agentLoading}
-          showTick={hasUnviewedResult && !agentLoading}
-          tabIndex={open ? -1 : 0}
-        />
-      </button>
+      />
 
       {/* Chat panel */}
       <div
@@ -272,29 +260,21 @@ function ChatFABFullFlowDemo() {
             {s === "open" && "④ Viewed — tick cleared"}
           </div>
         ))}
-        <button
-          type="button"
+        <Button
+          accent="success"
+          size="sm"
           onClick={simulateAgentRun}
           disabled={isLoading || open}
-          style={{
-            marginTop: 4,
-            padding: "6px 12px",
-            borderRadius: 6,
-            border: "none",
-            background: "#22c55e",
-            color: "#fff",
-            cursor: isLoading || open ? "not-allowed" : "pointer",
-            opacity: isLoading || open ? 0.5 : 1,
-            fontSize: 13,
-          }}
+          style={{ marginTop: 4 }}
         >
           Simulate agent run
-        </button>
+        </Button>
       </div>
 
       {/* FAB button */}
-      <button
-        type="button"
+      <ChatFABButton
+        loading={isLoading}
+        showTick={hasUnviewedResult && !isLoading}
         onClick={handleOpen}
         aria-label="Open Stirling AI assistant"
         style={{
@@ -302,21 +282,13 @@ function ChatFABFullFlowDemo() {
           right: 16,
           bottom: 16,
           padding: 0,
-          border: "none",
-          background: "none",
-          cursor: "pointer",
           opacity: open ? 0 : 1,
           transform: open ? "scale(0.78)" : "scale(1)",
           transition:
             "opacity 160ms ease, transform 180ms cubic-bezier(0.32, 0.72, 0, 1)",
           pointerEvents: open ? "none" : "auto",
         }}
-      >
-        <ChatFABButton
-          isLoading={isLoading}
-          showTick={hasUnviewedResult && !isLoading}
-        />
-      </button>
+      />
 
       {/* Chat panel */}
       <div
diff --git a/frontend/editor/src/portal/components/ErrorBoundary.test.tsx b/frontend/editor/src/portal/components/ErrorBoundary.test.tsx
index 4e84344e77..dc815c0d8f 100644
--- a/frontend/editor/src/portal/components/ErrorBoundary.test.tsx
+++ b/frontend/editor/src/portal/components/ErrorBoundary.test.tsx
@@ -1,8 +1,18 @@
 import { useState } from "react";
 import { describe, expect, it, vi } from "vitest";
-import { fireEvent, render, screen } from "@testing-library/react";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
 import { ErrorBoundary } from "@portal/components/ErrorBoundary";
 
+const render = (
+  ui: Parameters<typeof baseRender>[0],
+  options?: Parameters<typeof baseRender>[1],
+) => baseRender(ui, { wrapper: MantineProvider, ...options });
+
 // Deterministic i18n: return the key so assertions don't depend on the async
 // TOML backend ever loading. Mirrors the editor's test setup convention.
 vi.mock("react-i18next", () => ({
diff --git a/frontend/editor/src/portal/components/Header.tsx b/frontend/editor/src/portal/components/Header.tsx
index 7194094171..6ba062e577 100644
--- a/frontend/editor/src/portal/components/Header.tsx
+++ b/frontend/editor/src/portal/components/Header.tsx
@@ -1,5 +1,5 @@
 import { useTranslation } from "react-i18next";
-import { Avatar, Dropdown } from "@app/ui";
+import { ActionIcon, Avatar, Button, Dropdown } from "@app/ui";
 import { useAuth } from "@app/auth";
 import { useTheme } from "@portal/contexts/ThemeContext";
 import { useTier, TIER_INFO, type Tier } from "@portal/contexts/TierContext";
@@ -19,8 +19,9 @@ function ThemeToggle() {
   const { theme, toggle } = useTheme();
   const { t } = useTranslation();
   return (
-    <button
+    <ActionIcon
       type="button"
+      variant="quiet"
       className="portal-header__icon-btn"
       onClick={toggle}
       aria-label={
@@ -35,7 +36,7 @@ function ThemeToggle() {
       }
     >
       {theme === "light" ? <MoonIcon size={16} /> : <SunIcon size={16} />}
-    </button>
+    </ActionIcon>
   );
 }
 
@@ -49,7 +50,11 @@ function TierSwitcher() {
   return (
     <Dropdown.Root align="end">
       <Dropdown.Trigger>
-        <button type="button" className="portal-header__tier-btn">
+        <Button
+          type="button"
+          variant="quiet"
+          className="portal-header__tier-btn"
+        >
           <span
             className="portal-header__tier-dot"
             style={{ background: info.dotColor }}
@@ -57,7 +62,7 @@ function TierSwitcher() {
           />
           <span className="portal-header__tier-label">{info.label}</span>
           <ChevronDownIcon size={14} />
-        </button>
+        </Button>
       </Dropdown.Trigger>
       <Dropdown.Menu width="12rem">
         {(Object.keys(TIER_INFO) as Tier[]).map((id) => (
@@ -89,14 +94,15 @@ function UserMenu() {
   return (
     <Dropdown.Root align="end">
       <Dropdown.Trigger>
-        <button
+        <ActionIcon
           type="button"
+          variant="quiet"
           className="portal-header__user"
           aria-label={t("portal.shell.header.accountMenu", "Account menu")}
           title={name}
         >
           <Avatar name={name} size="md" tone="blue" />
-        </button>
+        </ActionIcon>
       </Dropdown.Trigger>
       <Dropdown.Menu width="12rem">
         <Dropdown.Item disabled>{name}</Dropdown.Item>
@@ -120,8 +126,9 @@ export function Header() {
         </span>
       </div>
 
-      <button
+      <Button
         type="button"
+        variant="quiet"
         className="portal-header__search"
         aria-label={t("portal.shell.header.search")}
         onClick={openSearch}
@@ -133,7 +140,7 @@ export function Header() {
         <span className="portal-header__search-kbd" aria-hidden>
           ⌘K
         </span>
-      </button>
+      </Button>
 
       <div className="portal-header__right">
         <MocksToggle />
diff --git a/frontend/editor/src/portal/components/MocksToggle.tsx b/frontend/editor/src/portal/components/MocksToggle.tsx
index 83fce02c21..a0a12d062e 100644
--- a/frontend/editor/src/portal/components/MocksToggle.tsx
+++ b/frontend/editor/src/portal/components/MocksToggle.tsx
@@ -6,6 +6,7 @@ import {
   writeMocksPreference,
 } from "@portal/mocks/preference";
 import "@portal/components/MocksToggle.css";
+import { Button } from "@app/ui/Button";
 
 /**
  * Dev-only header chip that flips MSW interception on and off. Persists the
@@ -32,8 +33,8 @@ export function MocksToggle() {
   }
 
   return (
-    <button
-      type="button"
+    <Button
+      variant="tertiary"
       className={
         "portal-mocks-toggle" +
         (enabled ? " is-on" : " is-off") +
@@ -49,6 +50,6 @@ export function MocksToggle() {
       <span className="portal-mocks-toggle__label">
         {enabled ? t("portal.mocks.label.on") : t("portal.mocks.label.off")}
       </span>
-    </button>
+    </Button>
   );
 }
diff --git a/frontend/editor/src/portal/components/NotificationsDropdown.tsx b/frontend/editor/src/portal/components/NotificationsDropdown.tsx
index 4a0d84d5c3..1401837e53 100644
--- a/frontend/editor/src/portal/components/NotificationsDropdown.tsx
+++ b/frontend/editor/src/portal/components/NotificationsDropdown.tsx
@@ -1,6 +1,6 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Dropdown, EmptyState, Skeleton } from "@app/ui";
+import { ActionIcon, Button, Dropdown, EmptyState, Skeleton } from "@app/ui";
 import { BellIcon } from "@portal/components/icons";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import {
@@ -45,8 +45,9 @@ export function NotificationsDropdown() {
   return (
     <Dropdown.Root align="end">
       <Dropdown.Trigger>
-        <button
+        <ActionIcon
           type="button"
+          variant="quiet"
           className="portal-header__icon-btn portal-header__icon-btn--badge"
           aria-label={
             hasUnread
@@ -60,7 +61,7 @@ export function NotificationsDropdown() {
           {hasUnread && (
             <span className="portal-header__bell-dot" aria-hidden />
           )}
-        </button>
+        </ActionIcon>
       </Dropdown.Trigger>
       <Dropdown.Menu width="22.5rem" className="portal-notif__menu">
         <div className="portal-notif__header">
@@ -115,17 +116,22 @@ export function NotificationsDropdown() {
           </ul>
         )}
         <div className="portal-notif__footer">
-          <button
+          <Button
             type="button"
+            variant="quiet"
             className="portal-notif__action"
             onClick={onMarkAllRead}
             disabled={!hasUnread}
           >
             {t("portal.notifications.markAllRead")}
-          </button>
-          <button type="button" className="portal-notif__action">
+          </Button>
+          <Button
+            type="button"
+            variant="quiet"
+            className="portal-notif__action"
+          >
             {t("portal.notifications.viewAll")}
-          </button>
+          </Button>
         </div>
       </Dropdown.Menu>
     </Dropdown.Root>
diff --git a/frontend/editor/src/portal/components/PipelineForkWizard.tsx b/frontend/editor/src/portal/components/PipelineForkWizard.tsx
index 838afda3db..3a27b5984a 100644
--- a/frontend/editor/src/portal/components/PipelineForkWizard.tsx
+++ b/frontend/editor/src/portal/components/PipelineForkWizard.tsx
@@ -85,9 +85,9 @@ export function PipelineForkWizard() {
       {phase === "pick" && (
         <div className="portal-fork__templates">
           {PIPELINE_TEMPLATES.map((t) => (
-            <button
+            <Button
               key={t.id}
-              type="button"
+              variant="tertiary"
               className="portal-fork__template"
               data-accent={t.accent}
               onClick={() => fork(t)}
@@ -96,12 +96,12 @@ export function PipelineForkWizard() {
               <span className="portal-fork__template-blurb">{t.blurb}</span>
               <span className="portal-fork__template-types">
                 {t.docTypes.map((d) => (
-                  <Chip key={d} size="sm" tone="neutral">
+                  <Chip key={d} size="sm">
                     {d}
                   </Chip>
                 ))}
               </span>
-            </button>
+            </Button>
           ))}
         </div>
       )}
@@ -139,17 +139,16 @@ export function PipelineForkWizard() {
           </ol>
 
           <div className="portal-fork__build-actions">
-            <Button variant="ghost" size="sm" onClick={reset}>
+            <Button variant="tertiary" size="sm" onClick={reset}>
               {phase === "ready"
                 ? t("portal.forkWizard.action.pickAnother")
                 : t("portal.forkWizard.action.cancel")}
             </Button>
             <Button
-              variant="gradient"
               size="sm"
               onClick={deploy}
               disabled={phase !== "ready"}
-              trailingIcon={<span aria-hidden>→</span>}
+              rightSection={<span aria-hidden>→</span>}
             >
               {phase === "ready"
                 ? t("portal.forkWizard.action.deploy")
diff --git a/frontend/editor/src/portal/components/PolicySummary.tsx b/frontend/editor/src/portal/components/PolicySummary.tsx
index 084e7e5b69..29d93cda3c 100644
--- a/frontend/editor/src/portal/components/PolicySummary.tsx
+++ b/frontend/editor/src/portal/components/PolicySummary.tsx
@@ -105,7 +105,7 @@ export function PolicySummary() {
       render: ({ state }) => {
         if (state === "locked") {
           return (
-            <Button size="sm" variant="ghost" onClick={goToPolicies}>
+            <Button size="sm" variant="tertiary" onClick={goToPolicies}>
               {t("portal.policySummary.action.comingSoon")}
             </Button>
           );
@@ -113,7 +113,7 @@ export function PolicySummary() {
         return (
           <Button
             size="sm"
-            variant={state === "active" ? "ghost" : "outline"}
+            variant={state === "active" ? "tertiary" : "secondary"}
             onClick={goToPolicies}
           >
             {state === "active"
diff --git a/frontend/editor/src/portal/components/PopularUseCases.tsx b/frontend/editor/src/portal/components/PopularUseCases.tsx
index b85912761f..85ccc90c72 100644
--- a/frontend/editor/src/portal/components/PopularUseCases.tsx
+++ b/frontend/editor/src/portal/components/PopularUseCases.tsx
@@ -1,5 +1,5 @@
 import { useTranslation } from "react-i18next";
-import { Card, type CardProps } from "@app/ui";
+import { Button, Card, type CardProps } from "@app/ui";
 import { useView } from "@portal/contexts/ViewContext";
 import "@portal/components/PopularUseCases.css";
 
@@ -11,12 +11,12 @@ interface UseCase {
   accent: Accent;
 }
 
-const ACCENT_COLOR: Record<Accent, string> = {
-  blue: "var(--color-blue)",
-  purple: "var(--color-purple)",
-  green: "var(--color-green)",
-  amber: "var(--color-amber)",
-  red: "var(--color-red)",
+const ACCENT_COLOR: Partial<Record<Accent, string>> = {
+  default: "var(--color-blue)",
+  premium: "var(--color-purple)",
+  success: "var(--color-green)",
+  warning: "var(--color-amber)",
+  danger: "var(--color-red)",
 };
 
 /**
@@ -26,10 +26,10 @@ const ACCENT_COLOR: Record<Accent, string> = {
  * copy (eyebrow, title, blurb, cta) is keyed into useCases.items.<key>.
  */
 const USE_CASES: UseCase[] = [
-  { key: "autoRouting", accent: "blue" },
-  { key: "piiRedaction", accent: "red" },
-  { key: "trainingData", accent: "purple" },
-  { key: "authenticity", accent: "green" },
+  { key: "autoRouting", accent: "default" },
+  { key: "piiRedaction", accent: "danger" },
+  { key: "trainingData", accent: "premium" },
+  { key: "authenticity", accent: "success" },
 ];
 
 export function PopularUseCases() {
@@ -42,13 +42,14 @@ export function PopularUseCases() {
     >
       <header className="portal-usecases__head">
         <h2 className="portal-usecases__title">{t("portal.useCases.title")}</h2>
-        <button
+        <Button
+          variant="quiet"
           type="button"
           className="portal-usecases__viewall"
           onClick={() => setActiveView("pipelines")}
         >
           {t("portal.useCases.viewAll")} <span aria-hidden>→</span>
-        </button>
+        </Button>
       </header>
       <div className="portal-usecases__grid">
         {USE_CASES.map((uc) => (
@@ -70,7 +71,8 @@ export function PopularUseCases() {
             <p className="portal-usecases__blurb">
               {t(`portal.useCases.items.${uc.key}.blurb`)}
             </p>
-            <button
+            <Button
+              variant="quiet"
               type="button"
               className="portal-usecases__cta"
               style={{ color: ACCENT_COLOR[uc.accent] }}
@@ -78,7 +80,7 @@ export function PopularUseCases() {
             >
               {t(`portal.useCases.items.${uc.key}.cta`)}{" "}
               <span aria-hidden>→</span>
-            </button>
+            </Button>
           </Card>
         ))}
       </div>
diff --git a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx b/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
index 9aa3025f98..1ef41f5e0f 100644
--- a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
+++ b/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
@@ -57,7 +57,7 @@ export function ProcessingStatusStrip() {
           nearCap ? (
             <Button
               size="sm"
-              variant="outline"
+              variant="secondary"
               onClick={() => setActiveView("usage")}
             >
               {t("portal.processingStatus.upgrade")}
@@ -104,7 +104,7 @@ export function ProcessingStatusStrip() {
       </span>
       <Button
         size="sm"
-        variant="ghost"
+        variant="tertiary"
         className="portal-statusstrip__manage"
         onClick={() => setActiveView("usage")}
       >
diff --git a/frontend/editor/src/portal/components/RecentActivity.tsx b/frontend/editor/src/portal/components/RecentActivity.tsx
index 8934a5f0bd..11d27a9770 100644
--- a/frontend/editor/src/portal/components/RecentActivity.tsx
+++ b/frontend/editor/src/portal/components/RecentActivity.tsx
@@ -1,5 +1,5 @@
 import { useTranslation } from "react-i18next";
-import { Card, EmptyState, Skeleton, StatusBadge } from "@app/ui";
+import { Button, Card, EmptyState, Skeleton, StatusBadge } from "@app/ui";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import {
   fetchRecentActivity,
@@ -33,9 +33,9 @@ export function RecentActivity() {
         <h2 className="portal-activity__title">
           {t("portal.recentActivity.title")}
         </h2>
-        <button type="button" className="portal-activity__more">
+        <Button variant="quiet" type="button" className="portal-activity__more">
           {t("portal.recentActivity.viewAll")} →
-        </button>
+        </Button>
       </header>
 
       {isLoading && (
diff --git a/frontend/editor/src/portal/components/SearchModal.tsx b/frontend/editor/src/portal/components/SearchModal.tsx
index ca66f9365e..6aac7e99d4 100644
--- a/frontend/editor/src/portal/components/SearchModal.tsx
+++ b/frontend/editor/src/portal/components/SearchModal.tsx
@@ -1,6 +1,6 @@
 import { useEffect, useMemo, useRef, useState } from "react";
+import { Button, EmptyState, Modal, Skeleton } from "@app/ui";
 import { useTranslation } from "react-i18next";
-import { EmptyState, Modal, Skeleton } from "@app/ui";
 import { useUI } from "@portal/contexts/UIContext";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import { fetchQuickActions, type QuickAction } from "@portal/api/search";
@@ -100,9 +100,11 @@ export function SearchModal() {
               <div key={group} className="portal-search__group">
                 <div className="portal-search__group-label">{group}</div>
                 {items.map((item) => (
-                  <button
+                  <Button
                     key={item.label}
-                    type="button"
+                    variant="tertiary"
+                    justify="start"
+                    fullWidth
                     className="portal-search__item"
                     onClick={closeSearch}
                   >
@@ -112,7 +114,7 @@ export function SearchModal() {
                     <span className="portal-search__item-hint">
                       {item.hint}
                     </span>
-                  </button>
+                  </Button>
                 ))}
               </div>
             ))}
diff --git a/frontend/editor/src/portal/components/SettingsModal.tsx b/frontend/editor/src/portal/components/SettingsModal.tsx
index c6a40f3389..3073d243f0 100644
--- a/frontend/editor/src/portal/components/SettingsModal.tsx
+++ b/frontend/editor/src/portal/components/SettingsModal.tsx
@@ -260,10 +260,10 @@ export function SettingsModal({
             <span className="portal-settings__footer-note">
               {t("portal.settings.footerNote")}
             </span>
-            <Button variant="ghost" onClick={onClose}>
+            <Button variant="tertiary" onClick={onClose}>
               {t("portal.settings.cancel")}
             </Button>
-            <Button variant="gradient" onClick={onClose}>
+            <Button variant="primary" accent="premium" onClick={onClose}>
               {t("portal.settings.saveChanges")}
             </Button>
           </>
@@ -401,7 +401,7 @@ function ProfilePanel({
           </div>
           <span className="portal-settings__identity-email">{email}</span>
         </div>
-        <Button variant="outline" size="sm" disabled>
+        <Button variant="secondary" size="sm" disabled>
           {t("portal.settings.profile.changePhoto")}
         </Button>
       </div>
@@ -458,9 +458,10 @@ function AppearancePanel({
           aria-label={t("portal.settings.appearance.themeTitle")}
         >
           {THEME_OPTIONS.map((opt) => (
-            <button
+            <Button
               key={opt.value}
               type="button"
+              variant="quiet"
               role="radio"
               aria-checked={theme === opt.value}
               className={
@@ -482,7 +483,7 @@ function AppearancePanel({
                 </strong>
                 <span>{t(`portal.settings.appearance.${opt.value}.hint`)}</span>
               </span>
-            </button>
+            </Button>
           ))}
         </div>
       </div>
@@ -639,7 +640,7 @@ function WorkspacePanel({
             </span>
           </div>
         )}
-        <Button variant="outline" size="sm" disabled>
+        <Button variant="secondary" size="sm" disabled>
           {t("portal.settings.workspace.manageBilling")}
         </Button>
       </div>
@@ -811,7 +812,7 @@ function SessionsPanel({
                 </StatusBadge>
               ) : (
                 // TODO(backend): DELETE /v1/settings/sessions/{id}
-                <Button variant="ghost" size="sm">
+                <Button variant="tertiary" size="sm">
                   {t("portal.settings.sessions.revoke")}
                 </Button>
               )}
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 0deb3c0dda..675e48561f 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -1,5 +1,5 @@
+import { Button, Dropdown, NavItem } from "@app/ui";
 import { useTranslation } from "react-i18next";
-import { Dropdown, NavItem } from "@app/ui";
 import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { useTier } from "@portal/contexts/TierContext";
 import { useTheme } from "@portal/contexts/ThemeContext";
@@ -172,13 +172,13 @@ export function Sidebar() {
 
         <Dropdown.Root align="end" className="portal-sidebar__app-switch">
           <Dropdown.Trigger>
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               className="portal-sidebar__app-switch-btn"
               aria-label={t("portal.shell.sidebar.switchApp")}
             >
               <ChevronDownIcon size={14} />
-            </button>
+            </Button>
           </Dropdown.Trigger>
           <Dropdown.Menu width="11rem">
             <Dropdown.Item
diff --git a/frontend/editor/src/portal/components/SingleOpRunner.tsx b/frontend/editor/src/portal/components/SingleOpRunner.tsx
index 2ac89450ec..3abb9f9850 100644
--- a/frontend/editor/src/portal/components/SingleOpRunner.tsx
+++ b/frontend/editor/src/portal/components/SingleOpRunner.tsx
@@ -161,28 +161,28 @@ export function SingleOpRunner({
               </StatusBadge>
             )}
           </div>
-          <Button variant="ghost" onClick={onClose}>
+          <Button variant="tertiary" onClick={onClose}>
             {t("portal.opRunner.action.close")}
           </Button>
           {phase === "done" ? (
             <>
-              <Button variant="outline" onClick={reset}>
+              <Button variant="secondary" onClick={reset}>
                 {t("portal.opRunner.action.runAgain")}
               </Button>
               <Button
-                variant="gradient"
+                accent="premium"
                 onClick={buildPipelineWithOp}
-                trailingIcon={<span aria-hidden>→</span>}
+                rightSection={<span aria-hidden>→</span>}
               >
                 {t("portal.opRunner.action.openBuilder")}
               </Button>
             </>
           ) : (
             <Button
-              variant="gradient"
+              accent="premium"
               onClick={run}
               disabled={phase === "running" || !selectedOp}
-              trailingIcon={<span aria-hidden>→</span>}
+              rightSection={<span aria-hidden>→</span>}
             >
               {phase === "running"
                 ? t("portal.opRunner.action.running")
@@ -233,15 +233,16 @@ export function SingleOpRunner({
                 </>
               )}
             </div>
-            <button
+            <Button
               type="button"
+              variant="quiet"
               className="portal-runner__sample-btn"
               onClick={pickSample}
             >
               {sample
                 ? t("portal.opRunner.drop.pickAnother")
                 : t("portal.opRunner.drop.useSample")}
-            </button>
+            </Button>
           </div>
 
           <div>
@@ -269,9 +270,10 @@ export function SingleOpRunner({
                 />
               )}
               {ops?.map((op) => (
-                <button
+                <Button
                   key={op.id}
                   type="button"
+                  variant="quiet"
                   className={
                     "portal-runner__op" +
                     (selectedOpId === op.id ? " is-selected" : "")
@@ -290,7 +292,7 @@ export function SingleOpRunner({
                     {op.endpoint}
                   </span>
                   <span className="portal-runner__op-blurb">{op.blurb}</span>
-                </button>
+                </Button>
               ))}
             </div>
           </div>
diff --git a/frontend/editor/src/portal/components/WelcomeCarousel.tsx b/frontend/editor/src/portal/components/WelcomeCarousel.tsx
index d0b01708e6..42af5a6abb 100644
--- a/frontend/editor/src/portal/components/WelcomeCarousel.tsx
+++ b/frontend/editor/src/portal/components/WelcomeCarousel.tsx
@@ -185,14 +185,13 @@ export function WelcomeCarousel({ onTryOp }: WelcomeCarouselProps) {
           </p>
           <div className="portal-carousel__cta">
             <Button
-              variant="gradient"
               onClick={() => runAction(slide.primary)}
-              trailingIcon={<span aria-hidden>→</span>}
+              rightSection={<span aria-hidden>→</span>}
             >
               {t(slide.primary.labelKey)}
             </Button>
             <Button
-              variant="outline"
+              variant="secondary"
               onClick={() => runAction(slide.secondary)}
             >
               {t(slide.secondary.labelKey)}
@@ -213,9 +212,9 @@ export function WelcomeCarousel({ onTryOp }: WelcomeCarouselProps) {
         aria-label={t("portal.welcome.pagination")}
       >
         {SLIDES.map((s, i) => (
-          <button
+          <Button
             key={s.id}
-            type="button"
+            variant="tertiary"
             aria-current={i === index ? "true" : undefined}
             aria-label={t("portal.welcome.slideLabel", {
               number: i + 1,
diff --git a/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx b/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
index 1bf8a65bf2..fa79ed2c72 100644
--- a/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
@@ -83,8 +83,8 @@ export function LinkAccountCard({ link }: Props) {
             )}
           </span>
           <Button
-            variant="outline"
-            accent="red"
+            variant="secondary"
+            accent="danger"
             loading={linking}
             onClick={link.unlink}
           >
diff --git a/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx b/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
index 2b07e12b3a..3f8da872c8 100644
--- a/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
@@ -106,7 +106,7 @@ export function LinkAccountModal({
           </Banner>
           {import.meta.env.DEV && (
             <Button
-              variant="outline"
+              variant="secondary"
               onClick={async () => {
                 await onLinked({ access_token: "dev-stub-jwt" });
                 onClose();
diff --git a/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx b/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
index f6839596d3..63defa92ac 100644
--- a/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
@@ -98,8 +98,8 @@ export function LinkedInstancesTable({
       render: (i) =>
         i.revoked ? null : (
           <Button
-            variant="outline"
-            accent="red"
+            variant="secondary"
+            accent="danger"
             size="sm"
             loading={revokingId === i.instanceId}
             onClick={() => onRevoke(i)}
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx b/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
index f6734721b8..9891c10d03 100644
--- a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
@@ -1,6 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
-import { StatusBadge } from "@app/ui";
+import { Button, StatusBadge } from "@app/ui";
 import "@portal/views/AgentBuilder.css";
 
 interface AgentSelectorProps {
@@ -22,9 +22,11 @@ export function AgentSelector({
       aria-label={t("portal.agentBuilder.selectorAriaLabel")}
     >
       {agents.map((a) => (
-        <button
+        <Button
           key={a.id}
-          type="button"
+          variant="tertiary"
+          justify="start"
+          fullWidth
           className={
             "portal-agents__selector-item" +
             (a.id === selectedId ? " is-selected" : "")
@@ -42,7 +44,7 @@ export function AgentSelector({
             </StatusBadge>
             <code className="portal-agents__selector-version">{a.version}</code>
           </span>
-        </button>
+        </Button>
       ))}
     </nav>
   );
diff --git a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx b/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
index 24bf1205f7..a6b28688e6 100644
--- a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
@@ -37,7 +37,7 @@ export function BootstrapDialog({ open, onClose }: BootstrapDialogProps) {
       subtitle={t("portal.agentBuilder.bootstrap.subtitle")}
       footer={
         <div className="portal-agents__dialog-footer">
-          <Button variant="ghost" size="sm" onClick={close}>
+          <Button variant="tertiary" size="sm" onClick={close}>
             {t("portal.agentBuilder.bootstrap.cancel")}
           </Button>
           <Button size="sm" onClick={bootstrap} disabled={!fileName}>
diff --git a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
index 3f1580652f..4654f10635 100644
--- a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
@@ -86,7 +86,7 @@ export function EvalsPanel({ agent }: EvalsPanelProps) {
             value={`${agent.evalsPassing} / ${agent.evalsTotal}`}
           />
         </div>
-        <Button size="sm" variant="outline" onClick={runEvals}>
+        <Button size="sm" variant="secondary" onClick={runEvals}>
           {t("portal.agentBuilder.evals.runEvals")}
         </Button>
       </div>
diff --git a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx b/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
index f4057ea2b6..d3a2822838 100644
--- a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
@@ -68,7 +68,7 @@ export function ScenariosPanel({ agent }: ScenariosPanelProps) {
             </div>
             <Button
               size="sm"
-              variant="ghost"
+              variant="tertiary"
               onClick={() => toggleEnabled(s.id)}
             >
               {s.enabled
@@ -80,7 +80,7 @@ export function ScenariosPanel({ agent }: ScenariosPanelProps) {
       </ul>
 
       <div className="portal-agents__scenario-add">
-        <Chip tone="blue" size="sm">
+        <Chip accent="default" size="sm">
           {t("portal.agentBuilder.scenarios.addScenario")}
         </Chip>
         <div className="portal-agents__scenario-form">
diff --git a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
index 4dde8ff54d..6c0d3030ac 100644
--- a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
@@ -47,7 +47,7 @@ export function ToolsPanel({ agent, governanceUnlocked }: ToolsPanelProps) {
               : t("portal.agentBuilder.tools.governanceGate")
           }
         />
-        <Chip tone={restricted ? "amber" : "green"} size="sm">
+        <Chip accent={restricted ? "warning" : "success"} size="sm">
           {restricted
             ? t("portal.agentBuilder.tools.restricted")
             : t("portal.agentBuilder.tools.broadAccess")}
@@ -68,7 +68,7 @@ export function ToolsPanel({ agent, governanceUnlocked }: ToolsPanelProps) {
               return (
                 <Chip
                   key={tool}
-                  tone={isDenied ? "red" : "neutral"}
+                  accent={isDenied ? "danger" : "neutral"}
                   size="sm"
                   onClick={
                     governanceUnlocked ? () => toggleDenied(tool) : undefined
diff --git a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
index 88edc7993c..20d71dbfbc 100644
--- a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
@@ -69,7 +69,7 @@ export function VersionsPanel({ agent, historyUnlocked }: VersionsPanelProps) {
                 {v.status === "draft" && (
                   <Button
                     size="sm"
-                    variant="outline"
+                    variant="secondary"
                     onClick={() => publish(v.version)}
                   >
                     {t("portal.agentBuilder.versions.publish")}
@@ -78,7 +78,7 @@ export function VersionsPanel({ agent, historyUnlocked }: VersionsPanelProps) {
                 {v.status === "published" && !isCurrent && (
                   <Button
                     size="sm"
-                    variant="ghost"
+                    variant="tertiary"
                     onClick={() => rollback(v.version)}
                   >
                     {t("portal.agentBuilder.versions.rollBack")}
diff --git a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
index 6525e66970..f27f62097e 100644
--- a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
+++ b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
@@ -35,11 +35,7 @@ export function EnterpriseUpsell({ bare = false }: Props) {
             )}
           </p>
         </div>
-        <Button
-          variant="gradient"
-          size="sm"
-          onClick={() => setActiveView("procurement")}
-        >
+        <Button size="sm" onClick={() => setActiveView("procurement")}>
           {t(
             "portal.billing.enterpriseUpsell.cta",
             "Build your Enterprise quote",
diff --git a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
index 77cbdbad5b..d06dfd23a6 100644
--- a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
@@ -72,9 +72,9 @@ export function FreePdfEditorsCard() {
         </MetricStrip>
         {/* Opens the Users tab with its invite-member modal (via the ?invite param). */}
         <Button
-          variant="outline"
+          variant="secondary"
           size="sm"
-          leadingIcon={<PersonAddIcon sx={{ fontSize: 16 }} />}
+          leftSection={<PersonAddIcon sx={{ fontSize: 16 }} />}
           onClick={() => navigate("/users?invite=1")}
         >
           {t("portal.billing.freeEditors.inviteTeammates", "Invite teammates")}
diff --git a/frontend/editor/src/portal/components/billing/FreePlanView.tsx b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
index 7132e6dfa1..0192d5761e 100644
--- a/frontend/editor/src/portal/components/billing/FreePlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
@@ -56,7 +56,8 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
 
   const switchOnAction = isLeader ? (
     <Button
-      variant="gradient"
+      variant="primary"
+      accent="premium"
       onClick={openCheckout}
       disabled={wallet.teamId == null}
     >
diff --git a/frontend/editor/src/portal/components/billing/InvoicesList.tsx b/frontend/editor/src/portal/components/billing/InvoicesList.tsx
index 1a9f015f5e..8e4c8a8540 100644
--- a/frontend/editor/src/portal/components/billing/InvoicesList.tsx
+++ b/frontend/editor/src/portal/components/billing/InvoicesList.tsx
@@ -218,7 +218,7 @@ export function InvoicesList() {
           {hasMore && (
             <div className="portal-billing__invoice-footer">
               <Button
-                variant="ghost"
+                variant="tertiary"
                 size="sm"
                 onClick={() => setShowAll((v) => !v)}
               >
diff --git a/frontend/editor/src/portal/components/billing/LinkAccountPrompt.tsx b/frontend/editor/src/portal/components/billing/LinkAccountPrompt.tsx
index 522fcc17c3..e21fec3591 100644
--- a/frontend/editor/src/portal/components/billing/LinkAccountPrompt.tsx
+++ b/frontend/editor/src/portal/components/billing/LinkAccountPrompt.tsx
@@ -23,7 +23,11 @@ export function LinkAccountPrompt() {
           "Manual PDF editing — view, sign, merge, split, watermark, compress, convert, manual OCR — is always free, linked or not. Link to claim 500 free PDFs of metered processing (automation, AI, and the API); when you need more, turn on the Processor plan and only pay for what you use.",
         )}
         actions={
-          <Button variant="gradient" onClick={() => openLinkModal()}>
+          <Button
+            variant="primary"
+            accent="premium"
+            onClick={() => openLinkModal()}
+          >
             {t("portal.billing.linkPrompt.cta", "Link Stirling account")}
           </Button>
         }
diff --git a/frontend/editor/src/portal/components/billing/PaymentMethodCard.tsx b/frontend/editor/src/portal/components/billing/PaymentMethodCard.tsx
index cd3b094a5e..4904e8364b 100644
--- a/frontend/editor/src/portal/components/billing/PaymentMethodCard.tsx
+++ b/frontend/editor/src/portal/components/billing/PaymentMethodCard.tsx
@@ -96,7 +96,7 @@ export function PaymentMethodCard({ onManage, managing }: Props) {
           )}
         </div>
         <Button
-          variant="outline"
+          variant="secondary"
           size="sm"
           loading={managing}
           onClick={onManage}
diff --git a/frontend/editor/src/portal/components/billing/SpendLimitCard.tsx b/frontend/editor/src/portal/components/billing/SpendLimitCard.tsx
index d117f3d9bc..9ee2fa1f5e 100644
--- a/frontend/editor/src/portal/components/billing/SpendLimitCard.tsx
+++ b/frontend/editor/src/portal/components/billing/SpendLimitCard.tsx
@@ -145,7 +145,8 @@ export function SpendLimitCard({
         />
 
         {proj && draftCap !== proj.suggestedMajor && (
-          <button
+          <Button
+            variant="quiet"
             type="button"
             className="portal-billing__suggested"
             onClick={() => setDraftCap(proj.suggestedMajor)}
@@ -157,7 +158,7 @@ export function SpendLimitCard({
                 amount: formatMoneyMajor(proj.suggestedMajor, wallet.currency),
               },
             )}
-          </button>
+          </Button>
         )}
 
         <div className="portal-billing__guardrail">
@@ -184,13 +185,13 @@ export function SpendLimitCard({
 
         <div className="portal-billing__edit-actions">
           <Button
-            variant="outline"
+            variant="secondary"
             size="sm"
             onClick={() => onAdjustingChange(false)}
           >
             {t("portal.billing.spendLimit.cancel", "Cancel")}
           </Button>
-          <Button variant="gradient" size="sm" loading={saving} onClick={save}>
+          <Button accent="premium" size="sm" loading={saving} onClick={save}>
             {t("portal.billing.spendLimit.save", "Save limit")}
           </Button>
         </div>
@@ -223,7 +224,7 @@ export function SpendLimitCard({
         </div>
         {isLeader && (
           <Button
-            variant="outline"
+            variant="secondary"
             size="sm"
             onClick={() => onAdjustingChange(true)}
           >
diff --git a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
index 2b8048ebcc..7e8e55e70a 100644
--- a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
@@ -91,7 +91,7 @@ function CheckoutActivationSlow({ onClose }: { onClose: () => void }) {
           "Your payment succeeded, but activation is taking a little longer than usual. It'll switch on automatically - close this and it'll appear here shortly.",
         )}
       </p>
-      <Button variant="outline" onClick={onClose}>
+      <Button variant="secondary" onClick={onClose}>
         {t("portal.billing.checkout.activationSlow.close", "Close")}
       </Button>
     </div>
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx b/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
index 07d3af75c1..2e19223ce8 100644
--- a/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
+++ b/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
@@ -69,7 +69,7 @@ export function ComponentCard({
 
       <div className="portal-components__frameworks">
         {component.frameworks.map((fw) => (
-          <Chip key={fw} size="sm" tone="neutral">
+          <Chip key={fw} size="sm">
             {fw}
           </Chip>
         ))}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
index 1959e10b1d..b2d8a3f173 100644
--- a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
+++ b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
@@ -98,7 +98,7 @@ export function ComponentDetailModal({
         ) : (
           <Button
             size="sm"
-            accent="purple"
+            accent="premium"
             // TODO(backend): route to the upgrade / contact-sales flow.
             onClick={() => onClose()}
           >
@@ -147,7 +147,7 @@ export function ComponentDetailModal({
             </p>
             <div className="portal-components__frameworks">
               {component.frameworks.map((fw) => (
-                <Chip key={fw} size="sm" tone="blue">
+                <Chip key={fw} size="sm">
                   {fw}
                 </Chip>
               ))}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx b/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
index 8ff5155b63..9a87fc3c0d 100644
--- a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
+++ b/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
@@ -32,7 +32,7 @@ export function ComponentPropsTable({ props: rows }: ComponentPropsTableProps) {
         header: t("portal.catalogue.props.columns.required"),
         render: (p) =>
           p.required ? (
-            <Chip size="sm" tone="amber">
+            <Chip size="sm" accent="warning">
               {t("portal.catalogue.props.required")}
             </Chip>
           ) : (
diff --git a/frontend/editor/src/portal/components/docs/AuthenticationSection.tsx b/frontend/editor/src/portal/components/docs/AuthenticationSection.tsx
index e15e04592c..25481f8cf7 100644
--- a/frontend/editor/src/portal/components/docs/AuthenticationSection.tsx
+++ b/frontend/editor/src/portal/components/docs/AuthenticationSection.tsx
@@ -18,13 +18,13 @@ export function AuthenticationSection() {
       />
       <div className="portal-docs__keytable">
         <div className="portal-docs__keyrow">
-          <Chip tone="green" size="sm" showDot>
+          <Chip accent="success" size="sm" showDot>
             sk_live_
           </Chip>
           <span>{t("portal.docs.authentication.liveKey")}</span>
         </div>
         <div className="portal-docs__keyrow">
-          <Chip tone="amber" size="sm" showDot>
+          <Chip accent="warning" size="sm" showDot>
             sk_test_
           </Chip>
           <span>{t("portal.docs.authentication.testKey")}</span>
diff --git a/frontend/editor/src/portal/components/docs/ComponentsSection.tsx b/frontend/editor/src/portal/components/docs/ComponentsSection.tsx
index 5ad8c4b502..6bb9326ab8 100644
--- a/frontend/editor/src/portal/components/docs/ComponentsSection.tsx
+++ b/frontend/editor/src/portal/components/docs/ComponentsSection.tsx
@@ -21,7 +21,7 @@ export function ComponentsSection({
           <Card key={c.name} padding="default">
             <div className="portal-docs__component-head">
               <code className="portal-docs__component-name">{c.name}</code>
-              <Chip tone="purple" size="sm">
+              <Chip accent="premium" size="sm">
                 {c.tag}
               </Chip>
             </div>
diff --git a/frontend/editor/src/portal/components/docs/DocsNav.tsx b/frontend/editor/src/portal/components/docs/DocsNav.tsx
index cbd45e7d6c..48d325e9ae 100644
--- a/frontend/editor/src/portal/components/docs/DocsNav.tsx
+++ b/frontend/editor/src/portal/components/docs/DocsNav.tsx
@@ -1,5 +1,5 @@
+import { Button, Skeleton, StatusBadge } from "@app/ui";
 import { useTranslation } from "react-i18next";
-import { Skeleton, StatusBadge } from "@app/ui";
 import type { DocsNavSection } from "@portal/api/docs";
 
 /** Left-hand documentation nav tree; each leaf selects an in-page section. */
@@ -31,8 +31,10 @@ export function DocsNav({
               const isActive = item.id === active;
               return (
                 <li key={item.id}>
-                  <button
-                    type="button"
+                  <Button
+                    variant="tertiary"
+                    justify="start"
+                    fullWidth
                     className={
                       "portal-docs__nav-link" + (isActive ? " is-active" : "")
                     }
@@ -48,7 +50,7 @@ export function DocsNav({
                         {item.badge}
                       </StatusBadge>
                     )}
-                  </button>
+                  </Button>
                 </li>
               );
             })}
diff --git a/frontend/editor/src/portal/components/docs/GettingStartedSection.tsx b/frontend/editor/src/portal/components/docs/GettingStartedSection.tsx
index 1f94361380..b28929005a 100644
--- a/frontend/editor/src/portal/components/docs/GettingStartedSection.tsx
+++ b/frontend/editor/src/portal/components/docs/GettingStartedSection.tsx
@@ -56,7 +56,7 @@ export function GettingStartedSection({
         </li>
       </ol>
 
-      <Card className="portal-docs__callout" accent="blue" padding="loose">
+      <Card className="portal-docs__callout" accent="default" padding="loose">
         <strong>{t("portal.docs.quickstart.callout.label")}</strong>{" "}
         {t("portal.docs.quickstart.callout.bodyBeforeLink")}{" "}
         <em>{t("portal.docs.quickstart.callout.link")}</em>{" "}
diff --git a/frontend/editor/src/portal/components/docs/PlaybooksSection.tsx b/frontend/editor/src/portal/components/docs/PlaybooksSection.tsx
index f48c90a251..10c5cdc7f6 100644
--- a/frontend/editor/src/portal/components/docs/PlaybooksSection.tsx
+++ b/frontend/editor/src/portal/components/docs/PlaybooksSection.tsx
@@ -20,7 +20,7 @@ export function PlaybooksSection({ playbooks }: { playbooks: Playbook[] }) {
             <div className="portal-docs__playbook-flow">
               {p.steps.map((step, i) => (
                 <span key={step} className="portal-docs__playbook-step">
-                  <Chip size="sm" tone="neutral">
+                  <Chip size="sm" accent="neutral">
                     {step}
                   </Chip>
                   {i < p.steps.length - 1 && (
@@ -33,7 +33,7 @@ export function PlaybooksSection({ playbooks }: { playbooks: Playbook[] }) {
             </div>
             {/* TODO(backend): POST /v1/pipelines/clone-from-playbook to seed a
                 draft pipeline from this recipe, then route to the composer. */}
-            <Button variant="outline" accent={p.accent} size="sm">
+            <Button variant="secondary" accent={p.accent} size="sm">
               {t("portal.docs.recipes.cloneButton")}
             </Button>
           </Card>
diff --git a/frontend/editor/src/portal/components/docs/WebhooksSection.tsx b/frontend/editor/src/portal/components/docs/WebhooksSection.tsx
index ee50704a2f..84ec30a6e0 100644
--- a/frontend/editor/src/portal/components/docs/WebhooksSection.tsx
+++ b/frontend/editor/src/portal/components/docs/WebhooksSection.tsx
@@ -25,7 +25,7 @@ export function WebhooksSection() {
   }
 }`}
       />
-      <Card className="portal-docs__callout" accent="amber" padding="loose">
+      <Card className="portal-docs__callout" accent="warning" padding="loose">
         {t("portal.docs.webhooks.callout.beforeSignature")}{" "}
         <code>Stirling-Signature</code>{" "}
         {t("portal.docs.webhooks.callout.beforeHelper")}{" "}
diff --git a/frontend/editor/src/portal/components/editor-admin/CredentialRotationCard.tsx b/frontend/editor/src/portal/components/editor-admin/CredentialRotationCard.tsx
index a3351b0d28..c4e80c1db1 100644
--- a/frontend/editor/src/portal/components/editor-admin/CredentialRotationCard.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/CredentialRotationCard.tsx
@@ -64,8 +64,8 @@ export function CredentialRotationCard({ serviceToken }: Props) {
 
       <div className="portal-editor__panel-actions">
         <Button
-          variant="outline"
-          accent="amber"
+          variant="secondary"
+          accent="warning"
           loading={rotating}
           onClick={rotate}
         >
diff --git a/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx b/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
index 9920b12d03..7add4fd8b5 100644
--- a/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
@@ -79,10 +79,7 @@ export function DeploymentTargets({ targets, onUpgrade }: Props) {
                 <p className="portal-editor__lock-copy">{lockCopy(target)}</p>
                 <Button
                   size="sm"
-                  variant="outline"
-                  accent={
-                    target.requiresTier === "enterprise" ? "purple" : "blue"
-                  }
+                  variant="secondary"
                   onClick={onUpgrade}
                   disabled={tier === "enterprise"}
                 >
diff --git a/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx b/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
index 4cf664288d..f7923b1272 100644
--- a/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
@@ -2,6 +2,7 @@ import { useTranslation } from "react-i18next";
 import {
   Card,
   Chip,
+  type ChipAccent,
   EmptyState,
   StatusBadge,
   Table,
@@ -20,6 +21,13 @@ const TARGET_LABEL: Record<EditorInstance["target"], string> = {
   kubernetes: "K8s",
 };
 
+/** Map the target palette tone onto the shared Chip accent set. */
+const TARGET_CHIP_ACCENT: Record<"neutral" | "blue" | "purple", ChipAccent> = {
+  neutral: "neutral",
+  blue: "default",
+  purple: "premium",
+};
+
 interface Props {
   instances: EditorInstance[];
 }
@@ -36,7 +44,10 @@ export function InstanceHealthTable({ instances }: Props) {
         <div className="portal-editor__cell-stack">
           <span className="portal-editor__cell-strong">{i.host}</span>
           <span className="portal-editor__cell-muted">
-            <Chip size="sm" tone={TARGET_META[i.target].tone}>
+            <Chip
+              size="sm"
+              accent={TARGET_CHIP_ACCENT[TARGET_META[i.target].tone]}
+            >
               {TARGET_LABEL[i.target]}
             </Chip>
           </span>
diff --git a/frontend/editor/src/portal/components/editor-admin/OfflineActivationCard.tsx b/frontend/editor/src/portal/components/editor-admin/OfflineActivationCard.tsx
index 302fe74812..ff780ea516 100644
--- a/frontend/editor/src/portal/components/editor-admin/OfflineActivationCard.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/OfflineActivationCard.tsx
@@ -30,7 +30,7 @@ export function OfflineActivationCard({ available, onUpgrade }: Props) {
   }
 
   return (
-    <Card padding="default" accent="purple" className="portal-editor__panel">
+    <Card padding="default" accent="premium" className="portal-editor__panel">
       <div className="portal-editor__panel-head">
         <div>
           <h3 className="portal-editor__panel-title">
@@ -51,8 +51,8 @@ export function OfflineActivationCard({ available, onUpgrade }: Props) {
             {t("portal.editorAdmin.offlineActivation.lockCopy")}
           </p>
           <Button
-            variant="outline"
-            accent="purple"
+            variant="secondary"
+            accent="premium"
             size="sm"
             onClick={onUpgrade}
           >
@@ -75,8 +75,8 @@ export function OfflineActivationCard({ available, onUpgrade }: Props) {
           )}
           <div className="portal-editor__panel-actions">
             <Button
-              variant="outline"
-              accent="purple"
+              variant="secondary"
+              accent="premium"
               loading={generating}
               onClick={generate}
             >
diff --git a/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx b/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
index bde1f09aa8..6544ab1967 100644
--- a/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
@@ -59,8 +59,8 @@ export function PairingPanel({ pairings, onUpgrade }: Props) {
                 </p>
                 <Button
                   size="sm"
-                  variant="outline"
-                  accent="purple"
+                  variant="secondary"
+                  accent="premium"
                   onClick={onUpgrade}
                 >
                   {t("portal.editorAdmin.pairing.talkToSales")}
@@ -77,13 +77,13 @@ export function PairingPanel({ pairings, onUpgrade }: Props) {
                 )}
                 <div className="portal-editor__pairing-foot">
                   {p.expires && (
-                    <Chip size="sm" tone="neutral">
+                    <Chip size="sm" accent="neutral">
                       {p.expires}
                     </Chip>
                   )}
                   <Button
                     size="sm"
-                    variant="outline"
+                    variant="secondary"
                     onClick={() => rotate(p.method)}
                   >
                     {rotated === p.method
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
index c1a1c8f247..58008b0837 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
@@ -1,6 +1,6 @@
 import { useState } from "react";
+import { Button, Card, Chip, StatusBadge } from "@app/ui";
 import { useTranslation } from "react-i18next";
-import { Card, Chip, StatusBadge } from "@app/ui";
 import type { ApiKey } from "@portal/api/infrastructure";
 import {
   KEY_LABEL,
@@ -13,8 +13,8 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
   const [open, setOpen] = useState(false);
   return (
     <Card padding="default" className="portal-infra__key">
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         className="portal-infra__key-head"
         onClick={() => setOpen((v) => !v)}
         aria-expanded={open}
@@ -34,7 +34,7 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
             ›
           </span>
         </span>
-      </button>
+      </Button>
 
       {open && (
         <div className="portal-infra__key-body">
@@ -71,7 +71,7 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
               <dt>{t("portal.infrastructure.apiKeys.card.permissions")}</dt>
               <dd className="portal-infra__chips">
                 {apiKey.permissions.map((p) => (
-                  <Chip key={p} tone="blue" size="sm">
+                  <Chip key={p} size="sm">
                     {p}
                   </Chip>
                 ))}
@@ -86,7 +86,7 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
                   </span>
                 ) : (
                   apiKey.allowedIps.map((ip) => (
-                    <Chip key={ip} tone="neutral" size="sm">
+                    <Chip key={ip} size="sm">
                       <span className="portal-infra__mono">{ip}</span>
                     </Chip>
                   ))
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
index a41dca0d20..a93b2c0c56 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
@@ -24,10 +24,9 @@ export function ApiKeysTab() {
           sub={t("portal.infrastructure.apiKeys.subheading")}
         />
         <Button
-          variant="gradient"
           size="sm"
           onClick={() => setModalOpen(true)}
-          leadingIcon={<span aria-hidden>+</span>}
+          leftSection={<span aria-hidden>+</span>}
         >
           {t("portal.infrastructure.apiKeys.createKey")}
         </Button>
diff --git a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
index 7e4fc0b723..613eb97377 100644
--- a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
@@ -72,16 +72,17 @@ export function CreateKeyModal({
       }
       footer={
         created ? (
-          <Button variant="gradient" onClick={close}>
+          <Button variant="primary" accent="premium" onClick={close}>
             {t("portal.infrastructure.createKey.done")}
           </Button>
         ) : (
           <div className="portal-infra__modal-actions">
-            <Button variant="ghost" onClick={close}>
+            <Button variant="tertiary" onClick={close}>
               {t("portal.infrastructure.createKey.cancel")}
             </Button>
             <Button
-              variant="gradient"
+              variant="primary"
+              accent="premium"
               disabled={name.trim() === "" || perms.length === 0}
               onClick={createKey}
             >
diff --git a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx b/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx
index 9c2037b13f..18967c2aaa 100644
--- a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx
@@ -141,11 +141,11 @@ export function DeploymentsTab() {
       header: t("portal.infrastructure.deployments.deployColumns.environment"),
       render: (d) => (
         <Chip
-          tone={
+          accent={
             d.environment === "production"
-              ? "blue"
+              ? "default"
               : d.environment === "canary"
-                ? "purple"
+                ? "premium"
                 : "neutral"
           }
           size="sm"
diff --git a/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx b/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx
index c6ba26d4b1..56f0583cdb 100644
--- a/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx
@@ -46,7 +46,7 @@ export function ModelsTab() {
       render: (m) => (
         <div className="portal-infra__cell-stack">
           <span className="portal-infra__cell-strong">{m.name}</span>
-          <Chip tone="neutral" size="sm">
+          <Chip accent="neutral" size="sm">
             {MODEL_PROVIDER_LABEL[m.provider]}
           </Chip>
         </div>
@@ -56,7 +56,7 @@ export function ModelsTab() {
       key: "type",
       header: t("portal.infrastructure.models.columns.type"),
       render: (m) => (
-        <Chip tone={MODEL_TYPE_TONE[m.type]} size="sm">
+        <Chip accent={MODEL_TYPE_TONE[m.type]} size="sm">
           {MODEL_TYPE_LABEL[m.type]}
         </Chip>
       ),
@@ -134,7 +134,7 @@ export function ModelsTab() {
         <div className="portal-infra__cell-stack">
           <span className="portal-infra__cell-strong">{r.operation}</span>
           {r.isDefault && (
-            <Chip tone="blue" size="sm">
+            <Chip accent="default" size="sm">
               {t("portal.infrastructure.models.routingColumns.default")}
             </Chip>
           )}
diff --git a/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx b/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx
index 457313eb29..0d299d7032 100644
--- a/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx
@@ -191,7 +191,7 @@ export function SecurityTab() {
             {/* Rotation is a privileged backend action; disabled where Stirling
                 holds the keys (managed tiers can't rotate customer keys). */}
             <Button
-              variant="outline"
+              variant="secondary"
               size="sm"
               disabled={!data.keyManagement.customerManaged}
               onClick={() => {
@@ -286,9 +286,7 @@ export function SecurityTab() {
                   {ATTESTATION_LABEL[a.status]}
                 </StatusBadge>
               </div>
-              <Chip tone="neutral" size="sm">
-                {a.framework}
-              </Chip>
+              <Chip size="sm">{a.framework}</Chip>
               <p className="portal-infra__cert-detail">{a.detail}</p>
               {a.reportUrl ? (
                 <a
diff --git a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
index 7b2ecaa441..a1f3b91869 100644
--- a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
@@ -166,7 +166,7 @@ export function StorageTab() {
                 ) : (
                   // TODO(backend): launch the provider OAuth/credential flow,
                   // then POST /v1/infrastructure/storage/providers/{id}/connect
-                  <Button variant="outline" size="sm">
+                  <Button variant="secondary" size="sm">
                     {t("portal.infrastructure.storage.providers.connect")}
                   </Button>
                 )}
diff --git a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
index 43980b4dba..2cf7c2e028 100644
--- a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
+++ b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
@@ -1,4 +1,4 @@
-import type { ChipTone, StatusTone } from "@app/ui";
+import type { ChipAccent, StatusTone } from "@app/ui";
 import type {
   ApiKeyStatus,
   AttestationStatus,
@@ -135,11 +135,11 @@ export const MODEL_TYPE_LABEL: Record<ModelType, string> = {
   llm: "LLM",
 };
 
-export const MODEL_TYPE_TONE: Record<ModelType, ChipTone> = {
-  extraction: "blue",
-  classification: "purple",
-  ocr: "green",
-  llm: "amber",
+export const MODEL_TYPE_TONE: Record<ModelType, ChipAccent> = {
+  extraction: "default",
+  classification: "premium",
+  ocr: "success",
+  llm: "warning",
 };
 
 export const MODEL_PROVIDER_LABEL: Record<ModelProvider, string> = {
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx b/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
index 5040a97ac0..fe0546a606 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
+  ActionIcon,
   Banner,
   Button,
   Checkbox,
@@ -280,7 +281,7 @@ export function PipelineComposer({
       footer={
         <div className="portal-pipelines__composer-footer">
           <Button
-            variant="ghost"
+            variant="tertiary"
             size="sm"
             disabled={submitting}
             onClick={onClose}
@@ -397,29 +398,29 @@ export function PipelineComposer({
                     {humanizeOperation(step.operation)}
                   </span>
                   <div className="portal-pipelines__chain-actions">
-                    <button
+                    <ActionIcon
                       type="button"
                       aria-label={t("portal.pipelines.composer.moveUp")}
                       disabled={i === 0}
                       onClick={() => moveStep(i, -1)}
                     >
                       ↑
-                    </button>
-                    <button
+                    </ActionIcon>
+                    <ActionIcon
                       type="button"
                       aria-label={t("portal.pipelines.composer.moveDown")}
                       disabled={i === steps.length - 1}
                       onClick={() => moveStep(i, 1)}
                     >
                       ↓
-                    </button>
-                    <button
+                    </ActionIcon>
+                    <ActionIcon
                       type="button"
                       aria-label={t("portal.pipelines.composer.removeStep")}
                       onClick={() => removeStep(i)}
                     >
                       ×
-                    </button>
+                    </ActionIcon>
                   </div>
                 </li>
               ))}
@@ -429,7 +430,7 @@ export function PipelineComposer({
             {PIPELINE_OPERATIONS.map((op) => (
               <Chip
                 key={op.operation}
-                tone="blue"
+                accent="default"
                 size="sm"
                 onClick={() => addStep(op.operation, op.parameters)}
               >
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx b/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
index 6bfc39d510..ea72ddfc53 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Banner, Button, Chip } from "@app/ui";
+import { ActionIcon, Banner, Button, Chip } from "@app/ui";
 import { errorMessage } from "@portal/api/http";
 import {
   fetchRun,
@@ -116,14 +116,14 @@ export function PipelineDetailCard({
             })}
           </span>
         </div>
-        <button
+        <ActionIcon
           type="button"
           className="portal-pipelines__expanded-close"
           onClick={onClose}
           aria-label={t("portal.pipelines.detail.closeAriaLabel")}
         >
           ×
-        </button>
+        </ActionIcon>
       </header>
 
       <div className="portal-pipelines__detail">
@@ -138,7 +138,7 @@ export function PipelineDetailCard({
           ) : (
             <div className="portal-pipelines__chips">
               {pipeline.steps.map((step, i) => (
-                <Chip key={`${step}-${i}`} tone="blue" size="sm">
+                <Chip key={`${step}-${i}`} size="sm">
                   {`${i + 1}. ${humanizeOperation(step)}`}
                 </Chip>
               ))}
@@ -157,7 +157,7 @@ export function PipelineDetailCard({
           ) : (
             <div className="portal-pipelines__chips">
               {pipeline.sources.map((source) => (
-                <Chip key={source.id} tone="neutral" size="sm">
+                <Chip key={source.id} accent="neutral" size="sm">
                   {source.name}
                 </Chip>
               ))}
@@ -169,7 +169,7 @@ export function PipelineDetailCard({
           <span className="portal-pipelines__detail-heading">
             {t("portal.pipelines.detail.output")}
           </span>
-          <Chip tone="purple" size="sm">
+          <Chip accent="premium" size="sm">
             {t(`portal.pipelines.output.${pipeline.output}`, {
               defaultValue: pipeline.output,
             })}
@@ -186,14 +186,14 @@ export function PipelineDetailCard({
           {t("portal.pipelines.detail.run")}
         </Button>
         <Button
-          variant="outline"
+          variant="secondary"
           disabled={busy || running}
           onClick={() => onEdit(pipeline)}
         >
           {t("portal.pipelines.detail.edit")}
         </Button>
         <Button
-          variant="outline"
+          variant="secondary"
           disabled={busy || running}
           onClick={() => onTogglePause(pipeline)}
         >
@@ -202,8 +202,8 @@ export function PipelineDetailCard({
             : t("portal.pipelines.detail.pause")}
         </Button>
         <Button
-          accent="red"
-          variant="outline"
+          accent="danger"
+          variant="secondary"
           disabled={busy || running}
           onClick={() => onDelete(pipeline)}
         >
diff --git a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
index a39f1c5e95..d2fda82fdc 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
@@ -39,7 +39,7 @@ export function PipelinesTable({
             </span>
             <div className="portal-pipelines__name-text">
               <strong>{p.name}</strong>
-              <Chip tone="neutral" size="sm">
+              <Chip accent="neutral" size="sm">
                 {t(`portal.pipelines.trigger.${p.trigger}`, {
                   defaultValue: p.trigger,
                 })}
diff --git a/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx b/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
index 21aef179a1..3ec4a72f78 100644
--- a/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
@@ -50,7 +50,7 @@ export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
       </div>
 
       {comingSoon ? (
-        <Chip tone="neutral" size="sm">
+        <Chip accent="neutral" size="sm">
           {t("portal.policies.card.comingSoon")}
         </Chip>
       ) : policy ? (
@@ -82,7 +82,7 @@ export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
           </StatusBadge>
         </div>
       ) : (
-        <Chip tone="blue" size="sm">
+        <Chip accent="default" size="sm">
           {t("portal.policies.card.notSetUp")}
         </Chip>
       )}
diff --git a/frontend/editor/src/portal/components/policies/PolicyDetailPanel.tsx b/frontend/editor/src/portal/components/policies/PolicyDetailPanel.tsx
index fd10a0a8d6..d638cc4b7a 100644
--- a/frontend/editor/src/portal/components/policies/PolicyDetailPanel.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyDetailPanel.tsx
@@ -84,15 +84,16 @@ function ActivityError({ message }: { message: string }) {
       >
         {message}
       </span>
-      <button
+      <Button
         type="button"
+        variant="quiet"
         className="portal-policies__link portal-policies__activity-error-toggle"
         onClick={() => setExpanded((v) => !v)}
       >
         {expanded
           ? t("portal.policies.detail.showLess")
           : t("portal.policies.detail.showMore")}
-      </button>
+      </Button>
     </span>
   );
 }
@@ -139,8 +140,8 @@ export function PolicyDetailPanel({
         <div className="portal-policies__detail-foot">
           {canDelete && (
             <Button
-              variant="ghost"
-              accent="red"
+              variant="tertiary"
+              accent="danger"
               size="sm"
               onClick={onDelete}
               disabled={busy}
@@ -151,7 +152,7 @@ export function PolicyDetailPanel({
           )}
           {onRun && (
             <Button
-              variant="outline"
+              variant="secondary"
               size="sm"
               onClick={onRun}
               disabled={busy}
@@ -161,7 +162,7 @@ export function PolicyDetailPanel({
             </Button>
           )}
           <Button
-            variant="outline"
+            variant="secondary"
             size="sm"
             onClick={onTogglePause}
             disabled={busy}
@@ -278,13 +279,14 @@ export function PolicyDetailPanel({
                 {item.time}
               </span>
               {item.status === "flagged" && onRetry && (
-                <button
+                <Button
                   type="button"
+                  variant="quiet"
                   className="portal-policies__link portal-policies__activity-retry"
                   onClick={() => onRetry(item)}
                 >
                   {t("portal.policies.detail.retry")}
-                </button>
+                </Button>
               )}
             </div>
           ))}
diff --git a/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx b/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
index 4024cce5e3..bad56b0541 100644
--- a/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyFieldRow.tsx
@@ -45,7 +45,7 @@ export function PolicyFieldRow({
           {(field.options ?? []).map((opt) => (
             <Chip
               key={opt}
-              tone={selected.includes(opt) ? "blue" : "neutral"}
+              accent={selected.includes(opt) ? "default" : "neutral"}
               size="sm"
               onClick={() => toggle(opt)}
             >
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 96a9d377f2..13f0dab8ac 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -251,7 +251,7 @@ function PolicySetupWizardBody({
       subtitle={config.summary}
       footer={
         <div className="portal-policies__wizard-foot">
-          <Button variant="ghost" size="sm" onClick={onClose}>
+          <Button variant="tertiary" size="sm" onClick={onClose}>
             {t("portal.policies.wizard.actions.cancel")}
           </Button>
           {step === "workflow" ? (
@@ -265,7 +265,7 @@ function PolicySetupWizardBody({
           ) : (
             <>
               <Button
-                variant="outline"
+                variant="secondary"
                 size="sm"
                 style={{ marginLeft: "auto" }}
                 onClick={() => setStep("workflow")}
@@ -367,9 +367,10 @@ function PolicySetupWizardBody({
               />
             ) : (
               availableSources.map((src) => (
-                <button
+                <Button
                   key={src.id}
                   type="button"
+                  variant="quiet"
                   className={
                     "portal-policies__source" +
                     (sources.includes(src.id)
@@ -389,7 +390,7 @@ function PolicySetupWizardBody({
                       {src.type}
                     </span>
                   </span>
-                </button>
+                </Button>
               ))
             )}
           </div>
@@ -413,22 +414,23 @@ function PolicySetupWizardBody({
                         count: scopeTypes.length,
                       })}
                 </span>
-                <button
+                <Button
                   type="button"
+                  variant="quiet"
                   className="portal-policies__link"
                   onClick={() => setScopeNarrow((v) => !v)}
                 >
                   {scopeNarrow
                     ? t("portal.policies.wizard.docTypes.clear")
                     : t("portal.policies.wizard.docTypes.narrow")}
-                </button>
+                </Button>
               </div>
               {scopeNarrow && (
                 <div className="portal-policies__doctypes">
                   {POLICY_DOC_TYPES.map((dt) => (
                     <Chip
                       key={dt}
-                      tone={scopeTypes.includes(dt) ? "blue" : "neutral"}
+                      accent={scopeTypes.includes(dt) ? "default" : "neutral"}
                       size="sm"
                       onClick={() => toggleScopeType(dt)}
                     >
diff --git a/frontend/editor/src/portal/components/procurement/ActionModal.tsx b/frontend/editor/src/portal/components/procurement/ActionModal.tsx
index e05ee15fbf..0a74f71370 100644
--- a/frontend/editor/src/portal/components/procurement/ActionModal.tsx
+++ b/frontend/editor/src/portal/components/procurement/ActionModal.tsx
@@ -124,12 +124,12 @@ export function ActionModal({
       subtitle={copy.subtitle}
       footer={
         <div className="portal-proc__modal-actions">
-          <Button variant="ghost" onClick={onClose}>
+          <Button variant="tertiary" onClick={onClose}>
             {t("portal.procurement.modal.cancel")}
           </Button>
           <Button
-            variant="gradient"
-            accent="purple"
+            variant="primary"
+            accent="premium"
             loading={submitting}
             disabled={needsFile && !file}
             onClick={submit}
@@ -150,7 +150,7 @@ export function ActionModal({
             onChange={(e) => setFile(e.target.files?.[0] ?? null)}
           />
           <Button
-            variant="outline"
+            variant="secondary"
             size="sm"
             onClick={() => fileRef.current?.click()}
           >
diff --git a/frontend/editor/src/portal/components/procurement/DealJourney.tsx b/frontend/editor/src/portal/components/procurement/DealJourney.tsx
index 96588f3c21..6e01d5c0f7 100644
--- a/frontend/editor/src/portal/components/procurement/DealJourney.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealJourney.tsx
@@ -85,8 +85,8 @@ export function DealJourney({
         </div>
         {!isTerminal && currentStep && (
           <Button
-            variant="gradient"
-            accent="purple"
+            variant="primary"
+            accent="premium"
             loading={advancing}
             onClick={() => onAdvance(currentStage)}
           >
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
index 296ccc1a52..730fb768ec 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
@@ -143,8 +143,8 @@ export function DealStatusHero({
         </span>
         <div className="portal-hero__next-actions">
           <Button
-            variant="gradient"
-            accent="purple"
+            variant="primary"
+            accent="premium"
             loading={busy}
             onClick={onExpand}
           >
diff --git a/frontend/editor/src/portal/components/procurement/DocRow.tsx b/frontend/editor/src/portal/components/procurement/DocRow.tsx
index ff6d27716e..b4329fbfa4 100644
--- a/frontend/editor/src/portal/components/procurement/DocRow.tsx
+++ b/frontend/editor/src/portal/components/procurement/DocRow.tsx
@@ -10,15 +10,15 @@ import {
 
 /** Maps a document's action to the button accent + variant. */
 function buttonStyle(doc: LedgerDoc): {
-  variant: "gradient" | "outline";
-  accent: "purple" | "blue";
+  variant: "primary" | "secondary";
+  accent: "premium" | "default";
 } {
   // The agreement signature and online payment are the deal-advancing actions;
-  // give them the filled accent CTA. Everything else is a quieter outline.
+  // give them the filled premium CTA. Everything else is a quieter outline.
   if (doc.action === "sign" || doc.action === "pay") {
-    return { variant: "gradient", accent: "purple" };
+    return { variant: "primary", accent: "premium" };
   }
-  return { variant: "outline", accent: "blue" };
+  return { variant: "secondary", accent: "default" };
 }
 
 /**
@@ -52,12 +52,12 @@ export function DocRow({
         <div className="portal-proc__doc-name-row">
           <span className="portal-proc__doc-name">{doc.name}</span>
           {doc.optional && (
-            <Chip tone="neutral" size="sm">
+            <Chip accent="neutral" size="sm">
               {t("portal.procurement.docs.optional")}
             </Chip>
           )}
           {doc.fee !== undefined && (
-            <Chip tone="amber" size="sm">
+            <Chip accent="warning" size="sm">
               {t("portal.procurement.docs.paidAddon")}
             </Chip>
           )}
diff --git a/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx b/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
index 69333325e8..8189d006f8 100644
--- a/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
+++ b/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
@@ -81,12 +81,12 @@ export function DocumentLedger({
                     <span className="portal-proc__stage-hint">· {blurb}</span>
                   )}
                   {cur && (
-                    <Chip tone="purple" size="sm">
+                    <Chip accent="premium" size="sm">
                       {t("portal.procurement.docs.here")}
                     </Chip>
                   )}
                   {done && (
-                    <Chip tone="green" size="sm">
+                    <Chip accent="success" size="sm">
                       {t("portal.procurement.docs.done")}
                     </Chip>
                   )}
diff --git a/frontend/editor/src/portal/components/procurement/LockedState.tsx b/frontend/editor/src/portal/components/procurement/LockedState.tsx
index 90a61c987a..8e70ba18c4 100644
--- a/frontend/editor/src/portal/components/procurement/LockedState.tsx
+++ b/frontend/editor/src/portal/components/procurement/LockedState.tsx
@@ -23,7 +23,7 @@ export function LockedState({
         title={t("portal.procurement.locked.title")}
         description={t("portal.procurement.locked.description")}
         actions={
-          <Button variant="gradient" accent="purple" onClick={onTalkToSales}>
+          <Button variant="primary" accent="premium" onClick={onTalkToSales}>
             {t("portal.procurement.locked.talkToSales")}
           </Button>
         }
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
index bd00a93904..640fcdb2e3 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
@@ -112,8 +112,8 @@ export function ProcurementAgreement({
 
       <div className="portal-proc__payment-actions">
         <Button
-          variant="gradient"
-          accent="purple"
+          variant="primary"
+          accent="premium"
           loading={busy}
           disabled={!checked}
           onClick={onAgree}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
index ce6620da78..d1f13ca0ee 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
@@ -276,8 +276,8 @@ export function TrialManageModal({
             {t("portal.procurement.trial.cancel")}
           </button>
           <Button
-            variant="gradient"
-            accent="purple"
+            variant="primary"
+            accent="premium"
             loading={busy}
             disabled={maxed}
             onClick={onExtend}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
index a10057a3d8..3c0498b71b 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
@@ -164,8 +164,8 @@ export function ProcurementHome({ autoOpen = false }: { autoOpen?: boolean }) {
           </p>
         </div>
         <Button
-          variant="outline"
-          accent="blue"
+          variant="secondary"
+          accent="default"
           loading={busy}
           disabled={!isLinked}
           onClick={onStartTrial}
@@ -201,8 +201,8 @@ export function ProcurementHome({ autoOpen = false }: { autoOpen?: boolean }) {
             description={t("portal.procurement.link.description")}
             actions={
               <Button
-                variant="gradient"
-                accent="purple"
+                variant="primary"
+                accent="premium"
                 onClick={() => openLinkModal()}
               >
                 {t("portal.procurement.link.cta")}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
index 7074e390e7..6c57c501c7 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
@@ -31,10 +31,10 @@ export const Open: Story = {
           contract and go live.
         </p>
         <div style={{ display: "flex", gap: "0.6rem" }}>
-          <Button variant="gradient" accent="purple">
+          <Button variant="primary" accent="premium">
             Continue to checkout
           </Button>
-          <Button variant="outline">Edit quote</Button>
+          <Button variant="secondary">Edit quote</Button>
         </div>
       </Card>
     ),
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
index fdebad61f6..174ed91154 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
@@ -72,17 +72,17 @@ export function QuoteMilestoneCard({
       </div>
       <div className="portal-proc__payment-actions">
         <Button
-          variant="gradient"
-          accent="purple"
+          variant="primary"
+          accent="premium"
           loading={busy}
           onClick={onAccept}
         >
           {t("portal.procurement.milestone.accept")}
         </Button>
-        <Button variant="outline" loading={downloading} onClick={onDownload}>
+        <Button variant="secondary" loading={downloading} onClick={onDownload}>
           {t("portal.procurement.milestone.download")}
         </Button>
-        <Button variant="ghost" onClick={onEdit}>
+        <Button variant="tertiary" onClick={onEdit}>
           {t("portal.procurement.milestone.edit")}
         </Button>
       </div>
@@ -115,8 +115,8 @@ export function PaymentStageCard({
         <div className="portal-proc__payment-actions">
           {invoiceUrl && (
             <Button
-              variant="gradient"
-              accent="purple"
+              variant="primary"
+              accent="premium"
               onClick={() => window.open(invoiceUrl, "_blank", "noopener")}
             >
               {t("portal.procurement.payment.viewInvoice")}
@@ -124,7 +124,7 @@ export function PaymentStageCard({
           )}
           {invoicePdf && (
             <Button
-              variant="outline"
+              variant="secondary"
               onClick={() => window.open(invoicePdf, "_blank", "noopener")}
             >
               {t("portal.procurement.payment.downloadInvoice")}
diff --git a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
index b180c986bf..d13aaaff06 100644
--- a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
+++ b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
@@ -283,14 +283,14 @@ export function QuoteBuilder({
         </span>
         <div className="portal-qb__foot-btns">
           {step > 0 && (
-            <Button variant="outline" onClick={() => setStep(step - 1)}>
+            <Button variant="secondary" onClick={() => setStep(step - 1)}>
               {t("portal.procurement.builder.back")}
             </Button>
           )}
           {step === 0 && (
             <Button
-              variant="gradient"
-              accent="purple"
+              variant="primary"
+              accent="premium"
               disabled={cfg.volume <= 0}
               onClick={() => setStep(1)}
             >
@@ -299,8 +299,8 @@ export function QuoteBuilder({
           )}
           {step === 1 && (
             <Button
-              variant="gradient"
-              accent="purple"
+              variant="primary"
+              accent="premium"
               onClick={() => setStep(2)}
             >
               {t("portal.procurement.builder.continue")}
@@ -308,8 +308,8 @@ export function QuoteBuilder({
           )}
           {step === 2 && (
             <Button
-              variant="gradient"
-              accent="purple"
+              variant="primary"
+              accent="premium"
               loading={busy}
               disabled={!eula}
               onClick={generate}
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
index 2c6e9263b7..afb3982545 100644
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
@@ -153,7 +153,7 @@ export function ConnectWizard({
       footer={
         <div className="portal-sources__wizard-footer">
           <Button
-            variant="ghost"
+            variant="tertiary"
             size="sm"
             disabled={submitting}
             onClick={() =>
@@ -169,7 +169,7 @@ export function ConnectWizard({
             onClick={advance}
             loading={submitting}
             disabled={!canContinue}
-            trailingIcon={!isLast ? <span aria-hidden>→</span> : undefined}
+            rightSection={!isLast ? <span aria-hidden>→</span> : undefined}
           >
             {!isLast
               ? t("portal.sources.wizard.continue")
@@ -200,9 +200,9 @@ export function ConnectWizard({
       {stepId === "type" && (
         <div className="portal-sources__type-grid">
           {CREATABLE_SOURCE_TYPES.map((ct) => (
-            <button
+            <Button
               key={ct.type}
-              type="button"
+              variant="tertiary"
               className={
                 "portal-sources__type-card" +
                 (type.type === ct.type ? " is-selected" : "")
@@ -215,7 +215,7 @@ export function ConnectWizard({
               <span className="portal-sources__type-name">
                 {t(ct.labelKey)}
               </span>
-            </button>
+            </Button>
           ))}
         </div>
       )}
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx b/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
index e1ab6a3503..ca659ec9d5 100644
--- a/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
+++ b/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
@@ -1,9 +1,10 @@
 import { useTranslation } from "react-i18next";
-import { Button } from "@app/ui";
+import { ActionIcon, Button } from "@app/ui";
 import type { SourceView } from "@portal/api/sources";
 import { SourceDetailPanel } from "@portal/components/sources/SourceDetailPanel";
 import { sourceTypeMeta } from "@portal/components/sources/sourceTypes";
 import "@portal/views/Sources.css";
+import CloseIcon from "@mui/icons-material/Close";
 
 interface SourceDetailCardProps {
   source: SourceView;
@@ -33,7 +34,7 @@ export function SourceDetailCard({
     <section className="portal-sources__expanded">
       <header className="portal-sources__expanded-head">
         <span
-          className={`portal-sources__type-dot portal-sources__type-dot--${meta.tone}`}
+          className={`portal-sources__type-dot portal-sources__type-dot--${meta.accent}`}
           aria-hidden
         >
           {meta.icon}
@@ -47,28 +48,28 @@ export function SourceDetailCard({
             })}
           </span>
         </div>
-        <button
-          type="button"
+        <ActionIcon
+          variant="tertiary"
           className="portal-sources__expanded-close"
           onClick={onClose}
           aria-label={t("portal.sources.detail.closeAriaLabel")}
         >
-          ×
-        </button>
+          <CloseIcon />
+        </ActionIcon>
       </header>
 
       <SourceDetailPanel source={source} docSeries={docSeries} />
 
       <div className="portal-sources__detail-actions">
         <Button
-          variant="outline"
+          variant="secondary"
           disabled={busy}
           onClick={() => onEdit(source)}
         >
           {t("portal.sources.detail.edit")}
         </Button>
         <Button
-          variant="outline"
+          variant="secondary"
           disabled={busy}
           onClick={() => onTogglePause(source)}
         >
@@ -77,8 +78,8 @@ export function SourceDetailCard({
             : t("portal.sources.detail.pause")}
         </Button>
         <Button
-          accent="red"
-          variant="outline"
+          accent="danger"
+          variant="secondary"
           disabled={busy}
           onClick={() => onDelete(source)}
         >
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx b/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
index 836d72ba81..f4ee827575 100644
--- a/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
+++ b/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
@@ -41,7 +41,7 @@ export function SourceDetailPanel({
         ) : (
           <div className="portal-sources__chips">
             {source.referencingPolicies.map((policy) => (
-              <Chip key={policy.id} tone="blue" size="sm">
+              <Chip key={policy.id} size="sm">
                 {policy.name}
               </Chip>
             ))}
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
index 45ca391575..be66fa350e 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
@@ -40,14 +40,14 @@ export function SourcesTable({
           return (
             <div className="portal-sources__name-cell">
               <span
-                className={`portal-sources__type-dot portal-sources__type-dot--${meta.tone}`}
+                className={`portal-sources__type-dot portal-sources__type-dot--${meta.accent}`}
                 aria-hidden
               >
                 {meta.icon}
               </span>
               <div className="portal-sources__name-text">
                 <strong>{s.name}</strong>
-                <Chip tone={meta.tone} size="sm">
+                <Chip accent={meta.accent} size="sm">
                   {t(meta.labelKey)}
                 </Chip>
               </div>
diff --git a/frontend/editor/src/portal/components/sources/sourceTypes.ts b/frontend/editor/src/portal/components/sources/sourceTypes.ts
index 59fb91fcd2..f3e128ef55 100644
--- a/frontend/editor/src/portal/components/sources/sourceTypes.ts
+++ b/frontend/editor/src/portal/components/sources/sourceTypes.ts
@@ -1,4 +1,4 @@
-import type { ChipTone } from "@app/ui";
+import type { ChipAccent } from "@app/ui";
 
 /**
  * Per-type presentation + create-form metadata. User-facing copy is stored as
@@ -12,26 +12,26 @@ import type { ChipTone } from "@app/ui";
 export interface SourceTypeMeta {
   labelKey: string;
   icon: string;
-  tone: ChipTone;
+  accent: ChipAccent;
 }
 
 const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
   folder: {
     labelKey: "portal.sources.types.folder.label",
     icon: "⛁",
-    tone: "blue",
+    accent: "default",
   },
   editor: {
     labelKey: "portal.sources.types.editor.label",
     icon: "✏",
-    tone: "green",
+    accent: "success",
   },
 };
 
 const UNKNOWN_TYPE_META: SourceTypeMeta = {
   labelKey: "portal.sources.types.unknown.label",
   icon: "◇",
-  tone: "neutral",
+  accent: "neutral",
 };
 
 export function sourceTypeMeta(type: string): SourceTypeMeta {
diff --git a/frontend/editor/src/portal/components/users/AccessControls.tsx b/frontend/editor/src/portal/components/users/AccessControls.tsx
index d45d43bbaf..9744e13141 100644
--- a/frontend/editor/src/portal/components/users/AccessControls.tsx
+++ b/frontend/editor/src/portal/components/users/AccessControls.tsx
@@ -142,7 +142,7 @@ export function AccessControls({ access }: AccessControlsProps) {
                 value={access.sso.domains.join(", ") || "—"}
               />
             </div>
-            <Button variant="ghost" size="sm">
+            <Button variant="tertiary" size="sm">
               {t("portal.users.access.sso.manage")}
             </Button>
           </Card>
@@ -188,7 +188,7 @@ export function AccessControls({ access }: AccessControlsProps) {
           title={t("portal.users.access.upgrade.title")}
           description={access.upgradeHint}
           action={
-            <Button size="sm" accent="purple">
+            <Button size="sm" accent="premium">
               {t("portal.users.access.upgrade.action")}
             </Button>
           }
diff --git a/frontend/editor/src/portal/components/users/InviteMemberModal.tsx b/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
index ad98077ba4..fe90105cf5 100644
--- a/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
+++ b/frontend/editor/src/portal/components/users/InviteMemberModal.tsx
@@ -60,7 +60,7 @@ export function InviteMemberModal({ open, onClose }: InviteMemberModalProps) {
       subtitle={t("portal.users.invite.subtitle")}
       footer={
         <div className="portal-users__modal-footer">
-          <Button variant="ghost" size="sm" onClick={close}>
+          <Button variant="tertiary" size="sm" onClick={close}>
             {t("portal.users.invite.cancel")}
           </Button>
           <Button size="sm" onClick={submit} disabled={touched && !emailValid}>
diff --git a/frontend/editor/src/portal/components/users/MembersTable.tsx b/frontend/editor/src/portal/components/users/MembersTable.tsx
index deda005d1f..6a918813b5 100644
--- a/frontend/editor/src/portal/components/users/MembersTable.tsx
+++ b/frontend/editor/src/portal/components/users/MembersTable.tsx
@@ -1,15 +1,24 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import { Menu } from "@mantine/core";
-import { Avatar, Chip, StatusBadge, Table, type TableColumn } from "@app/ui";
+import {
+  ActionIcon,
+  Avatar,
+  Chip,
+  StatusBadge,
+  Table,
+  type TableColumn,
+} from "@app/ui";
 import {
   type Member,
   type RoleId,
   MEMBER_STATUS_TONE,
   ROLE_LABEL,
-  ROLE_TONE,
 } from "@portal/api/users";
-import { avatarToneForRole } from "@portal/components/users/format";
+import {
+  avatarToneForRole,
+  chipAccentForRole,
+} from "@portal/components/users/format";
 import "@portal/views/Users.css";
 
 interface MembersTableProps {
@@ -57,7 +66,7 @@ export function MembersTable({
         key: "role",
         header: t("portal.users.table.role"),
         render: (m) => (
-          <Chip tone={ROLE_TONE[m.role]} size="sm">
+          <Chip accent={chipAccentForRole(m.role)} size="sm">
             {ROLE_LABEL[m.role]}
           </Chip>
         ),
@@ -92,16 +101,16 @@ export function MembersTable({
           // a row-action menu needs; SUI has no equivalent.
           <Menu position="bottom-end" withinPortal shadow="md" width={200}>
             <Menu.Target>
-              <button
-                type="button"
+              <ActionIcon
                 className="portal-users__row-action"
                 aria-label={t("portal.users.table.actionsFor", {
                   name: m.name,
                 })}
                 onClick={(e) => e.stopPropagation()}
+                variant="tertiary"
               >
                 ⋯
-              </button>
+              </ActionIcon>
             </Menu.Target>
             <Menu.Dropdown>
               <Menu.Label>{t("portal.users.table.changeRole")}</Menu.Label>
diff --git a/frontend/editor/src/portal/components/users/RolesGrid.tsx b/frontend/editor/src/portal/components/users/RolesGrid.tsx
index 522c264e82..24527f35be 100644
--- a/frontend/editor/src/portal/components/users/RolesGrid.tsx
+++ b/frontend/editor/src/portal/components/users/RolesGrid.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
 import { Card, Chip } from "@app/ui";
 import type { Role } from "@portal/api/users";
+import { chipAccentForRole } from "@portal/components/users/format";
 import "@portal/views/Users.css";
 
 interface RolesGridProps {
@@ -24,7 +25,7 @@ export function RolesGrid({ roles }: RolesGridProps) {
         {roles.map((role) => (
           <Card key={role.id} padding="default" className="portal-users__role">
             <div className="portal-users__role-head">
-              <Chip tone={role.tone} size="sm">
+              <Chip accent={chipAccentForRole(role.id)} size="sm">
                 {role.label}
               </Chip>
             </div>
diff --git a/frontend/editor/src/portal/components/users/format.ts b/frontend/editor/src/portal/components/users/format.ts
index 4dff015986..3308a6441d 100644
--- a/frontend/editor/src/portal/components/users/format.ts
+++ b/frontend/editor/src/portal/components/users/format.ts
@@ -1,7 +1,24 @@
-import type { AvatarTone } from "@app/ui";
+import type { AvatarTone, ChipAccent } from "@app/ui";
 import type { RoleId } from "@portal/api/users";
 import { ROLE_TONE } from "@portal/api/users";
 
+/** Map the role palette onto the shared Chip accent set. */
+const ROLE_CHIP_ACCENT: Record<
+  "purple" | "blue" | "green" | "amber" | "neutral",
+  ChipAccent
+> = {
+  purple: "premium",
+  blue: "default",
+  green: "success",
+  amber: "warning",
+  neutral: "neutral",
+};
+
+/** Chip accent for a role, derived from its palette tone. */
+export function chipAccentForRole(role: RoleId): ChipAccent {
+  return ROLE_CHIP_ACCENT[ROLE_TONE[role] ?? "neutral"];
+}
+
 /** Seats used / limit as display copy; null limit → "Unlimited". */
 export function seatsLabel(used: number, limit: number | null): string {
   return limit === null ? `${used} · Unlimited` : `${used} / ${limit}`;
diff --git a/frontend/editor/src/portal/mocks/docs.ts b/frontend/editor/src/portal/mocks/docs.ts
index 18a1084c06..2b54d0c17c 100644
--- a/frontend/editor/src/portal/mocks/docs.ts
+++ b/frontend/editor/src/portal/mocks/docs.ts
@@ -17,6 +17,7 @@
  * fixtures can be deleted (or kept as test seeds).
  */
 
+import type { CardAccent } from "@app/ui";
 import type { Tier } from "@portal/contexts/TierContext";
 import type { CodeLang } from "@app/ui";
 
@@ -145,7 +146,7 @@ export interface Playbook {
   blurb: string;
   /** Ordered stages rendered as a chip flow. */
   steps: string[];
-  accent: "blue" | "purple" | "green";
+  accent: CardAccent;
 }
 
 /** A bundled, named agent capability — a deterministic op chain. */
@@ -337,28 +338,28 @@ const PLAYBOOKS: Playbook[] = [
       "Three-way match",
       "POST to ERP",
     ],
-    accent: "blue",
+    accent: "default",
   },
   {
     title: "PII redaction at scale",
     blurb:
       "Sweep a document set for PII and write redacted copies to cold storage.",
     steps: ["S3 source", "Detect PII", "Redact", "Store to bucket"],
-    accent: "purple",
+    accent: "premium",
   },
   {
     title: "Compliance evidence pack",
     blurb:
       "Bundle SOC 2 and audit reports into a verified, timestamped archive.",
     steps: ["Batch upload", "Classify", "Validate schema", "Sign & archive"],
-    accent: "green",
+    accent: "success",
   },
   {
     title: "Agent document tool",
     blurb:
       "Expose extraction as an MCP tool your agent can call deterministically.",
     steps: ["Define tool", "Bind endpoint", "Run evals", "Ship to agent"],
-    accent: "purple",
+    accent: "premium",
   },
 ];
 
diff --git a/frontend/editor/src/portal/views/AgentBuilder.tsx b/frontend/editor/src/portal/views/AgentBuilder.tsx
index cd7638ee40..efa319c146 100644
--- a/frontend/editor/src/portal/views/AgentBuilder.tsx
+++ b/frontend/editor/src/portal/views/AgentBuilder.tsx
@@ -41,7 +41,7 @@ export function AgentBuilder() {
         </div>
         <Button
           onClick={() => setBootstrapOpen(true)}
-          leadingIcon={<span aria-hidden>⇪</span>}
+          leftSection={<span aria-hidden>⇪</span>}
         >
           {t("portal.agentBuilder.bootstrapFromDocument")}
         </Button>
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index 92d7f69318..fef96810e1 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -38,7 +38,7 @@ import "@portal/views/Home.css";
 /* ──────────────────────────────────────────────────────────────────────── */
 
 interface ProductCardProps {
-  accent: "blue" | "purple";
+  accent: "default" | "premium";
   badge?: string;
   title: string;
   blurb: string;
@@ -60,18 +60,21 @@ function ProductCard({
       <div className="portal-home__product-head">
         <h3 className="portal-home__product-title">{title}</h3>
         {badge && (
-          <StatusBadge tone={accent === "blue" ? "info" : "purple"} size="sm">
+          <StatusBadge
+            tone={accent === "default" ? "info" : "purple"}
+            size="sm"
+          >
             {badge}
           </StatusBadge>
         )}
       </div>
       <p className="portal-home__product-blurb">{blurb}</p>
       <Button
-        variant="outline"
+        variant="secondary"
         accent={accent}
         size="sm"
         onClick={() => setActiveView(target)}
-        trailingIcon={<span aria-hidden>→</span>}
+        rightSection={<span aria-hidden>→</span>}
       >
         {cta}
       </Button>
@@ -87,14 +90,14 @@ function ProductGrid() {
       aria-label={t("portal.home.productGrid.ariaLabel")}
     >
       <ProductCard
-        accent="purple"
+        accent="premium"
         title={t("portal.home.productGrid.sources.title")}
         blurb={t("portal.home.productGrid.sources.blurb")}
         cta={t("portal.home.productGrid.sources.cta")}
         target="sources"
       />
       <ProductCard
-        accent="blue"
+        accent="default"
         badge={t("portal.home.productGrid.pipelines.badge")}
         title={t("portal.home.productGrid.pipelines.title")}
         blurb={t("portal.home.productGrid.pipelines.blurb")}
@@ -102,7 +105,7 @@ function ProductGrid() {
         target="pipelines"
       />
       <ProductCard
-        accent="purple"
+        accent="premium"
         title={t("portal.home.productGrid.agents.title")}
         blurb={t("portal.home.productGrid.agents.blurb")}
         cta={t("portal.home.productGrid.agents.cta")}
@@ -130,7 +133,8 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
         </span>
       </div>
       <div className="portal-home__quick-list">
-        <button
+        <Button
+          variant="quiet"
           type="button"
           className="portal-home__quick-row"
           onClick={onTryOp}
@@ -152,8 +156,9 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
           <span className="portal-home__quick-arrow" aria-hidden>
             →
           </span>
-        </button>
-        <button
+        </Button>
+        <Button
+          variant="quiet"
           type="button"
           className="portal-home__quick-row"
           onClick={() => setActiveView("pipelines")}
@@ -175,8 +180,9 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
           <span className="portal-home__quick-arrow" aria-hidden>
             →
           </span>
-        </button>
-        <button
+        </Button>
+        <Button
+          variant="quiet"
           type="button"
           className="portal-home__quick-row"
           onClick={() => setActiveView("sources")}
@@ -198,8 +204,9 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
           <span className="portal-home__quick-arrow" aria-hidden>
             →
           </span>
-        </button>
-        <button
+        </Button>
+        <Button
+          variant="quiet"
           type="button"
           className="portal-home__quick-row"
           onClick={() => setActiveView("infrastructure")}
@@ -221,7 +228,7 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
           <span className="portal-home__quick-arrow" aria-hidden>
             →
           </span>
-        </button>
+        </Button>
       </div>
     </Card>
   );
@@ -243,7 +250,7 @@ function FreeOnboarding({ onTryOp }: { onTryOp: () => void }) {
   function renderCta(step: OnboardingStep) {
     if (step.done) {
       return (
-        <Button size="sm" variant="ghost" onClick={onTryOp}>
+        <Button size="sm" variant="tertiary" onClick={onTryOp}>
           {t("portal.home.onboarding.runAgain")}
         </Button>
       );
@@ -251,7 +258,7 @@ function FreeOnboarding({ onTryOp }: { onTryOp: () => void }) {
     if (!step.cta) return null;
     if (step.cta.kind === "try-op") {
       return (
-        <Button size="sm" variant="outline" onClick={onTryOp}>
+        <Button size="sm" variant="secondary" onClick={onTryOp}>
           {t("portal.home.onboarding.start")}
         </Button>
       );
@@ -260,7 +267,7 @@ function FreeOnboarding({ onTryOp }: { onTryOp: () => void }) {
     return (
       <Button
         size="sm"
-        variant="outline"
+        variant="secondary"
         onClick={() => setActiveView(target as ViewId)}
       >
         {t("portal.home.onboarding.start")}
diff --git a/frontend/editor/src/portal/views/Infrastructure.tsx b/frontend/editor/src/portal/views/Infrastructure.tsx
index eebea50483..bc0920382c 100644
--- a/frontend/editor/src/portal/views/Infrastructure.tsx
+++ b/frontend/editor/src/portal/views/Infrastructure.tsx
@@ -44,7 +44,7 @@ export function Infrastructure() {
           </p>
         </div>
         <Button
-          variant="outline"
+          variant="secondary"
           size="sm"
           onClick={() => setActiveView("editor")}
         >
diff --git a/frontend/editor/src/portal/views/Pipelines.test.tsx b/frontend/editor/src/portal/views/Pipelines.test.tsx
index 6b69d8ca33..ece7a2d87e 100644
--- a/frontend/editor/src/portal/views/Pipelines.test.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.test.tsx
@@ -1,7 +1,18 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
 import { MemoryRouter } from "react-router-dom";
 import { HttpError } from "@portal/api/http";
+
+const render = (
+  ui: Parameters<typeof baseRender>[0],
+  options?: Parameters<typeof baseRender>[1],
+) => baseRender(ui, { wrapper: MantineProvider, ...options });
 import type { PipelinesOverviewResponse, Policy } from "@portal/api/pipelines";
 import type { SourcesResponse } from "@portal/api/sources";
 import { Pipelines } from "@portal/views/Pipelines";
diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index d87e697446..8781778ced 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -114,7 +114,7 @@ export function Pipelines() {
             {t("portal.pipelines.subtitle")}
           </p>
         </div>
-        <Button onClick={openCreate} leadingIcon={<span aria-hidden>+</span>}>
+        <Button onClick={openCreate} leftSection={<span aria-hidden>+</span>}>
           {t("portal.pipelines.actions.newPipeline")}
         </Button>
       </header>
@@ -179,7 +179,7 @@ export function Pipelines() {
         footer={
           <div className="portal-pipelines__composer-footer">
             <Button
-              variant="ghost"
+              variant="tertiary"
               size="sm"
               disabled={deleting}
               onClick={() => setPendingDelete(null)}
@@ -188,7 +188,7 @@ export function Pipelines() {
             </Button>
             <Button
               size="sm"
-              accent="red"
+              accent="danger"
               loading={deleting}
               onClick={confirmDelete}
             >
diff --git a/frontend/editor/src/portal/views/Policies.css b/frontend/editor/src/portal/views/Policies.css
index 5744b2ff42..6bad9365c5 100644
--- a/frontend/editor/src/portal/views/Policies.css
+++ b/frontend/editor/src/portal/views/Policies.css
@@ -36,6 +36,31 @@
   gap: 0.375rem;
 }
 
+/* Category row — locked (coming soon) */
+.portal-policies__row {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.25rem 0.75rem;
+  min-height: 2.25rem;
+}
+
+.portal-policies__row-name {
+  flex: 1;
+  font-size: 0.9375rem;
+  font-weight: 600;
+  color: var(--color-text-3);
+}
+
+/* "Set up" underline link inside the active-row button's rightSection */
+.portal-policies__setup-link {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-blue);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
 /* Category card — horizontal table row */
 .portal-policies__card {
   display: flex;
@@ -109,6 +134,55 @@
   color: var(--color-text-1);
 }
 
+.portal-policies__card-blurb {
+  font-size: 0.75rem;
+  color: var(--color-text-4);
+  line-height: 1.4;
+}
+
+.portal-policies__card-summary {
+  margin: 0;
+  font-size: 0.8125rem;
+  line-height: 1.5;
+  color: var(--color-text-2);
+}
+
+.portal-policies__card-foot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+  margin-top: auto;
+  flex-wrap: wrap;
+}
+
+.portal-policies__card-rules {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.375rem;
+}
+
+.portal-policies__card-cta {
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--color-blue);
+}
+
+.portal-policies__chevron-right {
+  transform: rotate(-90deg);
+  display: block;
+}
+
+/* Configured-card stat footer */
+.portal-policies__card-stats {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 0.5rem;
+  margin-top: auto;
+  padding-top: 0.75rem;
+  border-top: 1px solid var(--color-border-light);
+}
+
 /* Wizard + detail shared chrome */
 .portal-policies__wizard-title {
   display: inline-flex;
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index d0c4e05d49..609f7b2bfc 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -133,7 +133,7 @@ export function Policies() {
           title={t("portal.policies.offline.title")}
           description={t("portal.policies.offline.description")}
           action={
-            <Button variant="outline" size="sm" onClick={refetch}>
+            <Button variant="secondary" size="sm" onClick={refetch}>
               {t("portal.policies.offline.retry")}
             </Button>
           }
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index d265a17135..d8cc6897af 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -74,23 +74,23 @@
   background: var(--color-bg-subtle);
   color: var(--color-text-3);
 }
-.portal-sources__type-dot--blue {
+.portal-sources__type-dot--default {
   background: var(--color-blue-light);
   color: var(--color-blue);
 }
-.portal-sources__type-dot--purple {
+.portal-sources__type-dot--premium {
   background: var(--color-purple-light);
   color: var(--color-purple);
 }
-.portal-sources__type-dot--green {
+.portal-sources__type-dot--success {
   background: var(--color-green-light);
   color: var(--color-green-dark);
 }
-.portal-sources__type-dot--amber {
+.portal-sources__type-dot--warning {
   background: var(--color-amber-light);
   color: var(--color-amber-dark);
 }
-.portal-sources__type-dot--red {
+.portal-sources__type-dot--danger {
   background: var(--color-red-light);
   color: var(--color-red);
 }
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index a68399d588..7226c2e017 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -1,7 +1,18 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
 import { MemoryRouter } from "react-router-dom";
 import { HttpError } from "@portal/api/http";
+
+const render = (
+  ui: Parameters<typeof baseRender>[0],
+  options?: Parameters<typeof baseRender>[1],
+) => baseRender(ui, { wrapper: MantineProvider, ...options });
 import type { SourcesResponse } from "@portal/api/sources";
 import { Sources } from "@portal/views/Sources";
 
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index b44eacb2ec..91191805ab 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -127,13 +127,13 @@ export function Sources() {
         </div>
         <div className="portal-sources__actions">
           <Button
-            variant="outline"
+            variant="secondary"
             onClick={() => setActiveView("agent-builder")}
-            leadingIcon={<AgentBuilderIcon size={16} />}
+            leftSection={<AgentBuilderIcon size={16} />}
           >
             {t("portal.sources.actions.agentBuilder")}
           </Button>
-          <Button onClick={openCreate} leadingIcon={<span aria-hidden>+</span>}>
+          <Button onClick={openCreate} leftSection={<span aria-hidden>+</span>}>
             {t("portal.sources.actions.connectSource")}
           </Button>
         </div>
@@ -200,7 +200,7 @@ export function Sources() {
         footer={
           <div className="portal-sources__wizard-footer">
             <Button
-              variant="ghost"
+              variant="tertiary"
               size="sm"
               disabled={deleting}
               onClick={() => setPendingDelete(null)}
@@ -209,7 +209,7 @@ export function Sources() {
             </Button>
             <Button
               size="sm"
-              accent="red"
+              accent="danger"
               loading={deleting}
               onClick={confirmDelete}
             >
diff --git a/frontend/editor/src/portal/views/Usage.tsx b/frontend/editor/src/portal/views/Usage.tsx
index d1f6ede78a..4a4493aa2c 100644
--- a/frontend/editor/src/portal/views/Usage.tsx
+++ b/frontend/editor/src/portal/views/Usage.tsx
@@ -181,7 +181,7 @@ export function Usage() {
           </div>
           {wallet?.status === "subscribed" && (
             <Button
-              variant="outline"
+              variant="secondary"
               size="sm"
               loading={portal.opening}
               onClick={portal.open}
diff --git a/frontend/editor/src/portal/views/Users.tsx b/frontend/editor/src/portal/views/Users.tsx
index 4337436b8e..7d210e9831 100644
--- a/frontend/editor/src/portal/views/Users.tsx
+++ b/frontend/editor/src/portal/views/Users.tsx
@@ -64,7 +64,7 @@ export function Users() {
         </div>
         <Button
           onClick={() => setInviteOpen(true)}
-          leadingIcon={<span aria-hidden>+</span>}
+          leftSection={<span aria-hidden>+</span>}
         >
           {t("portal.common.inviteMember")}
         </Button>
diff --git a/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
index 7fa97ecc09..08236c12c4 100644
--- a/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import "@app/auth/ui/auth.css";
-import { TextInput, PasswordInput, Button } from "@mantine/core";
+import { TextInput, PasswordInput } from "@mantine/core";
 
 // Force light mode styles for auth inputs
 const authInputStyles = {
@@ -128,18 +129,11 @@ export default function EmailPasswordForm({
           (showPasswordField && !password) ||
           (requiresMfa && !mfaCode.trim())
         }
-        className="auth-button"
         fullWidth
         loading={isSubmitting}
-        styles={{
-          // Own the brand colour inline so the host app's Mantine primaryColor
-          // can't win over .auth-button (editor vs portal Mantine themes
-          // differ). The fallback keeps it red even if auth-theme.css is absent.
-          root: {
-            backgroundColor: "var(--auth-button-bg-light-only, #af3434)",
-            color: "var(--auth-button-text-light-only, #ffffff)",
-          },
-        }}
+        // Stirling-red brand CTA; the brand accent sets the colour inline so the
+        // host app's Mantine primaryColor can't win (editor vs portal differ).
+        accent="brand"
       >
         {submitButtonText}
       </Button>
diff --git a/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx b/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
index 7a2d76d129..f6ad17ec7e 100644
--- a/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
@@ -1,4 +1,5 @@
 import { memo, useEffect, useMemo, useRef, useState } from "react";
+import { Button } from "@app/ui/Button";
 import bgDefault from "@app/assets/login/LoginBackgroundPanel.png";
 
 export type ImageSlide = {
@@ -208,13 +209,14 @@ function LoginRightCarousel({
         }}
       >
         {Array.from({ length: totalSlides }).map((_, i) => (
-          <button
+          <Button
             key={i}
+            variant="tertiary"
             aria-label={`Go to slide ${i + 1}`}
             onClick={() => setIndex(i)}
             style={{
-              width: "10px",
-              height: "12px",
+              width: "5px",
+              height: "5px",
               borderRadius: "50%",
               border: "none",
               cursor: "pointer",
@@ -223,6 +225,9 @@ function LoginRightCarousel({
               boxShadow: "0 2px 6px rgba(0,0,0,0.25)",
               display: "block",
               flexShrink: 0,
+              padding: 0,
+              minWidth: 0,
+              minHeight: 0,
             }}
           />
         ))}
diff --git a/frontend/editor/src/proprietary/auth/ui/OAuthButtons.tsx b/frontend/editor/src/proprietary/auth/ui/OAuthButtons.tsx
index ad1a3b82f7..3644ed91bc 100644
--- a/frontend/editor/src/proprietary/auth/ui/OAuthButtons.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/OAuthButtons.tsx
@@ -1,6 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { type OAuthProvider } from "@app/auth/spring/oauthTypes";
-import { Button } from "@mantine/core";
+import { Button as DSButton } from "@app/ui/Button";
 import { oauthIconUrl, GENERIC_PROVIDER_ICON } from "@app/auth/ui/oauthIcons";
 
 // Debug flag to show all providers for UI testing
@@ -107,58 +107,24 @@ export default function OAuthButtons({
             key={p.id}
             title={`${t("login.signInWith", "Sign in with")} ${p.label}`}
           >
-            <Button
+            <DSButton
               onClick={() => onProviderClick(p.id)}
               disabled={isSubmitting}
               className="oauth-button-icon"
               aria-label={`${t("login.signInWith", "Sign in with")} ${p.label}`}
-              variant="default"
+              variant="tertiary"
             >
               <img
                 src={oauthIconUrl(p.file)}
                 alt={p.label}
                 className="oauth-icon-small"
               />
-            </Button>
+            </DSButton>
           </div>
         ))}
       </div>
     );
   }
-
-  if (layout === "fullwidth") {
-    // Mirrors the SaaS editor login: rounded pill buttons stacked vertically,
-    // each with the provider's icon + "Sign in with X" label.
-    return (
-      <div className="oauth-container-fullwidth">
-        {providers.map((p) => (
-          <button
-            key={p.id}
-            type="button"
-            onClick={() => onProviderClick(p.id)}
-            disabled={isSubmitting}
-            className="oauth-button-fullwidth"
-            title={p.label}
-            aria-label={`${ctaPrefix ?? ""}${p.label}`}
-          >
-            <span className="oauth-btn-group">
-              <img
-                src={oauthIconUrl(p.file)}
-                alt={p.label}
-                className="oauth-icon-medium"
-                style={{ marginRight: "0.5rem", flexShrink: 0 }}
-              />
-              <span className="oauth-btn-label">
-                {ctaPrefix ?? ""}
-                {p.label}
-              </span>
-            </span>
-          </button>
-        ))}
-      </div>
-    );
-  }
-
   if (layout === "grid") {
     return (
       <div className="oauth-container-grid">
@@ -167,24 +133,55 @@ export default function OAuthButtons({
             key={p.id}
             title={`${t("login.signInWith", "Sign in with")} ${p.label}`}
           >
-            <Button
+            <DSButton
               onClick={() => onProviderClick(p.id)}
               disabled={isSubmitting}
               className="oauth-button-grid"
               aria-label={`${t("login.signInWith", "Sign in with")} ${p.label}`}
-              variant="default"
+              variant="tertiary"
             >
               <img
                 src={oauthIconUrl(p.file)}
                 alt={p.label}
                 className="oauth-icon-medium"
               />
-            </Button>
+            </DSButton>
           </div>
         ))}
       </div>
     );
   }
+  if (layout === "fullwidth") {
+    // Mirrors the SaaS editor login: rounded pill buttons stacked vertically,
+    // each with the provider's icon + "Sign in with X" label.
+    return (
+      <div className="oauth-container-fullwidth">
+        {providers.map((p) => (
+          <DSButton
+            key={p.id}
+            variant="secondary"
+            onClick={() => onProviderClick(p.id)}
+            disabled={isSubmitting}
+            className="oauth-button-fullwidth"
+            title={p.label}
+            aria-label={ctaPrefix ? `${ctaPrefix} ${p.label}` : p.label}
+          >
+            <span className="oauth-btn-group">
+              <img
+                src={oauthIconUrl(p.file)}
+                alt={p.label}
+                className={`oauth-icon-medium oauth-icon--${p.providerId}`}
+                style={{ marginRight: "0.5rem", flexShrink: 0 }}
+              />
+              <span className="oauth-btn-label">
+                {ctaPrefix ? `${ctaPrefix} ${p.label}` : p.label}
+              </span>
+            </span>
+          </DSButton>
+        ))}
+      </div>
+    );
+  }
 
   return (
     <div
@@ -195,12 +192,12 @@ export default function OAuthButtons({
           key={p.id}
           title={`${t("login.signInWith", "Sign in with")} ${p.label}`}
         >
-          <Button
+          <DSButton
             onClick={() => onProviderClick(p.id)}
             disabled={!demoMode && isSubmitting}
             className={`oauth-button-vertical${useNewStyle && isSingleProvider ? " oauth-button-vertical-single" : ""}${!useNewStyle ? " oauth-button-vertical-legacy" : ""}${isTinted ? " oauth-button-vertical-tinted" : ""}${isOutline ? " oauth-button-vertical-outline" : ""}${isLight ? " oauth-button-vertical-light" : ""}`}
             aria-label={`${t("login.signInWith", "Sign in with")} ${p.label}`}
-            variant="default"
+            variant="tertiary"
             style={
               isTinted
                 ? ({
@@ -238,7 +235,7 @@ export default function OAuthButtons({
                 </svg>
               </span>
             )}
-          </Button>
+          </DSButton>
         </div>
       ))}
     </div>
diff --git a/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
index f6c616fd77..ca8deb3c32 100644
--- a/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
@@ -102,11 +102,10 @@ export default function SpringLoginForm({
         <OAuthButtons
           onProviderClick={signInWithProvider}
           isSubmitting={isSubmitting}
-          layout="vertical"
+          layout="fullwidth"
           enabledProviders={providers}
-          ctaPrefix={oauthCtaPrefix}
+          ctaPrefix={oauthCtaPrefix ?? "Continue with"}
           useNewStyle={oauthUseNewStyle}
-          styleVariant="light"
         />
       )}
 
diff --git a/frontend/editor/src/proprietary/auth/ui/auth-theme.css b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
index 79c7ec6acd..f62691f518 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth-theme.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
@@ -39,8 +39,8 @@
   --auth-magic-button-text-light-only: var(--text-primary);
   --auth-text-primary-light-only: var(--text-primary);
   --auth-text-secondary-light-only: var(--text-secondary);
-  --text-divider-rule-rgb-light: 58, 64, 71;
-  --text-divider-label-rgb-light: 107, 114, 128;
+  --text-divider-rule-rgb-light: 28, 35, 64;
+  --text-divider-label-rgb-light: 91, 98, 128;
   --tool-subcategory-rule-color-light: var(--border-default);
   --tool-subcategory-text-color-light: var(--text-secondary);
 }
diff --git a/frontend/editor/src/proprietary/auth/ui/auth.css b/frontend/editor/src/proprietary/auth/ui/auth.css
index 3fce26f7ce..249d6cdda5 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth.css
@@ -707,6 +707,61 @@
   min-height: 0;
 }
 
+.oauth-container-fullwidth {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.oauth-button-fullwidth {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.75rem 1rem;
+  border: 1px solid #d1d5db;
+  border-radius: 100px;
+  background-color: #ffffff;
+  font-size: 1rem;
+  font-weight: 600;
+  color: #000000;
+  cursor: pointer;
+  gap: 0.5rem;
+  box-shadow: 0 0.125rem 0.375rem rgba(0, 0, 0, 0.04);
+  transition:
+    background-color 150ms ease,
+    box-shadow 150ms ease,
+    border-color 150ms ease;
+}
+
+.oauth-button-fullwidth:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
+.oauth-button-fullwidth:hover:not(:disabled) {
+  background-color: #fafafa;
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
+}
+
+[data-mantine-color-scheme="dark"] .oauth-button-fullwidth {
+  background-color: var(--bg-surface);
+  color: var(--text-primary);
+  border-color: var(--border-default);
+  box-shadow: none;
+}
+
+[data-mantine-color-scheme="dark"]
+  .oauth-button-fullwidth:hover:not(:disabled) {
+  background-color: var(--bg-raised);
+  box-shadow: none;
+}
+
+/* ── Dark-mode icon inversion for monochrome OAuth logos ────────────── */
+[data-mantine-color-scheme="dark"] .oauth-icon--github {
+  filter: invert(1);
+}
+
 /* ── Icon+label group — keeps icons vertically aligned across buttons ── */
 .oauth-btn-group {
   display: inline-flex;
diff --git a/frontend/editor/src/proprietary/billing/SpendCapControl.tsx b/frontend/editor/src/proprietary/billing/SpendCapControl.tsx
index c5589133f3..d6c267a099 100644
--- a/frontend/editor/src/proprietary/billing/SpendCapControl.tsx
+++ b/frontend/editor/src/proprietary/billing/SpendCapControl.tsx
@@ -123,8 +123,9 @@ export function SpendCapControl({
     <div className="scc">
       <div className="scc-row">
         {presets.map((preset) => (
-          <button
+          <Button
             key={preset}
+            variant="quiet"
             type="button"
             className="scc-chip"
             data-selected={capUsd === preset ? "true" : "false"}
@@ -133,7 +134,7 @@ export function SpendCapControl({
           >
             {sym}
             {preset.toLocaleString()}
-          </button>
+          </Button>
         ))}
 
         <label
@@ -154,7 +155,8 @@ export function SpendCapControl({
           />
         </label>
 
-        <button
+        <Button
+          variant="quiet"
           type="button"
           className={`scc-chip${onSave ? "" : " scc-row__spacer"}`}
           data-selected={isNoCap ? "true" : "false"}
@@ -162,12 +164,12 @@ export function SpendCapControl({
           disabled={busy}
         >
           {L.noCap}
-        </button>
+        </Button>
 
         {onSave && (
           <div className="scc-row__spacer">
             <Button
-              variant="outline"
+              variant="secondary"
               size="sm"
               loading={saving}
               disabled={!dirty || busy}
diff --git a/frontend/editor/src/proprietary/components/chat/ChatFAB.css b/frontend/editor/src/proprietary/components/chat/ChatFAB.css
index efa55ea67c..01e713429a 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatFAB.css
+++ b/frontend/editor/src/proprietary/components/chat/ChatFAB.css
@@ -7,6 +7,14 @@
   overflow: hidden;
 }
 
+/* Bounds element — inset by FAB_GAP_PX, used as react-rnd drag+resize limit ── */
+
+.chat-fab-bounds {
+  position: absolute;
+  inset: 16px;
+  pointer-events: none;
+}
+
 /* FAB trigger button ─────────────────────────────────────────────────────── */
 
 .chat-fab-trigger {
diff --git a/frontend/editor/src/proprietary/components/chat/ChatFAB.tsx b/frontend/editor/src/proprietary/components/chat/ChatFAB.tsx
index 06674d811f..490a7784cb 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatFAB.tsx
+++ b/frontend/editor/src/proprietary/components/chat/ChatFAB.tsx
@@ -1,4 +1,10 @@
-import { useEffect, useLayoutEffect, useRef, useState } from "react";
+import {
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+  useCallback,
+} from "react";
 import {
   createTheme,
   MantineProvider,
@@ -68,6 +74,13 @@ export function ChatFAB() {
   }, [isLoading]);
 
   const overlayRef = useRef<HTMLDivElement>(null);
+  // Separate bounds element inset by FAB_GAP_PX — react-rnd enforces this
+  // during both drag and resize, keeping the panel off the overlay edges.
+  const [boundsEl, setBoundsEl] = useState<HTMLDivElement | null>(null);
+  const boundsRef = useCallback(
+    (el: HTMLDivElement | null) => setBoundsEl(el),
+    [],
+  );
   const [rndPos, setRndPos] = useState<{ x: number; y: number } | null>(null);
   const [rndSize, setRndSize] = useState({
     width: PANEL_WIDTH_PX,
@@ -102,8 +115,7 @@ export function ChatFAB() {
     const pos = getDefaultPos();
     if (pos) setRndPos(pos);
   }, [enabled]);
-
-  // bounds="parent" only clamps during active drag/resize; ResizeObserver keeps position valid when the overlay changes size.
+  // ResizeObserver keeps position valid when the overlay changes size (e.g. window resize, sidebar toggle).
   useEffect(() => {
     if (!enabled) return;
     const el = overlayRef.current;
@@ -170,6 +182,8 @@ export function ChatFAB() {
       className="chat-fab-overlay"
       style={{ zIndex: Z_INDEX_CHAT_FAB_OVERLAY }}
     >
+      {/* Inset boundary element — react-rnd uses this to constrain drag+resize */}
+      <div ref={boundsRef} className="chat-fab-bounds" />
       {/* Trigger button — fades out while panel is open */}
       <ChatFABButton
         className={`chat-fab-trigger${isOpen ? " chat-fab-trigger--hidden" : ""}`}
@@ -185,19 +199,19 @@ export function ChatFAB() {
         }}
         aria-label={t("chat.fab.open", "Open Stirling AI assistant")}
         aria-expanded={isOpen}
-        isLoading={isLoading}
+        loading={isLoading}
         showTick={hasUnviewedResult && !isLoading}
       />
 
       {/* Draggable / resizable panel */}
-      {rndPos !== null && (
+      {rndPos !== null && boundsEl !== null && (
         <Rnd
           className="chat-fab-panel-rnd"
           position={rndPos}
           size={rndSize}
           minWidth={PANEL_MIN_WIDTH_PX}
           minHeight={PANEL_MIN_HEIGHT_PX}
-          bounds="parent"
+          bounds={boundsEl}
           enableResizing={true}
           // Drag from the header; cancel keeps buttons inside it clickable
           dragHandleClassName="chat-panel__header"
diff --git a/frontend/editor/src/proprietary/components/chat/ChatPanel.css b/frontend/editor/src/proprietary/components/chat/ChatPanel.css
index 19b6cdbfc0..58c3ea4619 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatPanel.css
+++ b/frontend/editor/src/proprietary/components/chat/ChatPanel.css
@@ -25,7 +25,22 @@
   flex-shrink: 0;
 }
 
-.chat-panel__agent-pill-vt {
+.chat-panel__agent-pill {
+  display: inline-flex;
+  gap: 0.5rem;
+  flex: 1;
+  min-width: 0;
+  padding: 0.4rem 0.75rem 0.4rem 0.4rem;
+  border: 1px solid var(--border-subtle);
+  border-radius: 9999px;
+  background: var(--mantine-color-body);
+  cursor: pointer;
+  transition:
+    background 120ms ease-out,
+    border-color 120ms ease-out;
+}
+
+.chat-fab-window--open .chat-panel__agent-pill {
   view-transition-name: stirling-agent;
 }
 
@@ -37,6 +52,96 @@
   animation-timing-function: cubic-bezier(0.32, 0.72, 0, 1);
 }
 
+.chat-panel__agent-pill:hover {
+  background: var(--mantine-color-default-hover);
+}
+
+.chat-panel__agent-pill-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  border-radius: 9999px;
+  background: var(--mantine-color-blue-light);
+  color: var(--mantine-color-blue-filled);
+  flex-shrink: 0;
+  position: relative;
+}
+
+/* Running / in-progress status dot, anchored to the agent pill icon. */
+.agent-status-dot {
+  position: absolute;
+  bottom: 0;
+  right: 0;
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--mantine-color-blue-5);
+  border: 1.5px solid var(--mantine-color-body);
+  animation: agent-dot-pulse 2.4s ease-in-out infinite;
+  pointer-events: none;
+}
+
+@keyframes agent-dot-pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.45;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .agent-status-dot {
+    animation: none;
+  }
+}
+
+.chat-panel__agent-pill--loading {
+  border-color: color-mix(
+    in srgb,
+    var(--mantine-color-blue-5) 60%,
+    var(--border-subtle)
+  );
+}
+
+[data-mantine-color-scheme="dark"] .chat-panel__agent-pill--loading {
+  border-color: color-mix(
+    in srgb,
+    var(--mantine-color-blue-4) 55%,
+    var(--border-subtle)
+  );
+}
+
+/* Dark-mode: let the pill blend into the rail. Just a thin border, no fill —
+   so it doesn't read as a clashing lighter card on the dark toolbar. */
+[data-mantine-color-scheme="dark"] .chat-panel__agent-pill {
+  background: transparent;
+  border-color: var(--border-subtle);
+}
+
+/* The default tertiary accent is blue — use the surface text colour instead so
+   the pill label and close icon don't look like interactive links. Overrides
+   the Mantine button colour var the shared Button sets inline. */
+.chat-panel__header .sui-btn--tertiary {
+  --button-color: var(--text-primary) !important;
+}
+
+[data-mantine-color-scheme="dark"] .chat-panel__agent-pill:hover {
+  background: rgba(255, 255, 255, 0.04);
+}
+
+[data-mantine-color-scheme="dark"] .chat-panel__agent-pill-icon {
+  background: color-mix(
+    in srgb,
+    var(--mantine-color-blue-filled) 18%,
+    transparent
+  );
+  color: var(--mantine-color-blue-3, var(--mantine-color-blue-filled));
+}
+
 /* Same treatment for the input pill and quick-action cards. */
 [data-mantine-color-scheme="dark"] .chat-panel-input {
   background: transparent;
diff --git a/frontend/editor/src/proprietary/components/chat/ChatPanel.tsx b/frontend/editor/src/proprietary/components/chat/ChatPanel.tsx
index 18ff7c50ec..d0ff7e19e3 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatPanel.tsx
+++ b/frontend/editor/src/proprietary/components/chat/ChatPanel.tsx
@@ -10,7 +10,6 @@ import { renderMarkdown } from "@app/components/viewer/nonpdf/MarkdownRenderer";
 import { TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
 import {
-  ActionIcon,
   Box,
   Collapse,
   Group,
@@ -19,8 +18,9 @@ import {
   Stack,
   Text,
   Textarea,
-  UnstyledButton,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import ArrowUpwardIcon from "@mui/icons-material/ArrowUpward";
 import ArticleOutlinedIcon from "@mui/icons-material/ArticleOutlined";
 import BuildOutlinedIcon from "@mui/icons-material/BuildOutlined";
@@ -266,7 +266,10 @@ function CompletedProgressLogDropdown({
 
   return (
     <div className="chat-completed-log">
-      <UnstyledButton
+      <Button
+        type="button"
+        variant="tertiary"
+        hover={false}
         className="chat-completed-log__toggle"
         onClick={() => setExpanded((v) => !v)}
         aria-expanded={expanded}
@@ -281,7 +284,7 @@ function CompletedProgressLogDropdown({
             {label}
           </Text>
         </Group>
-      </UnstyledButton>
+      </Button>
       <Collapse in={expanded}>
         <ol className="chat-completed-log__tools">
           {toolSteps.map((step, i) => {
@@ -333,14 +336,16 @@ function ChatMessageBubble({
 
   const actions = (
     <div className="chat-message-actions">
-      <button
+      <ActionIcon
         type="button"
+        variant="tertiary"
         className={`chat-message-action-btn${copied ? " chat-message-action-btn--active" : ""}`}
         onClick={handleCopy}
         title={t("chat.actions.copy", "Copy message")}
+        aria-label={t("chat.actions.copy", "Copy message")}
       >
         <ContentCopyIcon sx={{ fontSize: 13 }} />
-      </button>
+      </ActionIcon>
       <span className="chat-message-timestamp">
         {formatRelativeTime(timestamp, t)}
       </span>
@@ -551,9 +556,6 @@ export function ChatPanel({ onBack, backLabel }: ChatPanelProps) {
       <div className="chat-panel-input">
         <ActionIcon
           className="chat-panel-input__send"
-          variant="filled"
-          color="blue"
-          radius="xl"
           size="sm"
           onClick={() => handleSend()}
           disabled={!input.trim() || isLoading}
diff --git a/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx b/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
index 1905433037..f650c953fd 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
+++ b/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
@@ -1,6 +1,8 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Box, Group, Stack, Text, UnstyledButton } from "@mantine/core";
+import { Box, Group, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import CompressIcon from "@mui/icons-material/Compress";
 import ContentCutIcon from "@mui/icons-material/ContentCut";
@@ -26,7 +28,10 @@ interface QuickAction {
 
 function QuickActionCard({ action }: { action: QuickAction }) {
   return (
-    <UnstyledButton
+    <Button
+      type="button"
+      variant="tertiary"
+      hover={false}
       className="chat-quick-action"
       onClick={action.onClick}
       aria-label={action.title}
@@ -51,7 +56,7 @@ function QuickActionCard({ action }: { action: QuickAction }) {
           }}
         />
       </Group>
-    </UnstyledButton>
+    </Button>
   );
 }
 
@@ -81,23 +86,27 @@ function WorkbenchFilePills({
           <span className="chat-file-pill__label" title={stub.name}>
             {stub.name}
           </span>
-          <button
+          <ActionIcon
             type="button"
+            variant="tertiary"
             className="chat-file-pill__remove"
             onClick={() => onRemove(stub.id)}
             aria-label={removeLabel(stub.name)}
           >
             <CloseIcon sx={{ fontSize: 12 }} />
-          </button>
+          </ActionIcon>
         </span>
       ))}
       {overflow > 0 && (
-        <UnstyledButton
+        <Button
+          type="button"
+          variant="tertiary"
+          hover={false}
           className="chat-file-pill chat-file-pill--more"
           onClick={onOpenFilesModal}
         >
           {moreLabel(overflow)}
-        </UnstyledButton>
+        </Button>
       )}
     </div>
   );
diff --git a/frontend/editor/src/proprietary/components/policies/Policies.css b/frontend/editor/src/proprietary/components/policies/Policies.css
index 7785702a98..37b92a5830 100644
--- a/frontend/editor/src/proprietary/components/policies/Policies.css
+++ b/frontend/editor/src/proprietary/components/policies/Policies.css
@@ -178,6 +178,11 @@
   color: var(--color-text-4);
   text-decoration: none;
   white-space: nowrap;
+  cursor: pointer;
+  transition: color var(--motion-fast);
+}
+.pol-row-upgrade:hover {
+  color: var(--color-text-1);
 }
 .pol-row-upgrade:hover {
   text-decoration: underline;
diff --git a/frontend/editor/src/proprietary/components/policies/PoliciesSidebar.tsx b/frontend/editor/src/proprietary/components/policies/PoliciesSidebar.tsx
index 2a3616bafd..15b494c3f6 100644
--- a/frontend/editor/src/proprietary/components/policies/PoliciesSidebar.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PoliciesSidebar.tsx
@@ -33,6 +33,8 @@ import type {
 import type { WatchedFolder } from "@app/types/watchedFolders";
 import { POLICIES_ENABLED } from "@app/constants/featureFlags";
 import { Tooltip as AppTooltip } from "@app/components/shared/Tooltip";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { IconBadge } from "@app/ui/IconBadge";
 import {
   deriveRowStatus,
@@ -167,8 +169,9 @@ export function PoliciesSection({
           sidebarTooltip
           pinOnClick
         >
-          <button
+          <ActionIcon
             type="button"
+            variant="tertiary"
             className="pol-info-btn"
             aria-label={t(
               "policies.sidebar.infoAriaLabel",
@@ -181,7 +184,7 @@ export function PoliciesSection({
               height="1.25rem"
               style={{ color: "var(--icon-files-color)" }}
             />
-          </button>
+          </ActionIcon>
         </AppTooltip>
       </div>
 
@@ -199,26 +202,34 @@ export function PoliciesSection({
                       {t(`policies.catalog.${cat.id}`, cat.label)}
                     </span>
                     <span className="pol-row-trail">
-                      <a
-                        className="pol-row-upgrade"
-                        href="https://stirling.com/contact"
-                        target="_blank"
-                        rel="noopener noreferrer"
+                      <Button
+                        variant="tertiary"
+                        size="sm"
+                        accent="neutral"
+                        onClick={() =>
+                          window.open(
+                            "https://stirling.com/contact",
+                            "_blank",
+                            "noopener,noreferrer",
+                          )
+                        }
                       >
                         {t(
                           "policies.sidebar.upgradeToEnterprise",
                           "Upgrade to enterprise",
                         )}
-                      </a>
+                      </Button>
                     </span>
                   </div>
                 );
               }
               const status = deriveRowStatus(pol.policies[cat.id]);
               return (
-                <button
+                <Button
                   key={cat.id}
                   type="button"
+                  variant="tertiary"
+                  hover={false}
                   className="pol-row"
                   onClick={() =>
                     guestBlocked ? promptGuestSignup() : selectPolicy(cat.id)
@@ -248,7 +259,7 @@ export function PoliciesSection({
                       sx={{ fontSize: "1rem" }}
                     />
                   </span>
-                </button>
+                </Button>
               );
             })}
           </div>
@@ -508,8 +519,10 @@ export function PoliciesCollapsedButton({
               arrow
               delay={300}
             >
-              <button
+              <Button
                 type="button"
+                variant="tertiary"
+                hover={false}
                 className="pol-crail-btn"
                 data-status={status}
                 aria-label={t(
@@ -530,7 +543,7 @@ export function PoliciesCollapsedButton({
                 {(status === "active" || status === "paused") && (
                   <span className="pol-crail-dot" data-status={status} />
                 )}
-              </button>
+              </Button>
             </AppTooltip>
           );
         })}
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyDeleteConfirmModal.tsx b/frontend/editor/src/proprietary/components/policies/PolicyDeleteConfirmModal.tsx
index 0d40660d19..89d3dde57a 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyDeleteConfirmModal.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyDeleteConfirmModal.tsx
@@ -1,5 +1,6 @@
-import { Modal, Text, Button, Stack, Group } from "@mantine/core";
+import { Modal, Text, Stack, Group } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 
 interface PolicyDeleteConfirmModalProps {
   opened: boolean;
@@ -35,10 +36,10 @@ export function PolicyDeleteConfirmModal({
           )}
         </Text>
         <Group gap="sm" justify="flex-end">
-          <Button variant="outline" size="sm" onClick={onCancel}>
+          <Button variant="secondary" size="sm" onClick={onCancel}>
             {t("cancel", "Cancel")}
           </Button>
-          <Button color="red" size="sm" onClick={onConfirm}>
+          <Button accent="danger" size="sm" onClick={onConfirm}>
             {t("delete", "Delete")}
           </Button>
         </Group>
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyDetailPanel.tsx b/frontend/editor/src/proprietary/components/policies/PolicyDetailPanel.tsx
index 1193111c8a..4afcf5891c 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyDetailPanel.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyDetailPanel.tsx
@@ -84,15 +84,15 @@ function ActivityError({
       >
         {message}
       </span>
-      <button
-        type="button"
+      <Button
+        variant="tertiary"
         className="pol-activity-error__toggle"
         onClick={() => setExpanded((v) => !v)}
       >
         {expanded
           ? t("policies.detail.showLess", "Show less")
           : t("policies.detail.showMore", "Show more")}
-      </button>
+      </Button>
     </span>
   );
 }
@@ -221,7 +221,7 @@ export function PolicyDetailPanel({
                   trailing={
                     item.status === "flagged" && onRetry ? (
                       <Button
-                        variant="ghost"
+                        variant="tertiary"
                         size="sm"
                         onClick={() => onRetry(item)}
                       >
@@ -290,22 +290,22 @@ export function PolicyDetailPanel({
         <div className={`pol-footer${canDelete ? "" : " pol-footer-end"}`}>
           {canDelete && (
             <Button
-              variant="ghost"
-              accent="red"
+              variant="tertiary"
+              accent="danger"
               size="sm"
-              leadingIcon={<DeleteOutlineIcon sx={{ fontSize: "0.9rem" }} />}
+              leftSection={<DeleteOutlineIcon sx={{ fontSize: "0.9rem" }} />}
               onClick={onDelete}
               style={{ marginRight: "auto" }}
             >
               {t("delete", "Delete")}
             </Button>
           )}
-          <Button variant="outline" size="sm" onClick={onTogglePause}>
+          <Button variant="secondary" size="sm" onClick={onTogglePause}>
             {isPaused
               ? t("policies.detail.resume", "Resume")
               : t("policies.detail.pause", "Pause")}
           </Button>
-          <Button variant="gradient" size="sm" onClick={onEditSettings}>
+          <Button size="sm" onClick={onEditSettings}>
             {t("policies.detail.editSettings", "Edit Settings")}
           </Button>
         </div>
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx b/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
index 4049533290..1210b997ca 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyFieldRow.tsx
@@ -51,12 +51,7 @@ export function PolicyFieldRow({
         </div>
         <div className="pol-field-chips">
           {(field.options ?? []).map((opt) => (
-            <Chip
-              key={opt}
-              tone={selected.includes(opt) ? "blue" : "neutral"}
-              size="sm"
-              onClick={() => toggle(opt)}
-            >
+            <Chip key={opt} size="sm" onClick={() => toggle(opt)}>
               {t(`policies.fieldOption.${field.key}.${opt}`, opt)}
             </Chip>
           ))}
diff --git a/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
index abd1f6d8df..d096b8327e 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicySetupWizard.tsx
@@ -630,7 +630,7 @@ export function PolicySetupWizard({
                 )}
                 action={
                   <Button
-                    variant="ghost"
+                    variant="tertiary"
                     size="sm"
                     onClick={onSetupClassification}
                   >
@@ -656,14 +656,15 @@ export function PolicySetupWizard({
                           { count: scopeTypes.length },
                         )}
                   </span>
-                  <button
+                  <Button
+                    variant="tertiary"
                     className="pol-link"
                     onClick={() => setScopeNarrow((v) => !v)}
                   >
                     {scopeNarrow
                       ? t("policies.wizard.clear", "Clear")
                       : t("policies.wizard.edit", "Edit")}
-                  </button>
+                  </Button>
                 </div>
                 {scopeNarrow && (
                   <div className="pol-doctypes">
@@ -690,12 +691,11 @@ export function PolicySetupWizard({
       </div>
 
       <div className="pol-footer">
-        <Button variant="ghost" size="sm" onClick={back}>
+        <Button variant="tertiary" size="sm" onClick={back}>
           {step > 1 ? t("policies.wizard.back", "Back") : t("cancel", "Cancel")}
         </Button>
         {step < TOTAL_STEPS ? (
           <Button
-            variant="gradient"
             size="sm"
             style={{ marginLeft: "auto" }}
             onClick={() => setStep((s) => Math.min(TOTAL_STEPS, s + 1))}
@@ -704,7 +704,6 @@ export function PolicySetupWizard({
           </Button>
         ) : (
           <Button
-            variant="gradient"
             size="sm"
             style={{ marginLeft: "auto" }}
             onClick={submit}
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyToolConfig.tsx b/frontend/editor/src/proprietary/components/policies/PolicyToolConfig.tsx
index 78e7c1a491..591ea1386f 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyToolConfig.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyToolConfig.tsx
@@ -2,6 +2,7 @@ import { Suspense } from "react";
 import { useTranslation } from "react-i18next";
 import { Loader } from "@mantine/core";
 import { ToggleSwitch } from "@app/ui/ToggleSwitch";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Card } from "@app/ui/Card";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { Tooltip as AppTooltip } from "@app/components/shared/Tooltip";
@@ -85,8 +86,9 @@ export function PolicyToolConfig({
                   sidebarTooltip
                   pinOnClick
                 >
-                  <button
+                  <ActionIcon
                     type="button"
+                    variant="tertiary"
                     className="pol-info-btn"
                     aria-label={t(
                       "policies.toolConfig.infoAriaLabel",
@@ -100,7 +102,7 @@ export function PolicyToolConfig({
                       height="1rem"
                       style={{ color: "var(--icon-files-color)" }}
                     />
-                  </button>
+                  </ActionIcon>
                 </AppTooltip>
               )}
               <ToggleSwitch
diff --git a/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.tsx b/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.tsx
index aa116fff63..047d0be273 100644
--- a/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.tsx
+++ b/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.tsx
@@ -2,10 +2,7 @@ import { useEffect, useMemo, useState } from "react";
 import { isAxiosError } from "axios";
 import { useTranslation } from "react-i18next";
 import {
-  ActionIcon,
-  Button,
   Checkbox,
-  CloseButton,
   Group,
   Modal,
   PasswordInput,
@@ -13,6 +10,8 @@ import {
   Text,
   Tooltip,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
 import {
@@ -225,7 +224,9 @@ export default function ChangeUserPasswordModal({
       withCloseButton={false}
     >
       <div style={{ position: "relative" }}>
-        <CloseButton
+        <ActionIcon
+          aria-label={t("common.close", "Close")}
+          variant="tertiary"
           onClick={handleClose}
           size="lg"
           disabled={processing}
@@ -235,7 +236,9 @@ export default function ChangeUserPasswordModal({
             right: -8,
             zIndex: 1,
           }}
-        />
+        >
+          <LocalIcon icon="close-rounded" />
+        </ActionIcon>
         <Stack gap="lg" pt="md">
           <Stack gap="md" align="center">
             <LocalIcon
@@ -338,9 +341,12 @@ export default function ChangeUserPasswordModal({
                     )}
                   >
                     <ActionIcon
+                      aria-label={t(
+                        "workspace.people.changePassword.copyTooltip",
+                        "Copy to clipboard",
+                      )}
                       size="sm"
-                      variant="subtle"
-                      color="gray"
+                      variant="tertiary"
                       onClick={handleCopyPassword}
                       disabled={processing}
                     >
@@ -425,7 +431,7 @@ export default function ChangeUserPasswordModal({
             fullWidth
             size="md"
             disabled={disabled}
-            mt="md"
+            style={{ marginTop: "var(--mantine-spacing-md)" }}
           >
             {t("workspace.people.changePassword.submit", "Update password")}
           </Button>
diff --git a/frontend/editor/src/proprietary/components/shared/InviteMembersModal.tsx b/frontend/editor/src/proprietary/components/shared/InviteMembersModal.tsx
index 6e2f503fa3..e57f60395f 100644
--- a/frontend/editor/src/proprietary/components/shared/InviteMembersModal.tsx
+++ b/frontend/editor/src/proprietary/components/shared/InviteMembersModal.tsx
@@ -5,18 +5,18 @@ import {
   Modal,
   Stack,
   Text,
-  Button,
   TextInput,
   Select,
   Paper,
   Checkbox,
   Textarea,
-  SegmentedControl,
   Tooltip,
-  CloseButton,
   Box,
   Group,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
 import { userManagementService } from "@app/services/userManagementService";
@@ -362,7 +362,9 @@ export default function InviteMembersModal({
       withCloseButton={false}
     >
       <Box pos="relative">
-        <CloseButton
+        <ActionIcon
+          aria-label={t("common.close", "Close")}
+          variant="tertiary"
           onClick={handleClose}
           size="lg"
           style={{
@@ -371,7 +373,9 @@ export default function InviteMembersModal({
             right: -8,
             zIndex: 1,
           }}
-        />
+        >
+          <LocalIcon icon="close-rounded" />
+        </ActionIcon>
         <Stack gap="lg" pt="md">
           {/* Header with Icon */}
           <Stack gap="md" align="center">
@@ -421,7 +425,11 @@ export default function InviteMembersModal({
                     </Text>
                   </Group>
                   {licenseInfo.availableSlots === 0 && (
-                    <Button size="xs" variant="light" onClick={handleGoToPlan}>
+                    <Button
+                      size="sm"
+                      variant="secondary"
+                      onClick={handleGoToPlan}
+                    >
                       {t("workspace.people.actions.upgrade", "Upgrade")}
                     </Button>
                   )}
@@ -455,7 +463,7 @@ export default function InviteMembersModal({
                   setInviteMode(value as "email" | "direct" | "link");
                   setGeneratedInviteLink(null);
                 }}
-                data={[
+                options={[
                   {
                     label: t(
                       "workspace.people.inviteMode.username",
@@ -587,7 +595,7 @@ export default function InviteMembersModal({
                         style={{ flex: 1 }}
                       />
                       <Button
-                        variant="light"
+                        variant="secondary"
                         onClick={async () => {
                           try {
                             await navigator.clipboard.writeText(
@@ -850,7 +858,7 @@ export default function InviteMembersModal({
             loading={!hasNoSlots && processing}
             fullWidth
             size="md"
-            mt="md"
+            style={{ marginTop: "var(--mantine-spacing-md)" }}
           >
             {inviteMode === "email"
               ? t("workspace.people.emailInvite.submit", "Send Invites")
diff --git a/frontend/editor/src/proprietary/components/shared/ManageBillingButton.tsx b/frontend/editor/src/proprietary/components/shared/ManageBillingButton.tsx
index 179479bcd3..22450f441e 100644
--- a/frontend/editor/src/proprietary/components/shared/ManageBillingButton.tsx
+++ b/frontend/editor/src/proprietary/components/shared/ManageBillingButton.tsx
@@ -1,5 +1,5 @@
 import React, { useState } from "react";
-import { Button } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import licenseService from "@app/services/licenseService";
 import { alert } from "@app/components/toast";
@@ -50,7 +50,7 @@ export const ManageBillingButton: React.FC<ManageBillingButtonProps> = ({
   };
 
   return (
-    <Button variant="outline" onClick={handleClick} loading={loading}>
+    <Button variant="secondary" onClick={handleClick} loading={loading}>
       {t("billing.manageBilling", "Manage Billing")}
     </Button>
   );
diff --git a/frontend/editor/src/proprietary/components/shared/UpdateSeatsButton.tsx b/frontend/editor/src/proprietary/components/shared/UpdateSeatsButton.tsx
index f950495a5d..d46b566a1f 100644
--- a/frontend/editor/src/proprietary/components/shared/UpdateSeatsButton.tsx
+++ b/frontend/editor/src/proprietary/components/shared/UpdateSeatsButton.tsx
@@ -1,11 +1,11 @@
 import React from "react";
-import { Button, ButtonProps } from "@mantine/core";
+import { Button, type ButtonProps } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useUpdateSeats } from "@app/contexts/UpdateSeatsContext";
 
 interface UpdateSeatsButtonProps extends Omit<
   ButtonProps,
-  "onClick" | "loading"
+  "onClick" | "loading" | "onError" | "onSuccess"
 > {
   onSuccess?: () => void;
   onError?: (error: string) => void;
@@ -28,7 +28,7 @@ export const UpdateSeatsButton: React.FC<UpdateSeatsButtonProps> = ({
 
   return (
     <Button
-      variant="outline"
+      variant="secondary"
       onClick={handleClick}
       loading={isLoading}
       {...buttonProps}
diff --git a/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.tsx b/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.tsx
index a375fa42cc..689f9a7fab 100644
--- a/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.tsx
+++ b/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.tsx
@@ -1,7 +1,6 @@
 import React, { useState, useEffect } from "react";
 import {
   Modal,
-  Button,
   Text,
   Alert,
   Loader,
@@ -9,6 +8,7 @@ import {
   Group,
   NumberInput,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
 
@@ -186,7 +186,7 @@ const UpdateSeatsModal: React.FC<UpdateSeatsModalProps> = ({
         </Alert>
 
         <Group justify="flex-end" gap="sm">
-          <Button variant="outline" onClick={handleClose}>
+          <Button variant="secondary" onClick={handleClose}>
             {t("common.cancel", "Cancel")}
           </Button>
           <Button
diff --git a/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx b/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
index 649416f205..c3b5ae0307 100644
--- a/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
+++ b/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
@@ -358,7 +358,7 @@ const UpgradeBanner: React.FC = () => {
           textColor="#fff"
           iconColor="#fff"
           closeIconColor="#fff"
-          buttonVariant="white"
+          buttonVariant="filled"
           buttonColor="blue"
           minHeight={48}
           compact
diff --git a/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.tsx b/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.tsx
index 2307ed78bd..0b96811e18 100644
--- a/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.tsx
@@ -1,4 +1,5 @@
-import { Text, Button } from "@mantine/core";
+import { Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useAuth } from "@app/auth/UseSession";
 
@@ -45,7 +46,7 @@ export function OverviewHeader() {
           )}
         </div>
         {user && (
-          <Button color="red" variant="filled" onClick={handleLogout}>
+          <Button accent="danger" onClick={handleLogout}>
             {t("account.overview.logOut", "Log out")}
           </Button>
         )}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.tsx
index 40d16cfc56..457a02fef1 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.tsx
@@ -1,7 +1,6 @@
 import React, { useCallback, useEffect, useMemo, useState } from "react";
 import {
   Alert,
-  Button,
   Box,
   Group,
   Modal,
@@ -11,6 +10,7 @@ import {
   Text,
   TextInput,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert as showToast } from "@app/components/toast";
@@ -391,7 +391,7 @@ const AccountSection: React.FC = () => {
 
               {!isSsoUser && (
                 <Button
-                  variant="light"
+                  variant="secondary"
                   leftSection={<LocalIcon icon="edit-rounded" />}
                   onClick={() => setUsernameModalOpen(true)}
                 >
@@ -400,8 +400,8 @@ const AccountSection: React.FC = () => {
               )}
 
               <Button
-                variant="outline"
-                color="red"
+                variant="secondary"
+                accent="danger"
                 leftSection={<LocalIcon icon="logout-rounded" />}
                 onClick={handleLogout}
               >
@@ -452,8 +452,8 @@ const AccountSection: React.FC = () => {
                 </Button>
               ) : (
                 <Button
-                  variant="outline"
-                  color="red"
+                  variant="secondary"
+                  accent="danger"
                   leftSection={<LocalIcon icon="close-rounded" />}
                   onClick={() => {
                     setMfaError("");
@@ -546,7 +546,7 @@ const AccountSection: React.FC = () => {
 
             <Group justify="flex-end" gap="sm">
               <Button
-                variant="default"
+                variant="secondary"
                 onClick={() => setPasswordModalOpen(false)}
               >
                 {t("common.cancel", "Cancel")}
@@ -641,7 +641,7 @@ const AccountSection: React.FC = () => {
               required
             />
             <Group justify="flex-end" gap="sm">
-              <Button variant="default" onClick={handleCloseMfaSetupModal}>
+              <Button variant="secondary" onClick={handleCloseMfaSetupModal}>
                 {t("common.cancel", "Cancel")}
               </Button>
               <Button type="submit" loading={mfaLoading}>
@@ -699,10 +699,10 @@ const AccountSection: React.FC = () => {
               required
             />
             <Group justify="flex-end" gap="sm">
-              <Button variant="default" onClick={handleCloseMfaDisableModal}>
+              <Button variant="secondary" onClick={handleCloseMfaDisableModal}>
                 {t("common.cancel", "Cancel")}
               </Button>
-              <Button type="submit" color="red" loading={mfaLoading}>
+              <Button accent="danger" type="submit" loading={mfaLoading}>
                 {t("account.mfa.confirmDisable", "Disable")}
               </Button>
             </Group>
@@ -760,7 +760,7 @@ const AccountSection: React.FC = () => {
 
             <Group justify="flex-end" gap="sm">
               <Button
-                variant="default"
+                variant="secondary"
                 onClick={() => setUsernameModalOpen(false)}
               >
                 {t("common.cancel", "Cancel")}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAdvancedSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAdvancedSection.tsx
index e0b6a75e7c..9c81199ed5 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAdvancedSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAdvancedSection.tsx
@@ -4,7 +4,6 @@ import { useTranslation } from "react-i18next";
 import {
   NumberInput,
   Switch,
-  Button,
   Stack,
   Paper,
   Text,
@@ -14,6 +13,7 @@ import {
   TextInput,
   MultiSelect,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { alert } from "@app/components/toast";
 import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
 import { useRestartServer } from "@app/components/shared/config/useRestartServer";
@@ -752,8 +752,8 @@ export default function AdminAdvancedSection() {
                 )}
                 <Group justify="flex-end">
                   <Button
-                    size="xs"
-                    variant="light"
+                    size="sm"
+                    variant="secondary"
                     onClick={handleDownloadTessdataLanguages}
                     loading={downloadLanguagesLoading}
                     disabled={
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.tsx
index 734334cdee..fe1fcb725d 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.tsx
@@ -6,10 +6,10 @@ import {
   Alert,
   Stack,
   Text,
-  Button,
   Accordion,
   Center,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import auditService, {
@@ -174,8 +174,8 @@ const AdminAuditSection: React.FC = () => {
               )}
             </Text>
             <Button
-              variant="light"
-              size="xs"
+              variant="secondary"
+              size="sm"
               onClick={() => navigate("/settings/adminSecurity#auditLogging")}
               rightSection={
                 <LocalIcon
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminDatabaseSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminDatabaseSection.tsx
index 102f7f8f25..6b34e79fa6 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminDatabaseSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminDatabaseSection.tsx
@@ -5,7 +5,6 @@ import { useTranslation } from "react-i18next";
 import {
   NumberInput,
   Switch,
-  Button,
   Stack,
   Paper,
   Text,
@@ -15,7 +14,6 @@ import {
   Select,
   Badge,
   Table,
-  ActionIcon,
   Tooltip,
   FileInput,
   Alert,
@@ -23,6 +21,8 @@ import {
   Box,
   Modal,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { alert } from "@app/components/toast";
 import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
 import { useRestartServer } from "@app/components/shared/config/useRestartServer";
@@ -804,7 +804,7 @@ export default function AdminDatabaseSection() {
                   </Group>
                   <Group gap="xs">
                     <Button
-                      variant="light"
+                      variant="secondary"
                       leftSection={
                         <LocalIcon icon="refresh" width="1rem" height="1rem" />
                       }
@@ -849,7 +849,7 @@ export default function AdminDatabaseSection() {
                       styles={{ input: { minWidth: 280 } }}
                     />
                     <Button
-                      variant="outline"
+                      variant="secondary"
                       onClick={handleUploadImport}
                       loading={importingUpload}
                       disabled={!loginEnabled || !isEmbeddedH2}
@@ -927,11 +927,15 @@ export default function AdminDatabaseSection() {
                                 withArrow
                               >
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   onClick={() =>
                                     handleDownload(backup.fileName)
                                   }
                                   disabled={!loginEnabled || !isEmbeddedH2}
+                                  aria-label={t(
+                                    "admin.settings.database.download",
+                                    "Download",
+                                  )}
                                 >
                                   {downloadingFile === backup.fileName ? (
                                     <Loader size="xs" />
@@ -952,11 +956,15 @@ export default function AdminDatabaseSection() {
                                 withArrow
                               >
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   onClick={() =>
                                     handleImportExisting(backup.fileName)
                                   }
                                   disabled={!loginEnabled || !isEmbeddedH2}
+                                  aria-label={t(
+                                    "admin.settings.database.import",
+                                    "Import",
+                                  )}
                                 >
                                   {importingBackupFile === backup.fileName ? (
                                     <Loader size="xs" />
@@ -977,12 +985,16 @@ export default function AdminDatabaseSection() {
                                 withArrow
                               >
                                 <ActionIcon
-                                  variant="subtle"
-                                  color="red"
+                                  variant="tertiary"
+                                  accent="danger"
                                   onClick={() =>
                                     handleDeleteClick(backup.fileName)
                                   }
                                   disabled={!loginEnabled || !isEmbeddedH2}
+                                  aria-label={t(
+                                    "admin.settings.database.delete",
+                                    "Delete",
+                                  )}
                                 >
                                   {deletingFile === backup.fileName ? (
                                     <Loader size="xs" />
@@ -1068,14 +1080,14 @@ export default function AdminDatabaseSection() {
             </Stack>
             <Group justify="flex-end" gap="sm">
               <Button
-                variant="default"
+                variant="secondary"
                 onClick={closeConfirmImportModal}
                 disabled={importingUpload}
               >
                 {t("cancel", "Cancel")}
               </Button>
               <Button
-                color="red"
+                accent="danger"
                 onClick={handleConfirmImport}
                 loading={importingUpload}
                 disabled={confirmInput.length === 0}
@@ -1112,14 +1124,14 @@ export default function AdminDatabaseSection() {
             </Alert>
             <Group justify="flex-end" gap="sm">
               <Button
-                variant="default"
+                variant="secondary"
                 onClick={() => setDeleteConfirmFile(null)}
                 disabled={deletingFile !== null}
               >
                 {t("cancel", "Cancel")}
               </Button>
               <Button
-                color="red"
+                accent="danger"
                 onClick={() =>
                   deleteConfirmFile && handleDelete(deleteConfirmFile)
                 }
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
index aaf73ec281..5e78d21a22 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
@@ -12,9 +12,9 @@ import {
   Group,
   MultiSelect,
   Badge,
-  SegmentedControl,
   Select,
 } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { alert } from "@app/components/toast";
 import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
 import { useRestartServer } from "@app/components/shared/config/useRestartServer";
@@ -499,7 +499,7 @@ export default function AdminGeneralSection() {
               <SegmentedControl
                 value={logoStyleValue}
                 onChange={handleLogoStyleChange}
-                data={[
+                options={[
                   {
                     value: "classic",
                     label: (
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminUsageSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminUsageSection.tsx
index e077fe36fd..6b46789bdd 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminUsageSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminUsageSection.tsx
@@ -1,14 +1,7 @@
 import React, { useState, useEffect, useCallback } from "react";
-import {
-  Stack,
-  Group,
-  Text,
-  Button,
-  SegmentedControl,
-  Loader,
-  Alert,
-  Card,
-} from "@mantine/core";
+import { Stack, Group, Text, Loader, Alert, Card } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import usageAnalyticsService, {
@@ -300,8 +293,8 @@ const AdminUsageSection: React.FC = () => {
             </Text>
             <Group gap="sm">
               <Button
-                variant="light"
-                size="xs"
+                variant="secondary"
+                size="sm"
                 onClick={() => navigate("/settings/adminSecurity")}
                 rightSection={
                   <LocalIcon
@@ -314,8 +307,8 @@ const AdminUsageSection: React.FC = () => {
                 {t("usage.configureSettings", "Configure Analytics Settings")}
               </Button>
               <Button
-                variant="light"
-                size="xs"
+                variant="secondary"
+                size="sm"
                 onClick={() => navigate("/settings/adminSecurity#auditLogging")}
                 rightSection={
                   <LocalIcon
@@ -342,24 +335,26 @@ const AdminUsageSection: React.FC = () => {
                 onChange={(value) =>
                   setDisplayMode(value as "top10" | "top20" | "all")
                 }
-                disabled={showDemoData}
-                data={[
+                options={[
                   {
                     value: "top10",
                     label: t("usage.controls.top10", "Top 10"),
+                    disabled: showDemoData,
                   },
                   {
                     value: "top20",
                     label: t("usage.controls.top20", "Top 20"),
+                    disabled: showDemoData,
                   },
                   {
                     value: "all",
                     label: t("usage.controls.all", "All"),
+                    disabled: showDemoData,
                   },
                 ]}
               />
               <Button
-                variant="outline"
+                variant="secondary"
                 leftSection={
                   <LocalIcon icon="refresh" width="1rem" height="1rem" />
                 }
@@ -379,19 +374,21 @@ const AdminUsageSection: React.FC = () => {
             <SegmentedControl
               value={dataType}
               onChange={(value) => setDataType(value as "all" | "api" | "ui")}
-              disabled={showDemoData}
-              data={[
+              options={[
                 {
                   value: "all",
                   label: t("usage.controls.dataType.all", "All"),
+                  disabled: showDemoData,
                 },
                 {
                   value: "api",
                   label: t("usage.controls.dataType.api", "API"),
+                  disabled: showDemoData,
                 },
                 {
                   value: "ui",
                   label: t("usage.controls.dataType.ui", "UI"),
+                  disabled: showDemoData,
                 },
               ]}
             />
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.tsx
index a6c3af0bd2..9af89dedad 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.tsx
@@ -3,7 +3,6 @@ import { useNavigate } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import {
   Anchor,
-  Button,
   Group,
   Loader,
   Paper,
@@ -14,6 +13,7 @@ import {
   Textarea,
   Tooltip,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import InfoOutlinedIcon from "@mui/icons-material/InfoOutlined";
 import Markdown from "react-markdown";
 import remarkGfm from "remark-gfm";
@@ -201,6 +201,7 @@ export default function LoginAgreementEditor({
           style={{ flex: 1, maxWidth: 340 }}
         />
         <Button
+          variant="primary"
           onClick={handleSave}
           loading={saving}
           disabled={disabled || loading || loadFailed || !dirty}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
index 454b9e138c..68c2f49536 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
@@ -4,10 +4,8 @@ import { Trans, useTranslation } from "react-i18next";
 import {
   Stack,
   Text,
-  Button,
   TextInput,
   Table,
-  ActionIcon,
   Menu,
   Badge,
   Loader,
@@ -15,11 +13,12 @@ import {
   Modal,
   Select,
   Tooltip,
-  CloseButton,
   Avatar,
   Box,
   type ComboboxItem,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
 import {
@@ -507,8 +506,8 @@ export default function PeopleSection() {
                 )}
               </Badge>
               <Button
-                size="compact-sm"
-                variant="outline"
+                size="sm"
+                variant="secondary"
                 onClick={() => navigate("/settings/adminPlan")}
               >
                 {t("workspace.people.actions.upgrade", "Upgrade")}
@@ -550,7 +549,7 @@ export default function PeopleSection() {
               <Text size="sm" c="dimmed" span>
                 •
               </Text>
-              <UpdateSeatsButton size="xs" onSuccess={fetchData} />
+              <UpdateSeatsButton size="sm" onSuccess={fetchData} />
             </>
           )}
         </Group>
@@ -583,7 +582,7 @@ export default function PeopleSection() {
               (licenseInfo ? licenseInfo.availableSlots === 0 : false)
             }
           >
-            {t("workspace.people.addMembers")}
+            {t("workspace.people.addMembers", "Add Members")}
           </Button>
         </Tooltip>
       </Group>
@@ -783,7 +782,11 @@ export default function PeopleSection() {
                       withArrow
                       zIndex={Z_INDEX_OVER_CONFIG_MODAL + 10}
                     >
-                      <ActionIcon variant="subtle" size="sm">
+                      <ActionIcon
+                        variant="tertiary"
+                        size="sm"
+                        aria-label={t("workspace.people.userInfo", "User info")}
+                      >
                         <LocalIcon icon="info" width="1rem" height="1rem" />
                       </ActionIcon>
                     </Tooltip>
@@ -792,7 +795,14 @@ export default function PeopleSection() {
                     {!isCurrentUser(user) && (
                       <Menu position="bottom-end" withinPortal>
                         <Menu.Target>
-                          <ActionIcon variant="subtle" disabled={!loginEnabled}>
+                          <ActionIcon
+                            variant="tertiary"
+                            disabled={!loginEnabled}
+                            aria-label={t(
+                              "workspace.people.memberActions",
+                              "Member actions",
+                            )}
+                          >
                             <LocalIcon
                               icon="more-vert"
                               width="1rem"
@@ -993,16 +1003,20 @@ export default function PeopleSection() {
         withCloseButton={false}
       >
         <Box pos="relative">
-          <CloseButton
+          <ActionIcon
             onClick={closeEditModal}
             size="lg"
+            variant="tertiary"
+            aria-label={t("close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close" width="1.25rem" height="1.25rem" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -1077,7 +1091,7 @@ export default function PeopleSection() {
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.people.editMember.submit")}
             </Button>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx
index 90f4fda9e0..cabdfb642c 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx
@@ -4,20 +4,19 @@ import { useTranslation } from "react-i18next";
 import {
   Stack,
   Text,
-  Button,
   Table,
-  ActionIcon,
   Badge,
   Loader,
   Group,
   Modal,
   Select,
-  CloseButton,
   Tooltip,
   Menu,
   Avatar,
   Box,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
 import { teamService, Team } from "@app/services/teamService";
@@ -354,7 +353,7 @@ export default function TeamDetailsSection({
         <Text size="sm" c="red">
           {t("workspace.teams.teamNotFound", "Team not found")}
         </Text>
-        <Button variant="light" onClick={onBack}>
+        <Button variant="secondary" onClick={onBack}>
           {t("workspace.teams.backToTeams", "Back to Teams")}
         </Button>
       </Stack>
@@ -365,7 +364,11 @@ export default function TeamDetailsSection({
     <Stack gap="lg">
       {/* Header with back button */}
       <Group>
-        <ActionIcon variant="subtle" onClick={onBack}>
+        <ActionIcon
+          variant="tertiary"
+          onClick={onBack}
+          aria-label={t("common.back", "Back")}
+        >
           <LocalIcon icon="arrow-back" width="1.2rem" height="1.2rem" />
         </ActionIcon>
         <div style={{ flex: 1 }}>
@@ -562,7 +565,14 @@ export default function TeamDetailsSection({
                         withArrow
                         zIndex={Z_INDEX_OVER_CONFIG_MODAL + 10}
                       >
-                        <ActionIcon variant="subtle" color="gray" size="sm">
+                        <ActionIcon
+                          variant="tertiary"
+                          size="sm"
+                          aria-label={t(
+                            "workspace.people.userInfo",
+                            "User info",
+                          )}
+                        >
                           <LocalIcon icon="info" width="1rem" height="1rem" />
                         </ActionIcon>
                       </Tooltip>
@@ -570,7 +580,13 @@ export default function TeamDetailsSection({
                       {/* Actions menu */}
                       <Menu position="bottom-end" withinPortal>
                         <Menu.Target>
-                          <ActionIcon variant="subtle" color="gray">
+                          <ActionIcon
+                            variant="tertiary"
+                            aria-label={t(
+                              "workspace.people.memberActions",
+                              "Member actions",
+                            )}
+                          >
                             <LocalIcon
                               icon="more-vert"
                               width="1rem"
@@ -695,16 +711,20 @@ export default function TeamDetailsSection({
         withCloseButton={false}
       >
         <div style={{ position: "relative" }}>
-          <CloseButton
+          <ActionIcon
             onClick={() => setAddMemberModalOpened(false)}
             size="lg"
+            variant="tertiary"
+            aria-label={t("common.close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close-rounded" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -755,7 +775,7 @@ export default function TeamDetailsSection({
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.teams.addMemberToTeam.submit")}
             </Button>
@@ -774,16 +794,20 @@ export default function TeamDetailsSection({
         withCloseButton={false}
       >
         <div style={{ position: "relative" }}>
-          <CloseButton
+          <ActionIcon
             onClick={() => setChangeTeamModalOpened(false)}
             size="lg"
+            variant="tertiary"
+            aria-label={t("common.close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close-rounded" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -828,7 +852,7 @@ export default function TeamDetailsSection({
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.teams.changeTeam.submit", "Change Team")}
             </Button>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx
index e3cd79be02..4559296afe 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx
@@ -4,19 +4,18 @@ import { useTranslation } from "react-i18next";
 import {
   Stack,
   Text,
-  Button,
   TextInput,
   Table,
-  ActionIcon,
   Menu,
   Badge,
   Loader,
   Group,
   Modal,
   Select,
-  CloseButton,
   Tooltip,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
 import { teamService, Team } from "@app/services/teamService";
@@ -380,9 +379,12 @@ export default function TeamsSection() {
                   <Menu position="bottom-end" withinPortal>
                     <Menu.Target>
                       <ActionIcon
-                        variant="subtle"
-                        color="gray"
+                        variant="tertiary"
                         disabled={!loginEnabled}
+                        aria-label={t(
+                          "workspace.teams.teamActions",
+                          "Team actions",
+                        )}
                       >
                         <LocalIcon
                           icon="more-vert"
@@ -456,16 +458,20 @@ export default function TeamsSection() {
         withCloseButton={false}
       >
         <div style={{ position: "relative" }}>
-          <CloseButton
+          <ActionIcon
             onClick={() => setCreateModalOpened(false)}
             size="lg"
+            variant="tertiary"
+            aria-label={t("close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close" width="1.25rem" height="1.25rem" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -493,7 +499,7 @@ export default function TeamsSection() {
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.teams.createTeam.submit")}
             </Button>
@@ -512,16 +518,20 @@ export default function TeamsSection() {
         withCloseButton={false}
       >
         <div style={{ position: "relative" }}>
-          <CloseButton
+          <ActionIcon
             onClick={() => setRenameModalOpened(false)}
             size="lg"
+            variant="tertiary"
+            aria-label={t("close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close" width="1.25rem" height="1.25rem" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -555,7 +565,7 @@ export default function TeamsSection() {
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.teams.renameTeam.submit")}
             </Button>
@@ -574,16 +584,20 @@ export default function TeamsSection() {
         withCloseButton={false}
       >
         <div style={{ position: "relative" }}>
-          <CloseButton
+          <ActionIcon
             onClick={() => setAddMemberModalOpened(false)}
             size="lg"
+            variant="tertiary"
+            aria-label={t("close", "Close")}
             style={{
               position: "absolute",
               top: -8,
               right: -8,
               zIndex: 1,
             }}
-          />
+          >
+            <LocalIcon icon="close" width="1.25rem" height="1.25rem" />
+          </ActionIcon>
           <Stack gap="lg" pt="md">
             {/* Header with Icon */}
             <Stack gap="md" align="center">
@@ -634,7 +648,7 @@ export default function TeamsSection() {
               loading={processing}
               fullWidth
               size="md"
-              mt="md"
+              style={{ marginTop: "var(--mantine-spacing-md)" }}
             >
               {t("workspace.teams.addMemberToTeam.submit")}
             </Button>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
index 8fc8b6cdd4..f05817a957 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Box, Button, Group, Paper } from "@mantine/core";
+import { Box, Group, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import FitText from "@app/components/shared/FitText";
 import { useTranslation } from "react-i18next";
@@ -56,18 +57,14 @@ export default function ApiKeySection({
           </Box>
           <Button
             size="sm"
-            variant="light"
+            variant="secondary"
+            accent="neutral"
             onClick={() => onCopy(publicKey, "public")}
             leftSection={
               <LocalIcon icon="content-copy-rounded" width={14} height={14} />
             }
-            styles={{
-              root: {
-                background: "var(--api-keys-button-bg)",
-                color: "var(--api-keys-button-color)",
-                border: "none",
-                marginLeft: 12,
-              },
+            style={{
+              marginLeft: 12,
             }}
             aria-label={t("config.apiKeys.copyKeyAriaLabel", "Copy API key")}
           >
@@ -77,18 +74,14 @@ export default function ApiKeySection({
           </Button>
           <Button
             size="sm"
-            variant="light"
+            variant="secondary"
+            accent="neutral"
             onClick={onRefresh}
             leftSection={
               <LocalIcon icon="refresh-rounded" width={14} height={14} />
             }
-            styles={{
-              root: {
-                background: "var(--api-keys-button-bg)",
-                color: "var(--api-keys-button-color)",
-                border: "none",
-                marginLeft: 8,
-              },
+            style={{
+              marginLeft: 8,
             }}
             disabled={disabled}
             aria-label={t("config.apiKeys.refreshAriaLabel", "Refresh API key")}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.tsx
index ea3539d95a..11f90f4d76 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Modal, Stack, Text, Group, Button } from "@mantine/core";
+import { Modal, Stack, Text, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
 
@@ -44,10 +45,10 @@ export default function RefreshModal({
           )}
         </Text>
         <Group justify="flex-end" gap="sm">
-          <Button variant="default" onClick={onClose}>
+          <Button variant="secondary" onClick={onClose}>
             {t("common.cancel", "Cancel")}
           </Button>
-          <Button color="red" onClick={onConfirm}>
+          <Button accent="danger" onClick={onConfirm}>
             {t("config.apiKeys.refreshModal.confirmCta", "Refresh Keys")}
           </Button>
         </Group>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.tsx
index 742c0ceb21..cf205a9ccc 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.tsx
@@ -4,12 +4,12 @@ import {
   Text,
   Group,
   Stack,
-  SegmentedControl,
   Loader,
   Alert,
   Box,
   SimpleGrid,
 } from "@mantine/core";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import {
   AreaChart,
   Area,
@@ -161,13 +161,24 @@ const AuditChartsSection: React.FC<AuditChartsSectionProps> = ({
         <SegmentedControl
           value={timePeriod}
           onChange={(value) => {
-            onTimePeriodChange?.(value as "day" | "week" | "month");
+            onTimePeriodChange?.(value);
           }}
-          disabled={!loginEnabled}
-          data={[
-            { label: t("audit.charts.day", "Day"), value: "day" },
-            { label: t("audit.charts.week", "Week"), value: "week" },
-            { label: t("audit.charts.month", "Month"), value: "month" },
+          options={[
+            {
+              label: t("audit.charts.day", "Day"),
+              value: "day",
+              disabled: !loginEnabled,
+            },
+            {
+              label: t("audit.charts.week", "Week"),
+              value: "week",
+              disabled: !loginEnabled,
+            },
+            {
+              label: t("audit.charts.month", "Month"),
+              value: "month",
+              disabled: !loginEnabled,
+            },
           ]}
         />
       </Group>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.tsx
index a2d26aecf0..c166e2fc5b 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.tsx
@@ -4,12 +4,12 @@ import {
   Stack,
   Text,
   PasswordInput,
-  Button,
   Group,
   Alert,
   Code,
   Badge,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import auditService from "@app/services/auditService";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -172,11 +172,15 @@ const AuditClearDataSection: React.FC<AuditClearDataSectionProps> = ({
             )}
 
             <Group justify="space-between">
-              <Button variant="default" onClick={resetForm} disabled={clearing}>
+              <Button
+                variant="secondary"
+                onClick={resetForm}
+                disabled={clearing}
+              >
                 {t("audit.clearData.cancel", "Cancel")}
               </Button>
               <Button
-                color="red"
+                accent="danger"
                 onClick={handleClearData}
                 loading={clearing}
                 disabled={
@@ -229,7 +233,7 @@ const AuditClearDataSection: React.FC<AuditClearDataSectionProps> = ({
           </Group>
 
           <Button
-            color="red"
+            accent="danger"
             onClick={handleInitiateDeletion}
             disabled={!loginEnabled}
             fullWidth
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.tsx
index 756117214a..feca3696d4 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.tsx
@@ -4,7 +4,6 @@ import {
   Text,
   Group,
   Stack,
-  Button,
   Pagination,
   Modal,
   Code,
@@ -12,8 +11,8 @@ import {
   Alert,
   Table,
   Badge,
-  UnstyledButton,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import auditService, {
   AuditEvent,
@@ -276,7 +275,10 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                       }}
                       fz="sm"
                     >
-                      <UnstyledButton
+                      <Button
+                        type="button"
+                        variant="tertiary"
+                        hover={false}
                         onClick={() => toggleSort("timestamp")}
                         style={{
                           display: "flex",
@@ -292,7 +294,7 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                           width="0.9rem"
                           height="0.9rem"
                         />
-                      </UnstyledButton>
+                      </Button>
                     </Table.Th>
                     <Table.Th
                       style={{
@@ -302,7 +304,10 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                       }}
                       fz="sm"
                     >
-                      <UnstyledButton
+                      <Button
+                        type="button"
+                        variant="tertiary"
+                        hover={false}
                         onClick={() => toggleSort("eventType")}
                         style={{
                           display: "flex",
@@ -318,7 +323,7 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                           width="0.9rem"
                           height="0.9rem"
                         />
-                      </UnstyledButton>
+                      </Button>
                     </Table.Th>
                     <Table.Th
                       style={{
@@ -328,7 +333,10 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                       }}
                       fz="sm"
                     >
-                      <UnstyledButton
+                      <Button
+                        type="button"
+                        variant="tertiary"
+                        hover={false}
                         onClick={() => toggleSort("username")}
                         style={{
                           display: "flex",
@@ -344,7 +352,7 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                           width="0.9rem"
                           height="0.9rem"
                         />
-                      </UnstyledButton>
+                      </Button>
                     </Table.Th>
                     <Table.Th
                       style={{
@@ -482,8 +490,8 @@ const AuditEventsTable: React.FC<AuditEventsTableProps> = ({
                           )}
                           <Table.Td ta="center">
                             <Button
-                              variant="subtle"
-                              size="xs"
+                              variant="tertiary"
+                              size="sm"
                               onClick={() => setSelectedEvent(event)}
                               disabled={!loginEnabled}
                             >
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.tsx
index a0ad482779..4e0f808649 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.tsx
@@ -1,13 +1,7 @@
 import React, { useState } from "react";
-import {
-  Card,
-  Text,
-  Group,
-  Stack,
-  Button,
-  SegmentedControl,
-  Checkbox,
-} from "@mantine/core";
+import { Card, Text, Group, Stack, Checkbox } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import auditService from "@app/services/auditService";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -103,12 +97,11 @@ const AuditExportSection: React.FC<AuditExportSectionProps> = ({
             value={exportFormat}
             onChange={(value) => {
               if (!loginEnabled) return;
-              setExportFormat(value as "csv" | "json");
+              setExportFormat(value);
             }}
-            disabled={!loginEnabled}
-            data={[
-              { label: "CSV", value: "csv" },
-              { label: "JSON", value: "json" },
+            options={[
+              { label: "CSV", value: "csv", disabled: !loginEnabled },
+              { label: "JSON", value: "json", disabled: !loginEnabled },
             ]}
           />
         </div>
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.tsx
index da7c46ec59..5cc4313dbf 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.tsx
@@ -1,12 +1,6 @@
 import React from "react";
-import {
-  Group,
-  MultiSelect,
-  Button,
-  Stack,
-  SimpleGrid,
-  Text,
-} from "@mantine/core";
+import { Group, MultiSelect, Stack, SimpleGrid, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { DateInput } from "@mantine/dates";
 import { useTranslation } from "react-i18next";
 import { AuditFilters } from "@app/services/auditService";
@@ -102,32 +96,32 @@ const AuditFiltersForm: React.FC<AuditFiltersFormProps> = ({
         </Text>
         <Group gap="xs">
           <Button
-            variant={isPresetActive("today") ? "filled" : "light"}
-            size="xs"
+            variant={isPresetActive("today") ? "primary" : "secondary"}
+            size="sm"
             onClick={() => handleQuickPreset("today")}
             disabled={disabled}
           >
             {t("audit.filters.today", "Today")}
           </Button>
           <Button
-            variant={isPresetActive("last7") ? "filled" : "light"}
-            size="xs"
+            variant={isPresetActive("last7") ? "primary" : "secondary"}
+            size="sm"
             onClick={() => handleQuickPreset("last7")}
             disabled={disabled}
           >
             {t("audit.filters.last7Days", "Last 7 days")}
           </Button>
           <Button
-            variant={isPresetActive("last30") ? "filled" : "light"}
-            size="xs"
+            variant={isPresetActive("last30") ? "primary" : "secondary"}
+            size="sm"
             onClick={() => handleQuickPreset("last30")}
             disabled={disabled}
           >
             {t("audit.filters.last30Days", "Last 30 days")}
           </Button>
           <Button
-            variant={isPresetActive("thisMonth") ? "filled" : "light"}
-            size="xs"
+            variant={isPresetActive("thisMonth") ? "primary" : "secondary"}
+            size="sm"
             onClick={() => handleQuickPreset("thisMonth")}
             disabled={disabled}
           >
@@ -216,7 +210,7 @@ const AuditFiltersForm: React.FC<AuditFiltersFormProps> = ({
       {/* Clear Button */}
       <Group justify="flex-end">
         <Button
-          variant="outline"
+          variant="secondary"
           size="sm"
           onClick={onClearFilters}
           disabled={disabled}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.tsx
index 6ac4feb2e2..16e2bafa5e 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useMemo } from "react";
-import { Button, Collapse, Select, Group } from "@mantine/core";
+import { Collapse, Select, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import licenseService, {
   PlanTier,
@@ -128,7 +129,7 @@ const AvailablePlansSection: React.FC<AvailablePlansSectionProps> = ({
 
       <div style={{ textAlign: "center" }}>
         <Button
-          variant="subtle"
+          variant="tertiary"
           onClick={() => setShowComparison(!showComparison)}
         >
           {showComparison
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/LicenseKeySection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/LicenseKeySection.tsx
index ffd89ec7b0..4b890e683a 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/LicenseKeySection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/LicenseKeySection.tsx
@@ -1,6 +1,5 @@
 import React, { useState } from "react";
 import {
-  Button,
   Collapse,
   Alert,
   TextInput,
@@ -8,9 +7,10 @@ import {
   Stack,
   Group,
   Text,
-  SegmentedControl,
-  FileButton,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { FilePicker } from "@app/ui/FilePicker";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { alert } from "@app/components/toast";
@@ -113,7 +113,7 @@ const LicenseKeySection: React.FC<LicenseKeySectionProps> = ({
   return (
     <div>
       <Button
-        variant="subtle"
+        variant="tertiary"
         leftSection={
           <LocalIcon
             icon={
@@ -238,13 +238,14 @@ const LicenseKeySection: React.FC<LicenseKeySectionProps> = ({
               if (value === "text") setLicenseFile(null);
               if (value === "file") setLicenseKeyInput("");
             }}
-            data={[
+            options={[
               {
                 label: t(
                   "admin.settings.premium.inputMethod.text",
                   "License Key",
                 ),
                 value: "text",
+                disabled: !loginEnabled || savingLicense,
               },
               {
                 label: t(
@@ -252,9 +253,9 @@ const LicenseKeySection: React.FC<LicenseKeySectionProps> = ({
                   "Certificate File",
                 ),
                 value: "file",
+                disabled: !loginEnabled || savingLicense,
               },
             ]}
-            disabled={!loginEnabled || savingLicense}
           />
 
           {/* Input area */}
@@ -292,33 +293,26 @@ const LicenseKeySection: React.FC<LicenseKeySectionProps> = ({
                       "Upload your .lic or .cert license file",
                     )}
                   </Text>
-                  <FileButton
+                  <FilePicker
                     onChange={setLicenseFile}
                     accept=".lic,.cert"
                     disabled={!loginEnabled || savingLicense}
+                    variant="secondary"
+                    leftSection={
+                      <LocalIcon
+                        icon="upload-file-rounded"
+                        width="1rem"
+                        height="1rem"
+                      />
+                    }
                   >
-                    {(props) => (
-                      <Button
-                        {...props}
-                        variant="outline"
-                        leftSection={
-                          <LocalIcon
-                            icon="upload-file-rounded"
-                            width="1rem"
-                            height="1rem"
-                          />
-                        }
-                        disabled={!loginEnabled || savingLicense}
-                      >
-                        {licenseFile
-                          ? licenseFile.name
-                          : t(
-                              "admin.settings.premium.file.choose",
-                              "Choose License File",
-                            )}
-                      </Button>
-                    )}
-                  </FileButton>
+                    {licenseFile
+                      ? licenseFile.name
+                      : t(
+                          "admin.settings.premium.file.choose",
+                          "Choose License File",
+                        )}
+                  </FilePicker>
                   {licenseFile && (
                     <Text size="xs" c="dimmed" mt="xs">
                       {t(
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.tsx
index 84a8abe5e5..747448f913 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Button, Card, Text, Stack, Divider, Tooltip } from "@mantine/core";
+import { Card, Text, Stack, Divider, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { PlanTierGroup, LicenseInfo } from "@app/services/licenseService";
 import { PricingBadge } from "@app/components/shared/stripeCheckout/components/PricingBadge";
@@ -78,7 +79,7 @@ const PlanCard: React.FC<PlanCardProps> = ({
 
           <div style={{ flexGrow: 1 }} />
 
-          <Button variant="filled" disabled fullWidth className="plan-button">
+          <Button disabled fullWidth className="plan-button">
             {isCurrentTier
               ? t("plan.current", "Current Plan")
               : t("plan.free.included", "Included")}
@@ -190,7 +191,6 @@ const PlanCard: React.FC<PlanCardProps> = ({
             withArrow
           >
             <Button
-              variant="filled"
               fullWidth
               onClick={() =>
                 isCurrentTier && onManageClick
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticCheckoutModal.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticCheckoutModal.tsx
index dbac0833ce..05c0e0ec7f 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticCheckoutModal.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticCheckoutModal.tsx
@@ -3,14 +3,14 @@ import {
   Modal,
   Text,
   Group,
-  ActionIcon,
   Stack,
   Paper,
   Grid,
   TextInput,
-  Button,
   Alert,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { EmailStage } from "@app/components/shared/stripeCheckout/stages/EmailStage";
@@ -314,7 +314,7 @@ const StaticCheckoutModal: React.FC<StaticCheckoutModalProps> = ({
 
                 <Group justify="space-between">
                   <Button
-                    variant="subtle"
+                    variant="tertiary"
                     onClick={handleClose}
                     disabled={savingLicense}
                   >
@@ -362,7 +362,7 @@ const StaticCheckoutModal: React.FC<StaticCheckoutModalProps> = ({
         <Group gap="sm" wrap="nowrap">
           {canGoBack && (
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="lg"
               onClick={handleGoBack}
               aria-label={t("common.back", "Back")}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticPlanSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticPlanSection.tsx
index f0ab62a20d..ccceaaf16c 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticPlanSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/StaticPlanSection.tsx
@@ -1,13 +1,6 @@
 import React, { useState } from "react";
-import {
-  Card,
-  Text,
-  Stack,
-  Button,
-  Collapse,
-  Divider,
-  Tooltip,
-} from "@mantine/core";
+import { Card, Text, Stack, Collapse, Divider, Tooltip } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { alert } from "@app/components/toast";
 import { LicenseInfo, mapLicenseToTier } from "@app/services/licenseService";
@@ -222,7 +215,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                   if (plan.id === "free") {
                     return (
                       <Button
-                        variant="filled"
+                        variant="primary"
                         disabled
                         fullWidth
                         className="plan-button"
@@ -239,7 +232,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                     if (currentTier === "free") {
                       return (
                         <Button
-                          variant="filled"
+                          variant="primary"
                           fullWidth
                           onClick={() => handleOpenCheckout("server", false)}
                           className="plan-button"
@@ -251,7 +244,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                     if (isCurrent) {
                       return (
                         <Button
-                          variant="filled"
+                          variant="primary"
                           fullWidth
                           onClick={handleManageBilling}
                           className="plan-button"
@@ -263,7 +256,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                     if (isDowngradePlan) {
                       return (
                         <Button
-                          variant="filled"
+                          variant="primary"
                           disabled
                           fullWidth
                           className="plan-button"
@@ -287,7 +280,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                           withArrow
                         >
                           <Button
-                            variant="filled"
+                            variant="primary"
                             disabled
                             fullWidth
                             className="plan-button"
@@ -304,7 +297,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                       // TODO: Re-enable checkout flow when account syncing is ready
                       // return (
                       //   <Button
-                      //     variant="filled"
+                      //     variant="primary"
                       //     fullWidth
                       //     onClick={() => handleOpenCheckout('enterprise', true)}
                       //     className="plan-button"
@@ -314,7 +307,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                       // );
                       return (
                         <Button
-                          variant="filled"
+                          variant="primary"
                           fullWidth
                           disabled
                           className="plan-button"
@@ -326,7 +319,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
                     if (isCurrent) {
                       return (
                         <Button
-                          variant="filled"
+                          variant="primary"
                           fullWidth
                           onClick={handleManageBilling}
                           className="plan-button"
@@ -347,7 +340,7 @@ const StaticPlanSection: React.FC<StaticPlanSectionProps> = ({
         {/* Feature Comparison Toggle */}
         <div style={{ textAlign: "center", marginTop: "1rem" }}>
           <Button
-            variant="subtle"
+            variant="tertiary"
             onClick={() => setShowComparison(!showComparison)}
           >
             {showComparison
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.tsx
index 80772c8c97..e0b2c1a361 100644
--- a/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.tsx
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.tsx
@@ -1,5 +1,6 @@
 import React, { useEffect } from "react";
-import { Modal, Text, Group, ActionIcon } from "@mantine/core";
+import { Modal, Text, Group } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import licenseService from "@app/services/licenseService";
@@ -275,7 +276,7 @@ const StripeCheckout: React.FC<StripeCheckoutProps> = ({
         <Group gap="sm" wrap="nowrap">
           {canGoBack && (
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="lg"
               onClick={navigation.goBack}
               aria-label={t("common.back", "Back")}
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.tsx
index 4758d5d4d1..38efa7b308 100644
--- a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.tsx
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Stack, Text, TextInput, Button } from "@mantine/core";
+import { Stack, Text, TextInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 interface EmailStageProps {
@@ -44,7 +45,7 @@ export const EmailStage: React.FC<EmailStageProps> = ({
         }}
       />
 
-      <Button size="lg" onClick={onSubmit} disabled={!emailInput.trim()}>
+      <Button onClick={onSubmit} disabled={!emailInput.trim()}>
         {t("payment.emailStage.continue", "Continue")}
       </Button>
     </Stack>
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.tsx
index 3881ab25fa..fc31369079 100644
--- a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.tsx
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.tsx
@@ -1,5 +1,6 @@
 import React from "react";
-import { Alert, Stack, Text, Button } from "@mantine/core";
+import { Alert, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 
 interface ErrorStageProps {
@@ -14,7 +15,7 @@ export const ErrorStage: React.FC<ErrorStageProps> = ({ error, onClose }) => {
     <Alert color="red" title={t("payment.error", "Payment Error")}>
       <Stack gap="md">
         <Text size="sm">{error}</Text>
-        <Button variant="outline" onClick={onClose}>
+        <Button variant="secondary" onClick={onClose}>
           {t("common.close", "Close")}
         </Button>
       </Stack>
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.tsx
index 4928ee4fa8..d74afc4d99 100644
--- a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.tsx
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.tsx
@@ -1,13 +1,6 @@
 import React from "react";
-import {
-  Stack,
-  Button,
-  Text,
-  Grid,
-  Paper,
-  Alert,
-  Divider,
-} from "@mantine/core";
+import { Stack, Text, Grid, Paper, Alert, Divider } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { PlanTierGroup } from "@app/services/licenseService";
 import { SavingsCalculation } from "@app/components/shared/stripeCheckout/types/checkout";
@@ -87,7 +80,7 @@ export const PlanSelectionStage: React.FC<PlanSelectionStageProps> = ({
                 )}
 
                 <div style={{ marginTop: "auto", paddingTop: "1rem" }}>
-                  <Button variant="light" fullWidth size="lg">
+                  <Button variant="secondary" fullWidth>
                     {t("payment.planStage.selectMonthly", "Select Monthly")}
                   </Button>
                 </div>
@@ -200,7 +193,7 @@ export const PlanSelectionStage: React.FC<PlanSelectionStageProps> = ({
                 )}
 
                 <div style={{ marginTop: "auto", paddingTop: "1rem" }}>
-                  <Button variant="filled" fullWidth size="lg">
+                  <Button fullWidth>
                     {t("payment.planStage.selectYearly", "Select Yearly")}
                   </Button>
                 </div>
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.tsx
index 9f0bff06df..a25f2d9705 100644
--- a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.tsx
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.tsx
@@ -1,14 +1,6 @@
 import React from "react";
-import {
-  Alert,
-  Stack,
-  Text,
-  Paper,
-  Code,
-  Button,
-  Group,
-  Loader,
-} from "@mantine/core";
+import { Alert, Stack, Text, Paper, Code, Group, Loader } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { PollingStatus } from "@app/components/shared/stripeCheckout/types/checkout";
 
@@ -63,7 +55,7 @@ export const SuccessStage: React.FC<SuccessStageProps> = ({
               </Text>
               <Code block>{licenseKey}</Code>
               <Button
-                variant="light"
+                variant="secondary"
                 size="sm"
                 onClick={() => navigator.clipboard.writeText(licenseKey)}
               >
@@ -113,7 +105,10 @@ export const SuccessStage: React.FC<SuccessStageProps> = ({
           </Text>
         )}
 
-        <Button onClick={onClose} mt="md">
+        <Button
+          onClick={onClose}
+          style={{ marginTop: "var(--mantine-spacing-md)" }}
+        >
           {t("common.close", "Close")}
         </Button>
       </Stack>
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx b/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
index dd4bfa41fe..f5fc841689 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
@@ -1,7 +1,8 @@
 import React, { useState, useEffect } from "react";
 import { createPortal } from "react-dom";
 import { useTranslation } from "react-i18next";
-import { Text, ActionIcon, ScrollArea } from "@mantine/core";
+import { Text, ScrollArea } from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
 import {
   CardModalPhase,
@@ -198,9 +199,8 @@ export function CardExpansionModal({
             </div>
 
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="lg"
-              color="gray"
               onClick={onClose}
               aria-label={t("close", "Close")}
               style={{
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/DeleteFolderConfirmModal.tsx b/frontend/editor/src/proprietary/components/watchedFolders/DeleteFolderConfirmModal.tsx
index bd398858a7..35b5bd95e9 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/DeleteFolderConfirmModal.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/DeleteFolderConfirmModal.tsx
@@ -1,4 +1,5 @@
-import { Modal, Text, Button, Stack, Group } from "@mantine/core";
+import { Modal, Text, Stack, Group } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { WatchedFolder } from "@app/types/watchedFolders";
 
@@ -43,10 +44,15 @@ export function DeleteFolderConfirmModal({
           )}
         </Text>
         <Group gap="sm" justify="flex-end">
-          <Button variant="outline" size="sm" onClick={onCancel}>
+          <Button variant="secondary" size="sm" onClick={onCancel}>
             {t("cancel", "Cancel")}
           </Button>
-          <Button color="red" size="sm" onClick={onConfirm}>
+          <Button
+            variant="primary"
+            accent="danger"
+            size="sm"
+            onClick={onConfirm}
+          >
             {t("delete", "Delete")}
           </Button>
         </Group>
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
index 0e1612f447..44b2b0c657 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
@@ -1,5 +1,7 @@
 import { useState } from "react";
-import { Box, Button, Text, ActionIcon, Group, Loader } from "@mantine/core";
+import { Box, Text, Group, Loader } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import EditIcon from "@mui/icons-material/Edit";
 import DeleteIcon from "@mui/icons-material/Delete";
@@ -83,11 +85,17 @@ export function WatchedFolderCard({
       }
     >
       <Button
-        variant={isActive ? "light" : "subtle"}
+        variant="tertiary"
+        accent="neutral"
+        size="sm"
         className="tool-button"
         fullWidth
-        justify="flex-start"
-        px="sm"
+        justify="start"
+        style={
+          isActive
+            ? { backgroundColor: "var(--tool-button-selected-bg)" }
+            : undefined
+        }
         leftSection={
           <Box
             style={{
@@ -110,8 +118,9 @@ export function WatchedFolderCard({
           isHovered ? (
             <Group gap={2} onClick={(e) => e.stopPropagation()}>
               <ActionIcon
-                size="xs"
-                variant="subtle"
+                as="span"
+                size="sm"
+                variant="tertiary"
                 onClick={onEdit}
                 aria-label={t("watchedFolders.card.edit", "Edit folder")}
               >
@@ -119,9 +128,10 @@ export function WatchedFolderCard({
               </ActionIcon>
               {!folder.isDefault && (
                 <ActionIcon
-                  size="xs"
-                  variant="subtle"
-                  color="red"
+                  as="span"
+                  size="sm"
+                  variant="tertiary"
+                  accent="danger"
                   onClick={onDelete}
                   aria-label={t("watchedFolders.card.delete", "Delete folder")}
                 >
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
index 798d340567..f1110c9a2a 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
@@ -1,14 +1,7 @@
 import { useState, useCallback, useEffect } from "react";
-import {
-  Box,
-  Text,
-  Stack,
-  Group,
-  ActionIcon,
-  Button,
-  Loader,
-  ScrollArea,
-} from "@mantine/core";
+import { Box, Text, Stack, Group, Loader, ScrollArea } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import AddIcon from "@mui/icons-material/Add";
 import EditIcon from "@mui/icons-material/Edit";
@@ -243,7 +236,7 @@ function FolderCard({
       <div className="wf-card-actions" onClick={(e) => e.stopPropagation()}>
         <ActionIcon
           size="md"
-          variant="subtle"
+          variant="tertiary"
           onClick={() => onTogglePause(folder)}
           aria-label={
             isPaused
@@ -264,7 +257,7 @@ function FolderCard({
         </ActionIcon>
         <ActionIcon
           size="md"
-          variant="subtle"
+          variant="tertiary"
           onClick={() => onEdit(folder)}
           aria-label={t("watchedFolders.home.editFolder", "Edit folder")}
         >
@@ -272,8 +265,8 @@ function FolderCard({
         </ActionIcon>
         <ActionIcon
           size="md"
-          variant="subtle"
-          color="red"
+          variant="tertiary"
+          accent="danger"
           onClick={() => onDelete(folder)}
           aria-label={t("watchedFolders.home.deleteFolder", "Delete folder")}
         >
@@ -343,9 +336,8 @@ function HowItWorks() {
           </Text>
         </Group>
         <ActionIcon
-          size="xs"
-          variant="subtle"
-          color="gray"
+          size="sm"
+          variant="tertiary"
           onClick={() => {
             sessionStorage.setItem("wf_howItWorks_dismissed", "1");
             setDismissed(true);
@@ -353,7 +345,10 @@ function HowItWorks() {
           aria-label={t("watchedFolders.actions.dismiss", "Dismiss")}
         >
           <CloseIcon
-            style={{ fontSize: "0.75rem", color: "var(--mantine-color-text)" }}
+            style={{
+              fontSize: "0.75rem",
+              color: "var(--mantine-color-text)",
+            }}
           />
         </ActionIcon>
       </Group>
@@ -418,9 +413,10 @@ function EmptyState({ onCreate }: { onCreate: () => void }) {
 
       <Button
         size="md"
+        variant="primary"
         leftSection={<AddIcon style={{ fontSize: "1.125rem" }} />}
         onClick={onCreate}
-        mt="sm"
+        style={{ marginTop: "var(--mantine-spacing-sm)" }}
       >
         {t("watchedFolders.home.create", "Create your first Watched Folder")}
       </Button>
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
index daba774bfb..362d4cf7b0 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
@@ -1,6 +1,5 @@
 import { useState, useCallback, useRef, useEffect } from "react";
 import {
-  Button,
   Stack,
   Group,
   TextInput,
@@ -15,6 +14,7 @@ import {
   Tooltip,
   Modal,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { WatchedFolder } from "@app/types/watchedFolders";
 import { AutomationConfig, AutomationMode } from "@app/types/automation";
@@ -478,8 +478,8 @@ export function WatchedFolderManagementModal({
                             </Text>
                           </Stack>
                           <Button
-                            size="xs"
-                            variant="subtle"
+                            size="sm"
+                            variant="tertiary"
                             onClick={async () => {
                               try {
                                 const handle = await (
@@ -505,9 +505,9 @@ export function WatchedFolderManagementModal({
                           </Button>
                           {inputDirName && (
                             <Button
-                              size="xs"
-                              variant="subtle"
-                              color="red"
+                              size="sm"
+                              variant="tertiary"
+                              accent="danger"
                               onClick={() => {
                                 pendingInputDirHandle.current = null;
                                 setInputDirName(null);
@@ -575,8 +575,8 @@ export function WatchedFolderManagementModal({
                         zIndex={Z_INDEX_AUTOMATE_DROPDOWN}
                       >
                         <Button
-                          size="xs"
-                          variant="subtle"
+                          size="sm"
+                          variant="tertiary"
                           disabled={!canWriteLocalFolder}
                           onClick={async () => {
                             try {
@@ -601,9 +601,9 @@ export function WatchedFolderManagementModal({
                       </Tooltip>
                       {outputDirName && (
                         <Button
-                          size="xs"
-                          variant="subtle"
-                          color="red"
+                          size="sm"
+                          variant="tertiary"
+                          accent="danger"
                           onClick={() => {
                             pendingDirHandle.current = null;
                             setOutputDirName(null);
@@ -619,15 +619,13 @@ export function WatchedFolderManagementModal({
 
               {/* ── Advanced (collapsible) ── */}
               <div>
-                <button
+                <Button
+                  variant="tertiary"
                   onClick={() => setShowAdvanced((v) => !v)}
                   style={{
                     display: "flex",
                     alignItems: "center",
                     gap: "0.35rem",
-                    background: "none",
-                    border: "none",
-                    cursor: "pointer",
                     padding: "0.25rem 0",
                     width: "100%",
                     color: "var(--tool-subcategory-text-color)",
@@ -645,7 +643,7 @@ export function WatchedFolderManagementModal({
                     }}
                   />
                   {t("watchedFolders.modal.advanced", "Advanced")}
-                </button>
+                </Button>
 
                 <Collapse in={showAdvanced} transitionDuration={180}>
                   <Stack gap="sm" mt="sm">
@@ -828,15 +826,11 @@ export function WatchedFolderManagementModal({
               </Alert>
             )}
             <Group justify="flex-end" gap="sm">
-              <Button
-                variant="subtle"
-                size="sm"
-                color="gray"
-                onClick={handleClose}
-              >
+              <Button variant="tertiary" size="sm" onClick={handleClose}>
                 {t("cancel", "Cancel")}
               </Button>
               <Button
+                variant="primary"
                 size="sm"
                 onClick={handleSave}
                 loading={saving}
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
index 5b3345608d..67073a023a 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
-import { Box, Button, Text, Stack } from "@mantine/core";
+import { Box, Text, Stack } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import AddIcon from "@mui/icons-material/Add";
 import { useWatchedFolders } from "@app/hooks/useWatchedFolders";
@@ -132,11 +133,12 @@ export function WatchedFolderSection() {
           ))}
 
           <Button
-            variant="subtle"
+            variant="tertiary"
+            accent="neutral"
+            size="sm"
             className="tool-button"
             fullWidth
-            justify="flex-start"
-            px="sm"
+            justify="start"
             leftSection={
               <AddIcon
                 style={{ fontSize: 14, color: "var(--mantine-color-gray-5)" }}
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
index 0492949301..4954cebfc3 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
@@ -10,14 +10,14 @@ import {
   Text,
   Stack,
   Group,
-  Button,
-  ActionIcon,
   Modal,
   ScrollArea,
   Loader,
   TextInput,
   Select,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { Z_INDEX_OVER_FILE_MANAGER_MODAL } from "@app/styles/zIndex";
 
 import { useCardModalAnimation } from "@app/hooks/useCardModalAnimation";
@@ -860,9 +860,8 @@ export function WatchedFolderWorkbenchView({
         <Group justify="space-between" align="center">
           <Group gap="md" align="center">
             <ActionIcon
-              variant="subtle"
+              variant="tertiary"
               size="sm"
-              color="gray"
               onClick={goHome}
               aria-label={t("watchedFolders.actions.back", "Back")}
             >
@@ -977,9 +976,9 @@ export function WatchedFolderWorkbenchView({
           <Group gap="sm" align="center">
             {folder.isPaused ? (
               <Button
-                size="xs"
-                variant="light"
-                color="green"
+                size="sm"
+                variant="secondary"
+                accent="success"
                 onClick={handlePauseResume}
                 leftSection={<PlayArrowIcon style={{ fontSize: "0.875rem" }} />}
               >
@@ -987,9 +986,8 @@ export function WatchedFolderWorkbenchView({
               </Button>
             ) : (
               <Button
-                size="xs"
-                variant="subtle"
-                color="gray"
+                size="sm"
+                variant="tertiary"
                 onClick={handlePauseResume}
                 leftSection={<PauseIcon style={{ fontSize: "0.875rem" }} />}
               >
@@ -997,8 +995,8 @@ export function WatchedFolderWorkbenchView({
               </Button>
             )}
             <Button
-              size="xs"
-              variant="light"
+              size="sm"
+              variant="secondary"
               onClick={() =>
                 document
                   .getElementById(`folder-file-input-${folderId}`)
@@ -1277,8 +1275,8 @@ export function WatchedFolderWorkbenchView({
             {activityStatusFilter === "error" &&
               filteredActivityIds.length > 0 && (
                 <Button
-                  size="xs"
-                  variant="outline"
+                  size="sm"
+                  variant="secondary"
                   onClick={handleRetryAllFiltered}
                   leftSection={<ReplayIcon style={{ fontSize: "0.75rem" }} />}
                 >
@@ -1289,8 +1287,8 @@ export function WatchedFolderWorkbenchView({
               filteredActivityIds.length > 0 && (
                 <>
                   <Button
-                    size="xs"
-                    variant="outline"
+                    size="sm"
+                    variant="secondary"
                     onClick={() =>
                       void handleBatchDownload(filteredActivityIds)
                     }
@@ -1301,8 +1299,8 @@ export function WatchedFolderWorkbenchView({
                     {t("watchedFolders.workbench.exportZip", "Export zip")}
                   </Button>
                   <Button
-                    size="xs"
-                    variant="outline"
+                    size="sm"
+                    variant="secondary"
                     onClick={() =>
                       void handleBatchDownloadSeparate(filteredActivityIds)
                     }
@@ -1384,8 +1382,8 @@ export function WatchedFolderWorkbenchView({
                   </Text>
                   {selectedActivityIds.size < filteredActivityIds.length && (
                     <Button
-                      size="xs"
-                      variant="subtle"
+                      size="sm"
+                      variant="tertiary"
                       onClick={() =>
                         setSelectedActivityIds(new Set(filteredActivityIds))
                       }
@@ -1399,8 +1397,8 @@ export function WatchedFolderWorkbenchView({
                   <Box style={{ flex: 1 }} />
                   {showRetry && (
                     <Button
-                      size="xs"
-                      variant="outline"
+                      size="sm"
+                      variant="secondary"
                       onClick={handleBatchRetry}
                       leftSection={
                         <ReplayIcon style={{ fontSize: "0.75rem" }} />
@@ -1412,8 +1410,8 @@ export function WatchedFolderWorkbenchView({
                   {showExport && (
                     <>
                       <Button
-                        size="xs"
-                        variant="outline"
+                        size="sm"
+                        variant="secondary"
                         onClick={() => void handleBatchDownload()}
                         leftSection={
                           <DownloadIcon style={{ fontSize: "0.75rem" }} />
@@ -1422,8 +1420,8 @@ export function WatchedFolderWorkbenchView({
                         {t("watchedFolders.workbench.exportZip", "Export zip")}
                       </Button>
                       <Button
-                        size="xs"
-                        variant="outline"
+                        size="sm"
+                        variant="secondary"
                         onClick={() => void handleBatchDownloadSeparate()}
                         leftSection={
                           <DownloadIcon style={{ fontSize: "0.75rem" }} />
@@ -1437,9 +1435,9 @@ export function WatchedFolderWorkbenchView({
                     </>
                   )}
                   <Button
-                    size="xs"
-                    variant="outline"
-                    color="red"
+                    size="sm"
+                    variant="secondary"
+                    accent="danger"
                     onClick={() => void handleBatchDelete()}
                     leftSection={
                       <DeleteOutlineIcon style={{ fontSize: "0.75rem" }} />
@@ -1448,9 +1446,8 @@ export function WatchedFolderWorkbenchView({
                     {t("watchedFolders.workbench.delete", "Delete")}
                   </Button>
                   <ActionIcon
-                    variant="subtle"
+                    variant="tertiary"
                     size="sm"
-                    color="gray"
                     onClick={() => setSelectedActivityIds(new Set())}
                     aria-label={t(
                       "watchedFolders.workbench.clearSelection",
@@ -1536,9 +1533,8 @@ export function WatchedFolderWorkbenchView({
                           }
                         >
                           <ActionIcon
-                            variant="subtle"
+                            variant="tertiary"
                             size="sm"
-                            color="gray"
                             style={{ flexShrink: 0 }}
                             onClick={(e) => {
                               e.stopPropagation();
@@ -1666,9 +1662,8 @@ export function WatchedFolderWorkbenchView({
                             >
                               {!isExpanded && primaryFile && (
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     handleView(primaryFile);
@@ -1685,9 +1680,8 @@ export function WatchedFolderWorkbenchView({
                               )}
                               {!isExpanded && primaryFile && (
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     void handleDownload(
@@ -1706,9 +1700,8 @@ export function WatchedFolderWorkbenchView({
                                 </ActionIcon>
                               )}
                               <ActionIcon
-                                variant="subtle"
+                                variant="tertiary"
                                 size="sm"
-                                color="gray"
                                 onClick={(e) => {
                                   e.stopPropagation();
                                   void handleDeleteOne(fileId);
@@ -1777,9 +1770,8 @@ export function WatchedFolderWorkbenchView({
                                   {formatBytes(inputFile.size)}
                                 </Text>
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     handleView(inputFile);
@@ -1794,9 +1786,8 @@ export function WatchedFolderWorkbenchView({
                                   />
                                 </ActionIcon>
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     handleDownload(inputFile, inputFile.name);
@@ -1852,9 +1843,8 @@ export function WatchedFolderWorkbenchView({
                                   {formatBytes(out.size)}
                                 </Text>
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     handleView(out);
@@ -1869,9 +1859,8 @@ export function WatchedFolderWorkbenchView({
                                   />
                                 </ActionIcon>
                                 <ActionIcon
-                                  variant="subtle"
+                                  variant="tertiary"
                                   size="sm"
-                                  color="gray"
                                   onClick={(e) => {
                                     e.stopPropagation();
                                     handleDownload(out, out.name);
@@ -1915,8 +1904,8 @@ export function WatchedFolderWorkbenchView({
                                 )}
                                 {inputFile && (
                                   <Button
-                                    size="xs"
-                                    variant="light"
+                                    size="sm"
+                                    variant="secondary"
                                     style={{ flexShrink: 0 }}
                                     leftSection={
                                       <ReplayIcon
@@ -2000,9 +1989,8 @@ export function WatchedFolderWorkbenchView({
               {(["24h", "7d", "30d", "all"] as const).map((p) => (
                 <Button
                   key={p}
-                  size="xs"
-                  variant={statsPeriod === p ? "light" : "subtle"}
-                  color={statsPeriod === p ? "blue" : "gray"}
+                  size="sm"
+                  variant={statsPeriod === p ? "secondary" : "tertiary"}
                   onClick={() => setStatsPeriod(p)}
                 >
                   {p === "all"
@@ -2412,11 +2400,11 @@ export function WatchedFolderWorkbenchView({
             )}
           </Text>
           <Group justify="flex-end">
-            <Button variant="default" onClick={() => setDeleteConfirm(null)}>
+            <Button variant="secondary" onClick={() => setDeleteConfirm(null)}>
               {t("watchedFolders.workbench.cancel", "Cancel")}
             </Button>
             <Button
-              variant="default"
+              variant="secondary"
               onClick={() =>
                 deleteConfirm && void execDelete(deleteConfirm.ids, false)
               }
@@ -2427,7 +2415,8 @@ export function WatchedFolderWorkbenchView({
               )}
             </Button>
             <Button
-              color="red"
+              variant="primary"
+              accent="danger"
               onClick={() =>
                 deleteConfirm && void execDelete(deleteConfirm.ids, true)
               }
diff --git a/frontend/editor/src/proprietary/components/workflow/ParticipantView.tsx b/frontend/editor/src/proprietary/components/workflow/ParticipantView.tsx
index 20191a8b57..c8d000a5dc 100644
--- a/frontend/editor/src/proprietary/components/workflow/ParticipantView.tsx
+++ b/frontend/editor/src/proprietary/components/workflow/ParticipantView.tsx
@@ -6,13 +6,13 @@ import {
   Text,
   Badge,
   Group,
-  Button,
   Loader,
   Alert,
   TextInput,
   FileInput,
   Select,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useParticipantSession } from "@app/hooks/workflow/useParticipantSession";
 import InfoIcon from "@mui/icons-material/Info";
 import DownloadIcon from "@mui/icons-material/Download";
@@ -314,7 +314,7 @@ const ParticipantView: React.FC<ParticipantViewProps> = ({ token }) => {
               size="sm"
               leftSection={<DownloadIcon fontSize="small" />}
               onClick={() => downloadDocument(token)}
-              variant="light"
+              variant="secondary"
             >
               {t("workflow.participant.downloadDocument", "Download Document")}
             </Button>
@@ -489,7 +489,7 @@ const ParticipantView: React.FC<ParticipantViewProps> = ({ token }) => {
                 disabled={
                   isSubmitting || certValidation.status === "validating"
                 }
-                color="green"
+                accent="success"
                 data-testid="submit-signature-button"
               >
                 {t("workflow.participant.submitSignature", "Submit Signature")}
@@ -498,8 +498,8 @@ const ParticipantView: React.FC<ParticipantViewProps> = ({ token }) => {
               <Button
                 leftSection={<CancelIcon fontSize="small" />}
                 onClick={handleDecline}
-                color="red"
-                variant="light"
+                variant="secondary"
+                accent="danger"
                 data-testid="decline-button"
               >
                 {t("workflow.participant.decline", "Decline")}
diff --git a/frontend/editor/src/proprietary/routes/InviteAccept.tsx b/frontend/editor/src/proprietary/routes/InviteAccept.tsx
index 76ed0df90b..080cf4275a 100644
--- a/frontend/editor/src/proprietary/routes/InviteAccept.tsx
+++ b/frontend/editor/src/proprietary/routes/InviteAccept.tsx
@@ -18,7 +18,7 @@ import LoginHeader from "@app/routes/login/LoginHeader";
 import ErrorMessage from "@app/auth/ui/ErrorMessage";
 import { BASE_PATH } from "@app/constants/app";
 import apiClient from "@app/services/apiClient";
-
+import { Button } from "@app/ui/Button";
 interface InviteData {
   email: string | null;
   role: string;
@@ -163,13 +163,13 @@ export default function InviteAccept() {
         />
         <ErrorMessage error={error} />
         <div className="auth-section">
-          <button
+          <Button
             type="button"
             onClick={() => navigate("/login")}
             className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold cursor-pointer border-0 auth-cta-button"
           >
             {t("invite.goToLogin", "Go to Login")}
-          </button>
+          </Button>
         </div>
       </AuthLayout>
     );
@@ -259,7 +259,7 @@ export default function InviteAccept() {
           />
 
           <div className="auth-section">
-            <button
+            <Button
               type="submit"
               disabled={submitting}
               className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold cursor-pointer border-0 disabled:opacity-50 disabled:cursor-not-allowed auth-cta-button"
@@ -267,7 +267,7 @@ export default function InviteAccept() {
               {submitting
                 ? t("invite.creating", "Creating Account...")
                 : t("invite.createAccount", "Create Account")}
-            </button>
+            </Button>
           </div>
         </Stack>
       </form>
diff --git a/frontend/editor/src/proprietary/routes/Landing.tsx b/frontend/editor/src/proprietary/routes/Landing.tsx
index 91b79bbf8a..d22acbba56 100644
--- a/frontend/editor/src/proprietary/routes/Landing.tsx
+++ b/frontend/editor/src/proprietary/routes/Landing.tsx
@@ -7,6 +7,7 @@ import { useBackendProbe } from "@app/hooks/useBackendProbe";
 import AuthLayout from "@app/routes/authShared/AuthLayout";
 import LoginHeader from "@app/routes/login/LoginHeader";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 
 /**
  * Landing component - Smart router based on authentication status
@@ -149,14 +150,14 @@ export default function Landing() {
               "The application cannot currently connect to the backend. Verify the backend status and network connectivity, then try again.",
             )}
           </p>
-          <button
+          <Button
             type="button"
             onClick={handleRetry}
             className="auth-cta-button px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold mt-5 border-0 cursor-pointer"
             style={{ width: "fit-content" }}
           >
             {t("backendStartup.retry", "Retry")}
-          </button>
+          </Button>
         </div>
       </AuthLayout>
     );
diff --git a/frontend/editor/src/proprietary/routes/Login.test.tsx b/frontend/editor/src/proprietary/routes/Login.test.tsx
index 0360da737c..7a232d0fde 100644
--- a/frontend/editor/src/proprietary/routes/Login.test.tsx
+++ b/frontend/editor/src/proprietary/routes/Login.test.tsx
@@ -326,13 +326,13 @@ describe("Login", () => {
     // Wait for OAuth button to appear
     await waitFor(
       () => {
-        const button = screen.queryByText("Authentik");
+        const button = screen.queryByText(/Authentik/);
         expect(button).toBeTruthy();
       },
       { timeout: 3000 },
     );
 
-    const oauthButton = screen.getByText("Authentik");
+    const oauthButton = screen.getByText(/Authentik/);
     await user.click(oauthButton);
 
     await waitFor(() => {
@@ -372,13 +372,13 @@ describe("Login", () => {
     // Wait for OAuth button to appear (will show 'Mycompany' as label)
     await waitFor(
       () => {
-        const button = screen.queryByText("Mycompany");
+        const button = screen.queryByText(/Mycompany/);
         expect(button).toBeTruthy();
       },
       { timeout: 3000 },
     );
 
-    const oauthButton = screen.getByText("Mycompany");
+    const oauthButton = screen.getByText(/Mycompany/);
     await user.click(oauthButton);
 
     await waitFor(() => {
@@ -419,13 +419,13 @@ describe("Login", () => {
     // Wait for OAuth button to appear
     await waitFor(
       () => {
-        const button = screen.queryByText("OIDC");
+        const button = screen.queryByText(/OIDC/);
         expect(button).toBeTruthy();
       },
       { timeout: 3000 },
     );
 
-    const oauthButton = screen.getByText("OIDC");
+    const oauthButton = screen.getByText(/OIDC/);
     await user.click(oauthButton);
 
     await waitFor(() => {
@@ -761,12 +761,12 @@ describe("Login", () => {
 
     await waitFor(
       () => {
-        expect(screen.getByText("Authentik")).toBeTruthy();
+        expect(screen.getByText(/Authentik/)).toBeTruthy();
       },
       { timeout: 3000 },
     );
 
-    await user.click(screen.getByText("Authentik"));
+    await user.click(screen.getByText(/Authentik/));
 
     await waitFor(() => {
       expect(springAuth.signInWithOAuth).toHaveBeenCalled();
diff --git a/frontend/editor/src/proprietary/routes/Login.tsx b/frontend/editor/src/proprietary/routes/Login.tsx
index 1e12f73e89..47920f6c62 100644
--- a/frontend/editor/src/proprietary/routes/Login.tsx
+++ b/frontend/editor/src/proprietary/routes/Login.tsx
@@ -6,6 +6,7 @@ import {
   useSearchParams,
 } from "react-router-dom";
 import { Text, Stack, Alert } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { setPostLoginRedirectPath } from "@app/auth/spring/springAuthClient";
 import { useAuth } from "@app/auth/UseSession";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
@@ -435,14 +436,14 @@ export default function Login() {
               "The application cannot currently connect to the backend. Verify the backend status and network connectivity, then try again.",
             )}
           </p>
-          <button
+          <Button
             type="button"
             onClick={handleRetry}
             className="auth-cta-button px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold mt-5 border-0 cursor-pointer"
             style={{ width: "fit-content" }}
           >
             {t("backendStartup.retry", "Retry")}
-          </button>
+          </Button>
         </div>
       </AuthLayout>
     );
@@ -486,14 +487,16 @@ export default function Login() {
         beforeEmailForm={
           hasSSOProviders && !showEmailForm && isUserPassAllowed ? (
             <div className="auth-section">
-              <button
+              <Button
                 type="button"
+                variant="tertiary"
+                hover={false}
                 onClick={() => setShowEmailForm(true)}
                 disabled={login.isSubmitting}
                 className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold mb-2 cursor-pointer border-0 disabled:opacity-50 disabled:cursor-not-allowed auth-cta-button"
               >
                 {t("login.useEmailInstead", "Login with email")}
-              </button>
+              </Button>
             </div>
           ) : undefined
         }
diff --git a/frontend/editor/src/proprietary/routes/ShareLinkPage.tsx b/frontend/editor/src/proprietary/routes/ShareLinkPage.tsx
index 915ec3c07d..aef9b6f4f7 100644
--- a/frontend/editor/src/proprietary/routes/ShareLinkPage.tsx
+++ b/frontend/editor/src/proprietary/routes/ShareLinkPage.tsx
@@ -4,7 +4,6 @@ import { useNavigate, useParams } from "react-router-dom";
 import {
   Alert,
   Badge,
-  Button,
   Group,
   Loader,
   Paper,
@@ -13,6 +12,7 @@ import {
   Title,
 } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
 import DownloadIcon from "@mui/icons-material/Download";
 import LoginIcon from "@mui/icons-material/Login";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
@@ -232,7 +232,7 @@ export default function ShareLinkPage() {
                   {t("storageShare.openInApp", "Open in Stirling PDF")}
                 </Button>
                 <Button
-                  variant="light"
+                  variant="secondary"
                   leftSection={<DownloadIcon style={{ fontSize: 18 }} />}
                   onClick={handleDownload}
                   loading={isWorking}
diff --git a/frontend/editor/src/proprietary/routes/Signup.tsx b/frontend/editor/src/proprietary/routes/Signup.tsx
index dab0ac2624..68be029969 100644
--- a/frontend/editor/src/proprietary/routes/Signup.tsx
+++ b/frontend/editor/src/proprietary/routes/Signup.tsx
@@ -16,6 +16,7 @@ import {
   SignupFieldErrors,
 } from "@app/routes/signup/SignupFormValidation";
 import { useAuthService } from "@app/routes/signup/AuthService";
+import { Button } from "@app/ui/Button";
 import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
 
 export default function Signup() {
@@ -130,13 +131,13 @@ export default function Signup() {
 
       {/* Bottom row - centered */}
       <div style={{ textAlign: "center", margin: "0.5rem 0 0.25rem" }}>
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={() => navigate("/login")}
           className="auth-link-black"
         >
           {t("login.logIn", "Log In")}
-        </button>
+        </Button>
       </div>
     </AuthLayout>
   );
diff --git a/frontend/editor/src/proprietary/routes/login/NavigationLink.tsx b/frontend/editor/src/proprietary/routes/login/NavigationLink.tsx
index dcb5bd9380..0ca283af2d 100644
--- a/frontend/editor/src/proprietary/routes/login/NavigationLink.tsx
+++ b/frontend/editor/src/proprietary/routes/login/NavigationLink.tsx
@@ -1,5 +1,4 @@
-import { Button } from "@mantine/core";
-
+import { Button } from "@app/ui/Button";
 interface NavigationLinkProps {
   onClick: () => void;
   text: string;
@@ -17,7 +16,7 @@ export default function NavigationLink({
         onClick={onClick}
         disabled={isDisabled}
         className="navigation-link-button"
-        variant="subtle"
+        variant="tertiary"
       >
         {text}
       </Button>
diff --git a/frontend/editor/src/proprietary/routes/login/OAuthButtons.stories.tsx b/frontend/editor/src/proprietary/routes/login/OAuthButtons.stories.tsx
new file mode 100644
index 0000000000..c60ce89feb
--- /dev/null
+++ b/frontend/editor/src/proprietary/routes/login/OAuthButtons.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import OAuthButtons from "@app/auth/ui/OAuthButtons";
+import "@app/auth/ui/auth.css";
+
+/**
+ * The OAuth provider buttons the login page renders
+ */
+const meta: Meta<typeof OAuthButtons> = {
+  title: "Auth/OAuth Buttons",
+  component: OAuthButtons,
+  parameters: { layout: "centered" },
+  args: {
+    onProviderClick: () => {},
+    isSubmitting: false,
+    enabledProviders: ["google", "github", "apple", "azure"],
+  },
+};
+export default meta;
+type Story = StoryObj<typeof OAuthButtons>;
+
+export const Vertical: Story = {
+  render: (args) => (
+    <div style={{ width: 320 }}>
+      <OAuthButtons {...args} layout="vertical" />
+    </div>
+  ),
+};
+export const Grid: Story = {
+  render: (args) => <OAuthButtons {...args} layout="grid" />,
+};
+export const Icons: Story = {
+  render: (args) => <OAuthButtons {...args} layout="icons" />,
+};
diff --git a/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx b/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
index a47d6e6600..8b6ef3d272 100644
--- a/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
+++ b/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
@@ -1,7 +1,8 @@
 import { useEffect } from "react";
 import "@app/auth/ui/auth.css";
 import { useTranslation } from "react-i18next";
-import { Checkbox, TextInput, PasswordInput, Button } from "@mantine/core";
+import { Checkbox, TextInput, PasswordInput } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { SignupFieldErrors } from "@app/routes/signup/SignupFormValidation";
 
 interface SignupFormProps {
diff --git a/frontend/editor/src/proprietary/ui/Button.css b/frontend/editor/src/proprietary/ui/Button.css
deleted file mode 100644
index 8b474e7f42..0000000000
--- a/frontend/editor/src/proprietary/ui/Button.css
+++ /dev/null
@@ -1,118 +0,0 @@
-.sui-btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.5rem;
-  border: 1px solid transparent;
-  border-radius: var(--radius-md);
-  font-family: var(--font-sans);
-  font-weight: 500;
-  cursor: pointer;
-  transition:
-    transform var(--motion-fast),
-    box-shadow var(--motion-fast),
-    background var(--motion-fast),
-    color var(--motion-fast),
-    border-color var(--motion-fast);
-  white-space: nowrap;
-  user-select: none;
-}
-.sui-btn:disabled {
-  cursor: not-allowed;
-  opacity: 0.55;
-}
-.sui-btn:focus-visible {
-  outline: 2px solid var(--color-blue);
-  outline-offset: 2px;
-}
-
-/* sizes */
-.sui-btn--md {
-  font-size: 0.8125rem;
-  padding: 0.4375rem 0.875rem;
-  min-height: 2rem;
-}
-.sui-btn--sm {
-  font-size: 0.75rem;
-  padding: 0.3125rem 0.625rem;
-  min-height: 1.625rem;
-  border-radius: var(--radius-sm);
-}
-
-.sui-btn--full {
-  width: 100%;
-  justify-content: center;
-}
-
-/* gradient (primary) */
-.sui-btn--gradient {
-  color: var(--color-text-on-accent);
-  background: var(--grad-blue-btn);
-  box-shadow: var(--shadow-blue);
-}
-.sui-btn--gradient.sui-btn--purple {
-  background: var(--grad-purple-btn);
-}
-.sui-btn--gradient.sui-btn--green {
-  background: var(--grad-green-btn);
-}
-.sui-btn--gradient:hover:not(:disabled) {
-  box-shadow: var(--shadow-blue-hover);
-  transform: translateY(-0.0625rem);
-}
-.sui-btn--gradient:active:not(:disabled) {
-  transform: translateY(0);
-}
-
-/* outline (secondary) */
-.sui-btn--outline {
-  color: var(--color-text-2);
-  background: var(--color-surface);
-  border-color: var(--color-border);
-}
-.sui-btn--outline.sui-btn--blue {
-  color: var(--color-blue);
-  border-color: var(--color-blue-border);
-}
-.sui-btn--outline.sui-btn--purple {
-  color: var(--color-purple);
-  border-color: var(--color-purple-border);
-}
-.sui-btn--outline.sui-btn--green {
-  color: var(--color-green);
-  border-color: var(--color-green-border);
-}
-.sui-btn--outline.sui-btn--amber {
-  color: var(--color-amber);
-  border-color: var(--color-amber-border);
-}
-.sui-btn--outline.sui-btn--red {
-  color: var(--color-red);
-  border-color: var(--color-red-border);
-}
-.sui-btn--outline:hover:not(:disabled) {
-  background: var(--color-bg-hover);
-  border-color: var(--color-border-hover);
-}
-
-/* ghost (tertiary) */
-.sui-btn--ghost {
-  color: var(--color-text-3);
-  background: transparent;
-}
-.sui-btn--ghost:hover:not(:disabled) {
-  color: var(--color-text-1);
-  background: var(--color-bg-hover);
-}
-
-/* spinner */
-.sui-btn__spinner {
-  width: 0.875rem;
-  height: 0.875rem;
-  border-radius: 50%;
-  border: 2px solid currentColor;
-  border-right-color: transparent;
-  animation: spin 0.7s linear infinite;
-}
-.sui-btn__label {
-  display: inline-block;
-}
diff --git a/frontend/editor/src/proprietary/ui/Button.stories.tsx b/frontend/editor/src/proprietary/ui/Button.stories.tsx
deleted file mode 100644
index 66b203ec3b..0000000000
--- a/frontend/editor/src/proprietary/ui/Button.stories.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react";
-import { Button } from "@app/ui/Button";
-
-const meta: Meta<typeof Button> = {
-  title: "Primitives/Button",
-  component: Button,
-  parameters: { layout: "centered" },
-  args: { children: "Connect agent" },
-  argTypes: {
-    variant: {
-      control: "inline-radio",
-      options: ["gradient", "outline", "ghost"],
-    },
-    accent: {
-      control: "inline-radio",
-      options: ["blue", "purple", "green", "amber", "red"],
-    },
-    size: { control: "inline-radio", options: ["sm", "md"] },
-  },
-};
-export default meta;
-type Story = StoryObj<typeof Button>;
-
-export const Gradient: Story = { args: { variant: "gradient" } };
-export const Outline: Story = { args: { variant: "outline" } };
-export const Ghost: Story = { args: { variant: "ghost" } };
-
-export const WithTrailingArrow: Story = {
-  args: {
-    variant: "gradient",
-    children: "Build a pipeline",
-    trailingIcon: <span aria-hidden>→</span>,
-  },
-};
-
-export const Loading: Story = { args: { variant: "gradient", loading: true } };
-export const Disabled: Story = {
-  args: { variant: "gradient", disabled: true },
-};
-
-export const AccentMatrix: Story = {
-  render: () => (
-    <div style={{ display: "flex", flexWrap: "wrap", gap: 8 }}>
-      {(["gradient", "outline"] as const).flatMap((variant) =>
-        (["blue", "purple", "green", "amber", "red"] as const).map((accent) => (
-          <Button
-            key={`${variant}-${accent}`}
-            variant={variant}
-            accent={accent}
-          >
-            {variant} · {accent}
-          </Button>
-        )),
-      )}
-    </div>
-  ),
-};
diff --git a/frontend/editor/src/proprietary/ui/Button.tsx b/frontend/editor/src/proprietary/ui/Button.tsx
deleted file mode 100644
index f3dc73e933..0000000000
--- a/frontend/editor/src/proprietary/ui/Button.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-import type { ButtonHTMLAttributes, ReactNode } from "react";
-import "@app/ui/Button.css";
-
-export type ButtonVariant = "gradient" | "outline" | "ghost";
-export type ButtonSize = "sm" | "md";
-export type ButtonAccent = "blue" | "purple" | "green" | "amber" | "red";
-
-export interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
-  /** Visual variant. `gradient` is the primary CTA; `outline` is secondary; `ghost` is tertiary/text. */
-  variant?: ButtonVariant;
-  /** Optional accent colour. Currently affects `gradient` and `outline` variants. */
-  accent?: ButtonAccent;
-  size?: ButtonSize;
-  /** Icon node rendered before the label. */
-  leadingIcon?: ReactNode;
-  /** Icon node rendered after the label (arrow → for "next" CTAs). */
-  trailingIcon?: ReactNode;
-  /** Show a spinner and disable interactivity. */
-  loading?: boolean;
-  /** Stretches to fill its parent container. */
-  fullWidth?: boolean;
-  children?: ReactNode;
-}
-
-/**
- * Stirling's two-button system: a gradient primary CTA and an outlined
- * secondary action. Ghost is reserved for tertiary links inside a row.
- *
- * Buttons compose with the existing CSS variables — they re-skin cleanly in
- * dark mode without per-variant overrides.
- */
-export function Button({
-  variant = "gradient",
-  accent = "blue",
-  size = "md",
-  leadingIcon,
-  trailingIcon,
-  loading = false,
-  fullWidth = false,
-  disabled,
-  className,
-  children,
-  ...rest
-}: ButtonProps) {
-  const classes = [
-    "sui-btn",
-    `sui-btn--${variant}`,
-    `sui-btn--${accent}`,
-    `sui-btn--${size}`,
-    fullWidth ? "sui-btn--full" : "",
-    loading ? "sui-btn--loading" : "",
-    className ?? "",
-  ]
-    .filter(Boolean)
-    .join(" ");
-
-  return (
-    <button {...rest} disabled={disabled || loading} className={classes}>
-      {loading ? (
-        <span className="sui-btn__spinner" aria-hidden />
-      ) : (
-        leadingIcon
-      )}
-      {children && <span className="sui-btn__label">{children}</span>}
-      {!loading && trailingIcon}
-    </button>
-  );
-}
diff --git a/frontend/editor/src/proprietary/ui/Chip.css b/frontend/editor/src/proprietary/ui/Chip.css
deleted file mode 100644
index 78c18800e8..0000000000
--- a/frontend/editor/src/proprietary/ui/Chip.css
+++ /dev/null
@@ -1,96 +0,0 @@
-.sui-chip {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--space-1_5);
-  border-radius: var(--radius-pill);
-  font-family: var(--font-sans);
-  font-weight: 500;
-  white-space: nowrap;
-  border: 1px solid transparent;
-  transition:
-    background var(--motion-fast),
-    border-color var(--motion-fast),
-    transform var(--motion-fast);
-}
-
-.sui-chip--sm {
-  padding: var(--space-0_5) var(--space-2);
-  font-size: 0.6875rem;
-}
-.sui-chip--md {
-  padding: var(--space-1) var(--space-2_5, 0.5rem);
-  font-size: 0.75rem;
-}
-.sui-chip--md {
-  padding: var(--space-1) 0.625rem;
-  font-size: 0.75rem;
-}
-
-.sui-chip--neutral {
-  background: var(--color-bg-muted);
-  color: var(--color-text-2);
-  border-color: var(--color-border);
-}
-.sui-chip--blue {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
-  border-color: var(--color-blue-border);
-}
-.sui-chip--purple {
-  background: var(--color-purple-light);
-  color: var(--color-purple);
-  border-color: var(--color-purple-border);
-}
-.sui-chip--green {
-  background: var(--color-green-light);
-  color: var(--color-green);
-  border-color: var(--color-green-border);
-}
-.sui-chip--amber {
-  background: var(--color-amber-light);
-  color: var(--color-amber-dark);
-  border-color: var(--color-amber-border);
-}
-.sui-chip--red {
-  background: var(--color-red-light);
-  color: var(--color-red);
-  border-color: var(--color-red-border);
-}
-
-.sui-chip--interactive {
-  cursor: pointer;
-}
-.sui-chip--interactive:hover {
-  transform: translateY(-0.0625rem);
-  filter: brightness(1.05);
-}
-
-.sui-chip__dot {
-  width: 0.4375rem;
-  height: 0.4375rem;
-  border-radius: 50%;
-  background: currentColor;
-  opacity: 0.85;
-}
-
-.sui-chip__icon {
-  display: inline-flex;
-  line-height: 1;
-}
-
-.sui-chip__remove {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1rem;
-  height: 1rem;
-  border-radius: 50%;
-  color: inherit;
-  opacity: 0.6;
-  font-size: 0.875rem;
-  line-height: 1;
-}
-.sui-chip__remove:hover {
-  opacity: 1;
-  background: rgba(0, 0, 0, 0.08);
-}
diff --git a/frontend/editor/src/proprietary/ui/Chip.stories.tsx b/frontend/editor/src/proprietary/ui/Chip.stories.tsx
deleted file mode 100644
index a19e0eff96..0000000000
--- a/frontend/editor/src/proprietary/ui/Chip.stories.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { Chip } from "@app/ui/Chip";
-
-const meta: Meta<typeof Chip> = {
-  title: "Primitives/Chip",
-  component: Chip,
-  tags: ["autodocs"],
-  parameters: { layout: "centered" },
-  args: {
-    children: "us-east-1",
-    tone: "neutral",
-    size: "md",
-    showDot: false,
-  },
-  argTypes: {
-    tone: {
-      control: "inline-radio",
-      options: ["neutral", "blue", "purple", "green", "amber", "red"],
-    },
-    size: { control: "inline-radio", options: ["sm", "md"] },
-    showDot: { control: "boolean" },
-    onClick: { action: "clicked" },
-    onRemove: { action: "removed" },
-  },
-};
-export default meta;
-type Story = StoryObj<typeof Chip>;
-
-/** Flip tone / size / dot / interactive / removable in controls. */
-export const Playground: Story = {};
-
-export const ToneRow: Story = {
-  render: () => (
-    <div style={{ display: "flex", gap: 8 }}>
-      {(["neutral", "blue", "purple", "green", "amber", "red"] as const).map(
-        (t) => (
-          <Chip key={t} tone={t}>
-            {t}
-          </Chip>
-        ),
-      )}
-    </div>
-  ),
-};
-
-export const InContext_OpChain: Story = {
-  render: () => (
-    <div
-      style={{
-        display: "flex",
-        flexWrap: "wrap",
-        gap: 6,
-        maxWidth: "32rem",
-      }}
-    >
-      <Chip tone="green" showDot>
-        ocr
-      </Chip>
-      <Chip tone="green" showDot>
-        classify
-      </Chip>
-      <Chip tone="green" showDot>
-        extract
-      </Chip>
-      <Chip tone="blue" showDot>
-        validate
-      </Chip>
-      <Chip tone="red" showDot>
-        redact
-      </Chip>
-      <Chip tone="red" showDot>
-        encrypt-rest
-      </Chip>
-      <Chip tone="purple" showDot>
-        store-primary
-      </Chip>
-    </div>
-  ),
-};
diff --git a/frontend/editor/src/proprietary/ui/Chip.tsx b/frontend/editor/src/proprietary/ui/Chip.tsx
deleted file mode 100644
index 340b4a493d..0000000000
--- a/frontend/editor/src/proprietary/ui/Chip.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-import type { ReactNode } from "react";
-import "@app/ui/Chip.css";
-
-export type ChipTone =
-  | "neutral"
-  | "blue"
-  | "purple"
-  | "green"
-  | "amber"
-  | "red";
-
-export type ChipSize = "sm" | "md";
-
-export interface ChipProps {
-  tone?: ChipTone;
-  size?: ChipSize;
-  leadingIcon?: ReactNode;
-  trailingIcon?: ReactNode;
-  /** Show a `×` button. Calls `onRemove` when clicked. */
-  onRemove?: () => void;
-  /** Renders as a button when set. */
-  onClick?: () => void;
-  /** Show the leading dot affordance. Defaults to false (set true for status-style chips). */
-  showDot?: boolean;
-  children?: ReactNode;
-  className?: string;
-}
-
-/**
- * Generic chip / tag — `StatusBadge` has a fixed taxonomy (success/warning/…),
- * `MethodBadge` is HTTP-method-only; this is the open-ended one for tag rows
- * (selected ops, document regions, kbd hints, sort chips, etc).
- */
-export function Chip({
-  tone = "neutral",
-  size = "md",
-  leadingIcon,
-  trailingIcon,
-  onRemove,
-  onClick,
-  showDot,
-  children,
-  className,
-}: ChipProps) {
-  const Tag = onClick ? "button" : "span";
-  const classes = [
-    "sui-chip",
-    `sui-chip--${tone}`,
-    `sui-chip--${size}`,
-    onClick ? "sui-chip--interactive" : "",
-    className ?? "",
-  ]
-    .filter(Boolean)
-    .join(" ");
-  return (
-    <Tag
-      className={classes}
-      onClick={onClick}
-      type={onClick ? "button" : undefined}
-    >
-      {showDot && <span className="sui-chip__dot" aria-hidden />}
-      {leadingIcon && (
-        <span className="sui-chip__icon" aria-hidden>
-          {leadingIcon}
-        </span>
-      )}
-      <span className="sui-chip__label">{children}</span>
-      {trailingIcon && !onRemove && (
-        <span className="sui-chip__icon" aria-hidden>
-          {trailingIcon}
-        </span>
-      )}
-      {onRemove && (
-        <button
-          type="button"
-          className="sui-chip__remove"
-          onClick={(e) => {
-            e.stopPropagation();
-            onRemove();
-          }}
-          aria-label="Remove"
-        >
-          ×
-        </button>
-      )}
-    </Tag>
-  );
-}
diff --git a/frontend/editor/src/saas/components/SignupRequiredBootstrap.tsx b/frontend/editor/src/saas/components/SignupRequiredBootstrap.tsx
index 43e388587d..b9028ce22b 100644
--- a/frontend/editor/src/saas/components/SignupRequiredBootstrap.tsx
+++ b/frontend/editor/src/saas/components/SignupRequiredBootstrap.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useState, useMemo } from "react";
-import { Modal, Stack, Button, Text } from "@mantine/core";
+import { Modal, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import PersonAddIcon from "@mui/icons-material/PersonAdd";
 import { useTranslation } from "react-i18next";
 import { withBasePath } from "@app/constants/app";
@@ -112,7 +113,7 @@ export default function SignupRequiredBootstrap() {
             gap: "0.5rem",
           }}
         >
-          <Button variant="default" onClick={() => setOpened(false)}>
+          <Button variant="secondary" onClick={() => setOpened(false)}>
             {t("payg.signupRequired.cancel", "Not now")}
           </Button>
           <Button
diff --git a/frontend/editor/src/saas/components/auth/GuestUserBanner.css b/frontend/editor/src/saas/components/auth/GuestUserBanner.css
index d714bd858f..40ef91adc7 100644
--- a/frontend/editor/src/saas/components/auth/GuestUserBanner.css
+++ b/frontend/editor/src/saas/components/auth/GuestUserBanner.css
@@ -47,38 +47,6 @@
   flex-shrink: 0;
 }
 
-.guest-banner-dismiss {
-  padding: 6px;
-  border-radius: 8px;
-  background: transparent;
-  color: var(--mantine-color-dimmed);
-  border: none;
-  cursor: pointer;
-}
-
-.guest-banner-dismiss:hover {
-  background: var(--mantine-color-gray-1, rgba(255, 255, 255, 0.05));
-}
-
-.guest-banner-signup {
-  white-space: nowrap;
-  padding: 6px 12px;
-  border-radius: 8px;
-  background: var(--blue-6, #2563eb);
-  color: #fff;
-  border: none;
-  font-size: 12px;
-  font-weight: 600;
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  cursor: pointer;
-}
-
-.guest-banner-signup:hover {
-  background: var(--blue-7, #1d4ed8);
-}
-
 .guest-banner-icon {
   width: 16px;
   height: 16px;
diff --git a/frontend/editor/src/saas/components/auth/GuestUserBanner.tsx b/frontend/editor/src/saas/components/auth/GuestUserBanner.tsx
index 160b0c56a1..1f8e137c88 100644
--- a/frontend/editor/src/saas/components/auth/GuestUserBanner.tsx
+++ b/frontend/editor/src/saas/components/auth/GuestUserBanner.tsx
@@ -2,6 +2,8 @@ import React, { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import CloseIcon from "@mui/icons-material/Close";
 import PersonAddIcon from "@mui/icons-material/PersonAdd";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useAuth } from "@app/auth/UseSession";
 import { isUserAnonymous } from "@app/auth/supabase";
 import { withBasePath } from "@app/constants/app";
@@ -81,17 +83,20 @@ export function GuestUserBanner({ className = "" }: GuestUserBannerProps) {
           </div>
         </div>
         <div className="guest-banner-actions">
-          <button
+          <ActionIcon
+            variant="tertiary"
             onClick={handleDismiss}
             aria-label={t("guestBanner.dismiss", "Dismiss banner")}
-            className="guest-banner-dismiss"
           >
             <CloseIcon className="guest-banner-icon" />
-          </button>
-          <button onClick={handleSignUp} className="guest-banner-signup">
-            <PersonAddIcon className="guest-banner-signup-icon" />
+          </ActionIcon>
+          <Button
+            size="sm"
+            onClick={handleSignUp}
+            leftSection={<PersonAddIcon className="guest-banner-signup-icon" />}
+          >
             {t("guestBanner.signUp", "Sign Up Free")}
-          </button>
+          </Button>
         </div>
       </div>
     </div>
diff --git a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
index 0fa14721d7..b691244e68 100644
--- a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
@@ -1,5 +1,7 @@
 import React, { useCallback, useMemo, useState, useEffect } from "react";
-import { Modal, Button, Text, ActionIcon } from "@mantine/core";
+import { Modal, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
 import { useMediaQuery } from "@mantine/hooks";
 import { useAuth } from "@app/auth/UseSession";
 import { isUserAnonymous } from "@app/auth/supabase";
@@ -253,9 +255,9 @@ const AppConfigModal: React.FC<AppConfigModalProps> = ({ opened, onClose }) => {
                   ) : null}
                 </Text>
                 <ActionIcon
-                  variant="subtle"
+                  variant="tertiary"
                   onClick={onClose}
-                  aria-label="Close"
+                  aria-label={t("common.close", "Close")}
                 >
                   <LocalIcon icon="close-rounded" width={18} height={18} />
                 </ActionIcon>
@@ -276,11 +278,11 @@ const AppConfigModal: React.FC<AppConfigModalProps> = ({ opened, onClose }) => {
         <div className="confirm-modal-content">
           <Text>Are you sure you want to sign out?</Text>
           <div className="confirm-modal-buttons">
-            <Button variant="default" onClick={() => setConfirmOpen(false)}>
+            <Button variant="secondary" onClick={() => setConfirmOpen(false)}>
               Cancel
             </Button>
             <Button
-              color="red"
+              accent="danger"
               onClick={async () => {
                 try {
                   await signOut();
diff --git a/frontend/editor/src/saas/components/shared/config/ProfilePictureCropper.tsx b/frontend/editor/src/saas/components/shared/config/ProfilePictureCropper.tsx
index 0148da621b..8230184a2c 100644
--- a/frontend/editor/src/saas/components/shared/config/ProfilePictureCropper.tsx
+++ b/frontend/editor/src/saas/components/shared/config/ProfilePictureCropper.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useCallback, useEffect } from "react";
-import { Modal, Button, Stack, Slider, Alert, Text, Box } from "@mantine/core";
+import { Modal, Stack, Slider, Alert, Text, Box } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import Cropper from "react-easy-crop";
 import { getCroppedImage, type Area } from "@app/utils/cropImage";
@@ -182,7 +183,7 @@ export const ProfilePictureCropper: React.FC<ProfilePictureCropperProps> = ({
         <div
           style={{ display: "flex", justifyContent: "flex-end", gap: "8px" }}
         >
-          <Button variant="subtle" onClick={onClose} disabled={processing}>
+          <Button variant="tertiary" onClick={onClose} disabled={processing}>
             {t("common.cancel", "Cancel")}
           </Button>
           <Button onClick={handleSave} loading={processing}>
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx b/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
index bee502e70d..4d65073f71 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Anchor, Group, Stack, Text, Button, Paper } from "@mantine/core";
+import { Anchor, Group, Stack, Text, Paper } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import ApiKeySection from "@app/components/shared/config/configSections/apiKeys/ApiKeySection";
 import RefreshModal from "@app/components/shared/config/configSections/apiKeys/RefreshModal";
 import useApiKey from "@app/components/shared/config/configSections/apiKeys/hooks/useApiKey";
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/McpSection.tsx b/frontend/editor/src/saas/components/shared/config/configSections/McpSection.tsx
index 6a6ea06b6e..705032da58 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/McpSection.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/McpSection.tsx
@@ -7,12 +7,12 @@ import {
   Group,
   Alert,
   Code,
-  Button,
   CopyButton,
   Tabs,
   Tooltip,
   ThemeIcon,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
 import { openAppSettings } from "@app/utils/appSettings";
@@ -41,9 +41,9 @@ function CopyInline({ value, label }: { value: string; label: string }) {
           withArrow
         >
           <Button
-            size="compact-xs"
-            variant={copied ? "light" : "default"}
-            color={copied ? "teal" : "gray"}
+            size="sm"
+            variant="secondary"
+            accent={copied ? "success" : undefined}
             onClick={copy}
             leftSection={
               <LocalIcon
@@ -180,6 +180,7 @@ export default function McpSection() {
                 </Text>
                 <Button
                   size="sm"
+                  variant="primary"
                   onClick={goToAccount}
                   style={{ flexShrink: 0 }}
                 >
@@ -277,8 +278,8 @@ export default function McpSection() {
                   )}
                 </Text>
                 <Button
-                  size="xs"
-                  variant="light"
+                  size="sm"
+                  variant="secondary"
                   style={{ flexShrink: 0 }}
                   leftSection={
                     <LocalIcon icon="key-rounded" width={14} height={14} />
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx b/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
index 6033b5cd90..fac87148fe 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
@@ -2,9 +2,7 @@ import React, { useState } from "react";
 import {
   Alert,
   Avatar,
-  Button,
   Divider,
-  FileButton,
   Group,
   Image,
   LoadingOverlay,
@@ -13,6 +11,8 @@ import {
   TextInput,
   Modal,
 } from "@mantine/core";
+import { Button as DSButton } from "@app/ui/Button";
+import { FilePicker } from "@app/ui/FilePicker";
 import { useTranslation } from "react-i18next";
 import { useAuth } from "@app/auth/UseSession";
 import {
@@ -363,9 +363,9 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
               </p>
             )}
           </div>
-          <Button color="red" variant="filled" onClick={onLogoutClick}>
+          <DSButton variant="primary" accent="danger" onClick={onLogoutClick}>
             {t("logOut", "Log out")}
-          </Button>
+          </DSButton>
         </div>
       </div>
 
@@ -434,8 +434,8 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
                   },
                 )}
               </Text>
-              <Button
-                variant="outline"
+              <DSButton
+                variant="secondary"
                 onClick={handleUseCustomPicture}
                 disabled={profileUploading}
               >
@@ -443,7 +443,7 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
                   "config.account.profilePicture.useCustom",
                   "Use custom picture",
                 )}
-              </Button>
+              </DSButton>
             </div>
           </Group>
         ) : (
@@ -464,24 +464,21 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
               }}
             >
               <Group gap="sm">
-                <FileButton
+                <FilePicker
                   onChange={handleProfileUpload}
                   accept="image/png,image/jpeg,image/webp"
                   disabled={!user || profileUploading}
+                  loading={profileUploading}
                 >
-                  {(props) => (
-                    <Button {...props} loading={profileUploading}>
-                      {t("config.account.profilePicture.upload", "Upload")}
-                    </Button>
-                  )}
-                </FileButton>
-                <Button
-                  variant="outline"
+                  {t("config.account.profilePicture.upload", "Upload")}
+                </FilePicker>
+                <DSButton
+                  variant="secondary"
                   onClick={handleProfileRemove}
                   disabled={!profilePictureUrl || profileUploading}
                 >
                   {t("config.account.profilePicture.remove", "Remove")}
-                </Button>
+                </DSButton>
               </Group>
               <Text size="xs" c="var(--mantine-color-dimmed)">
                 {t(
@@ -559,8 +556,8 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
                     key={provider.id}
                     content={`${t("config.account.upgrade.linkWith", "Link with")} ${provider.label}`}
                   >
-                    <Button
-                      variant="outline"
+                    <DSButton
+                      variant="secondary"
                       size="sm"
                       leftSection={
                         <Image
@@ -581,7 +578,7 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
                       disabled={isLoading}
                     >
                       {provider.label}
-                    </Button>
+                    </DSButton>
                   </Tooltip>
                 ))}
             </div>
@@ -624,9 +621,9 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
                   )}
                   style={{ flex: 1 }}
                 />
-                <Button type="submit" disabled={isLoading}>
+                <DSButton type="submit" variant="primary" disabled={isLoading}>
                   {t("config.account.upgrade.upgradeButton", "Upgrade Account")}
-                </Button>
+                </DSButton>
               </Group>
             </form>
           </div>
@@ -644,13 +641,13 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
             borderTop: "1px solid var(--mantine-color-default-border)",
           }}
         >
-          <Button
-            color="red"
-            variant="outline"
+          <DSButton
+            variant="secondary"
+            accent="danger"
             onClick={() => setDeleteModalOpen(true)}
           >
             {t("config.account.overview.deleteAccount", "Delete Account")}
-          </Button>
+          </DSButton>
         </div>
       )}
 
@@ -693,11 +690,16 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
             mb="md"
           />
           <Group justify="flex-end" gap="sm">
-            <Button variant="default" onClick={closeDeleteModal} type="button">
+            <DSButton
+              variant="secondary"
+              onClick={closeDeleteModal}
+              type="button"
+            >
               {t("cancel", "Cancel")}
-            </Button>
-            <Button
-              color="red"
+            </DSButton>
+            <DSButton
+              variant="primary"
+              accent="danger"
               disabled={
                 confirmEmail.toLowerCase() !== user?.email?.toLowerCase()
               }
@@ -705,7 +707,7 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
               loading={isDeletingAccount}
             >
               {t("config.account.overview.confirmDelete", "Delete My Account")}
-            </Button>
+            </DSButton>
           </Group>
         </form>
       </Modal>
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/PasswordSecurity.tsx b/frontend/editor/src/saas/components/shared/config/configSections/PasswordSecurity.tsx
index 8010b5482a..d38e46e1a7 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/PasswordSecurity.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/PasswordSecurity.tsx
@@ -1,6 +1,5 @@
 import React, { useState } from "react";
 import {
-  Button,
   PasswordInput,
   Group,
   Alert,
@@ -8,6 +7,7 @@ import {
   Modal,
   Divider,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import { useAuth } from "@app/auth/UseSession";
 import { supabase } from "@app/auth/supabase";
@@ -116,7 +116,7 @@ const PasswordSecurity: React.FC = () => {
             )}
           </p>
         </div>
-        <Button type="button" onClick={() => setOpened(true)} variant="filled">
+        <Button type="button" onClick={() => setOpened(true)}>
           {t("config.account.security.changePassword", "Change password")}
         </Button>
       </div>
@@ -166,7 +166,7 @@ const PasswordSecurity: React.FC = () => {
             <Group justify="flex-end">
               <Button
                 type="button"
-                variant="default"
+                variant="secondary"
                 onClick={() => setOpened(false)}
               >
                 {t("common.cancel", "Cancel")}
diff --git a/frontend/editor/src/saas/components/tools/sign/SignSettings.tsx b/frontend/editor/src/saas/components/tools/sign/SignSettings.tsx
index a6e406a410..b8691df30d 100644
--- a/frontend/editor/src/saas/components/tools/sign/SignSettings.tsx
+++ b/frontend/editor/src/saas/components/tools/sign/SignSettings.tsx
@@ -2,16 +2,15 @@
 import { useTranslation } from "react-i18next";
 import {
   Stack,
-  Button,
   Text,
   Alert,
-  SegmentedControl,
   Divider,
-  ActionIcon,
   Tooltip,
   Group,
   Box,
 } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { SignParameters } from "@app/hooks/tools/sign/useSignParameters";
 import { useSignature } from "@app/contexts/SignatureContext";
 import { useViewer } from "@app/contexts/ViewerContext";
@@ -440,9 +439,9 @@ const SignSettings = ({
 
     const button = (
       <Button
-        size="xs"
-        variant="outline"
-        color={isSaved ? "green" : undefined}
+        size="sm"
+        variant="secondary"
+        accent={isSaved ? "success" : undefined}
         onClick={() => onClick(scope)}
         disabled={
           !isReady || disabled || isSavedSignatureLimitReached || !hasChanges
@@ -1154,49 +1153,33 @@ const SignSettings = ({
     onActivateSignaturePlacement || onDeactivateSignature ? (
       isPlacementMode ? (
         <Tooltip label={translate("mode.pause", "Pause placement")}>
-          <ActionIcon
-            variant="default"
-            size="lg"
+          <Button
+            variant="secondary"
             aria-label={translate("mode.pause", "Pause placement")}
             onClick={handlePausePlacement}
             disabled={disabled || !onDeactivateSignature}
-            style={{
-              width: "auto",
-              paddingInline: "0.75rem",
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-            }}
+            leftSection={
+              <LocalIcon icon="pause-circle-rounded" width={20} height={20} />
+            }
           >
-            <LocalIcon icon="pause-circle-rounded" width={20} height={20} />
-            <Text component="span" size="sm" fw={500}>
-              {translate("mode.pause", "Pause placement")}
-            </Text>
-          </ActionIcon>
+            {translate("mode.pause", "Pause placement")}
+          </Button>
         </Tooltip>
       ) : (
         <Tooltip label={translate("mode.resume", "Resume placement")}>
-          <ActionIcon
-            variant="default"
-            size="lg"
+          <Button
+            variant="secondary"
             aria-label={translate("mode.resume", "Resume placement")}
             onClick={handleResumePlacement}
             disabled={
               disabled || !isCurrentTypeReady || !onActivateSignaturePlacement
             }
-            style={{
-              width: "auto",
-              paddingInline: "0.75rem",
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-            }}
+            leftSection={
+              <LocalIcon icon="play-arrow-rounded" width={20} height={20} />
+            }
           >
-            <LocalIcon icon="play-arrow-rounded" width={20} height={20} />
-            <Text component="span" size="sm" fw={500}>
-              {translate("mode.resume", "Resume placement")}
-            </Text>
-          </ActionIcon>
+            {translate("mode.resume", "Resume placement")}
+          </Button>
         </Tooltip>
       )
     ) : null;
@@ -1217,7 +1200,7 @@ const SignSettings = ({
             onChange={(value) =>
               handleSignatureSourceChange(value as SignatureSource)
             }
-            data={sourceOptions}
+            options={sourceOptions}
           />
         )}
         {renderSignatureBuilder()}
@@ -1260,7 +1243,7 @@ const SignSettings = ({
       />
 
       {onSave && (
-        <Button onClick={onSave} color="blue" variant="filled" fullWidth>
+        <Button onClick={onSave} fullWidth>
           {translate("applySignatures", "Apply Signatures")}
         </Button>
       )}
diff --git a/frontend/editor/src/saas/routes/AuthCallback.tsx b/frontend/editor/src/saas/routes/AuthCallback.tsx
index 1701163f9d..ee16d8ce36 100644
--- a/frontend/editor/src/saas/routes/AuthCallback.tsx
+++ b/frontend/editor/src/saas/routes/AuthCallback.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { supabase } from "@app/auth/supabase";
-import { Button } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { withBasePath } from "@app/constants/app";
 
 interface CallbackState {
@@ -206,8 +206,8 @@ export default function AuthCallback() {
               if (state.status === "error") {
                 return (
                   <Button
+                    accent="danger"
                     onClick={() => navigate("/login", { replace: true })}
-                    className="inline-flex items-center rounded-md bg-rose-600 px-4 py-2 text-sm font-medium text-white shadow hover:bg-rose-700 focus:outline-none focus:ring-2 focus:ring-rose-500"
                   >
                     Back to login
                   </Button>
diff --git a/frontend/editor/src/saas/routes/Login.tsx b/frontend/editor/src/saas/routes/Login.tsx
index 4395bef998..dcf7b454a2 100644
--- a/frontend/editor/src/saas/routes/Login.tsx
+++ b/frontend/editor/src/saas/routes/Login.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useMemo, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { supabase, signInAnonymously } from "@app/auth/supabase";
+import { Button } from "@app/ui/Button";
 import { useAuth } from "@app/auth/UseSession";
 import { useTranslation } from "@app/hooks/useTranslation";
 import { useDocumentMeta } from "@app/hooks/useDocumentMeta";
@@ -299,8 +300,8 @@ export default function Login() {
 
         {/* Magic link button + its expandable form as one unit */}
         <div>
-          <button
-            type="button"
+          <Button
+            variant="secondary"
             disabled={isSigningIn}
             onClick={toggleMagicLink}
             className={`oauth-button-fullwidth auth-expandable-trigger ${showMagicLinkForm ? "auth-expandable-trigger--active" : ""}`}
@@ -318,7 +319,7 @@ export default function Login() {
                 {t("login.useMagicLink", "Use magic link")}
               </span>
             </span>
-          </button>
+          </Button>
 
           <div
             className={`auth-expand-grid ${showMagicLinkForm ? "auth-expand-grid--open" : ""}`}
@@ -352,7 +353,7 @@ export default function Login() {
                       }
                       className="auth-input"
                     />
-                    <button
+                    <Button
                       onClick={signInWithMagicLink}
                       disabled={isSigningIn || !magicLinkEmail}
                       className="auth-magic-button"
@@ -360,7 +361,7 @@ export default function Login() {
                       {isSigningIn
                         ? t("login.sending")
                         : t("login.sendMagicLink")}
-                    </button>
+                    </Button>
                   </div>
                 )}
               </div>
@@ -370,8 +371,8 @@ export default function Login() {
       </div>
 
       {/* Email & Password button */}
-      <button
-        type="button"
+      <Button
+        variant="secondary"
         disabled={isSigningIn}
         onClick={toggleEmailForm}
         className={`oauth-button-fullwidth auth-expandable-trigger ${showEmailForm ? "auth-expandable-trigger--active" : ""}`}
@@ -381,7 +382,7 @@ export default function Login() {
           <span className="auth-at-icon">@</span>
           <span className="oauth-btn-label">{`${t("login.signInWith", "Sign in with")} email`}</span>
         </span>
-      </button>
+      </Button>
 
       {/* Email form — animated expand */}
       <div
@@ -400,22 +401,22 @@ export default function Login() {
                 isSigningIn ? t("login.loggingIn") : t("login.login")
               }
             />
-            <button
-              type="button"
+            <Button
+              variant="tertiary"
               onClick={() => navigate("/auth/reset")}
               className="auth-link-black"
               style={{ fontSize: "0.8125rem", marginTop: "0.25rem" }}
             >
               {t("login.forgotPassword", "Forgot your password?")}
-            </button>
+            </Button>
           </div>
         </div>
       </div>
 
       {/* Skip */}
       <div style={{ textAlign: "center", margin: "1rem 0" }}>
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={handleAnonymousSignIn}
           disabled={isSigningIn}
           style={{
@@ -424,13 +425,13 @@ export default function Login() {
             cursor: "pointer",
             fontSize: "1rem",
             fontWeight: 700,
-            color: "#000000",
+            color: "var(--text-primary)",
           }}
         >
           {isSigningIn
             ? t("login.signingIn", "Signing in...")
             : `${t("signup.skip", "Skip")} →`}
-        </button>
+        </Button>
       </div>
 
       {/* Bottom */}
@@ -441,8 +442,8 @@ export default function Login() {
           paddingTop: "1rem",
         }}
       >
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={() => navigate("/signup")}
           style={{
             background: "none",
@@ -453,7 +454,7 @@ export default function Login() {
           }}
         >
           {t("login.createAccount", "Create an account")}
-        </button>
+        </Button>
       </div>
     </AuthLayout>
   );
diff --git a/frontend/editor/src/saas/routes/OAuthConsent.tsx b/frontend/editor/src/saas/routes/OAuthConsent.tsx
index e36f4d371b..d851a91a53 100644
--- a/frontend/editor/src/saas/routes/OAuthConsent.tsx
+++ b/frontend/editor/src/saas/routes/OAuthConsent.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useLocation, useNavigate } from "react-router-dom";
+import { Button } from "@app/ui/Button";
 import { useAuth } from "@app/auth/UseSession";
 import { useTranslation } from "@app/hooks/useTranslation";
 import { useDocumentMeta } from "@app/hooks/useDocumentMeta";
@@ -236,13 +237,13 @@ export default function OAuthConsent() {
             "Sign in to your Stirling PDF account to continue connecting the app.",
           )}
         </p>
-        <button
-          type="button"
+        <Button
+          variant="secondary"
           className="oauth-button-fullwidth"
           onClick={() => navigate(`/login?next=${encodeURIComponent(next)}`)}
         >
           {t("oauthConsent.signInButton", "Sign in to continue")}
-        </button>
+        </Button>
       </AuthLayout>
     );
   }
@@ -358,8 +359,7 @@ export default function OAuthConsent() {
       <ErrorMessage error={error} />
 
       <div style={{ display: "flex", flexDirection: "column", gap: "0.75rem" }}>
-        <button
-          type="button"
+        <Button
           disabled={deciding !== null}
           onClick={() => decide("approve")}
           style={{
@@ -378,9 +378,9 @@ export default function OAuthConsent() {
           {deciding === "approve"
             ? t("oauthConsent.approving", "Allowing...")
             : t("oauthConsent.approve", "Allow access")}
-        </button>
-        <button
-          type="button"
+        </Button>
+        <Button
+          variant="secondary"
           disabled={deciding !== null}
           onClick={() => decide("deny")}
           className="oauth-button-fullwidth"
@@ -388,7 +388,7 @@ export default function OAuthConsent() {
           {deciding === "deny"
             ? t("oauthConsent.denying", "Denying...")
             : t("oauthConsent.deny", "Deny")}
-        </button>
+        </Button>
       </div>
 
       {displayName && (
diff --git a/frontend/editor/src/saas/routes/ResetPassword.tsx b/frontend/editor/src/saas/routes/ResetPassword.tsx
index f17e82bd68..b0a1273199 100644
--- a/frontend/editor/src/saas/routes/ResetPassword.tsx
+++ b/frontend/editor/src/saas/routes/ResetPassword.tsx
@@ -9,6 +9,7 @@ import NavigationLink from "@app/routes/login/NavigationLink";
 import { supabase } from "@app/auth/supabase";
 import { absoluteWithBasePath } from "@app/constants/app";
 import { useTranslation } from "@app/hooks/useTranslation";
+import { Button } from "@app/ui/Button";
 
 export default function ResetPassword() {
   const { t } = useTranslation();
@@ -233,7 +234,7 @@ export default function ResetPassword() {
               />
             </div>
           </div>
-          <button
+          <Button
             onClick={handleUpdatePassword}
             disabled={isSubmitting || !password || !confirmPassword}
             className="auth-button"
@@ -241,7 +242,7 @@ export default function ResetPassword() {
             {isSubmitting
               ? t("login.sending", "Sending…")
               : t("login.updatePassword", "Update password")}
-          </button>
+          </Button>
           <NavigationLink
             onClick={() => navigate("/login")}
             text={t("login.backToSignIn", "Back to sign in")}
diff --git a/frontend/editor/src/saas/routes/Signup.tsx b/frontend/editor/src/saas/routes/Signup.tsx
index 36d162a549..3836c60ac1 100644
--- a/frontend/editor/src/saas/routes/Signup.tsx
+++ b/frontend/editor/src/saas/routes/Signup.tsx
@@ -9,6 +9,7 @@ import AuthLayout from "@app/routes/authShared/AuthLayout";
 import "@app/auth/ui/auth.css";
 import "@app/routes/authShared/saas-auth.css";
 import { alert } from "@app/components/toast";
+import { Button } from "@app/ui/Button";
 
 // Import signup components
 import ErrorMessage from "@app/auth/ui/ErrorMessage";
@@ -209,8 +210,8 @@ export default function Signup() {
       </div>
 
       {/* Email & Password button */}
-      <button
-        type="button"
+      <Button
+        variant="secondary"
         disabled={isSigningUp}
         onClick={() => setShowEmailForm((v) => !v)}
         className={`oauth-button-fullwidth auth-expandable-trigger ${showEmailForm ? "auth-expandable-trigger--active" : ""}`}
@@ -220,7 +221,7 @@ export default function Signup() {
           <span className="auth-at-icon">@</span>
           <span className="oauth-btn-label">{`${t("signup.signUpWith", "Sign up with")} email`}</span>
         </span>
-      </button>
+      </Button>
 
       {/* Email form — animated expand */}
       <div
@@ -249,8 +250,8 @@ export default function Signup() {
 
       {/* Skip */}
       <div style={{ textAlign: "center", margin: "1rem 0" }}>
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={handleAnonymousSignIn}
           disabled={isSigningUp}
           style={{
@@ -259,13 +260,13 @@ export default function Signup() {
             cursor: "pointer",
             fontSize: "1rem",
             fontWeight: 700,
-            color: "#000000",
+            color: "var(--text-primary)",
           }}
         >
           {isSigningUp
             ? t("login.signingIn", "Signing in...")
             : `${t("signup.skip", "Skip")} →`}
-        </button>
+        </Button>
       </div>
 
       {/* Bottom */}
@@ -276,8 +277,8 @@ export default function Signup() {
           paddingTop: "1rem",
         }}
       >
-        <button
-          type="button"
+        <Button
+          variant="tertiary"
           onClick={() => navigate("/login")}
           style={{
             background: "none",
@@ -288,7 +289,7 @@ export default function Signup() {
           }}
         >
           {t("signup.alreadyHaveAccount", "I already have an account")}
-        </button>
+        </Button>
       </div>
     </AuthLayout>
   );
diff --git a/frontend/editor/src/saas/routes/authShared/GuestSignInButton.tsx b/frontend/editor/src/saas/routes/authShared/GuestSignInButton.tsx
index 31bbc35ca0..273bb17dfd 100644
--- a/frontend/editor/src/saas/routes/authShared/GuestSignInButton.tsx
+++ b/frontend/editor/src/saas/routes/authShared/GuestSignInButton.tsx
@@ -1,4 +1,7 @@
 import React from "react";
+import { Button } from "@app/ui/Button";
+
+// TODO: add saas-auth.css to the same location as auth.css
 import "@app/auth/ui/auth.css";
 import "@app/routes/authShared/saas-auth.css";
 
@@ -14,13 +17,13 @@ export default function GuestSignInButton({
   disabled,
 }: GuestSignInButtonProps) {
   return (
-    <button
-      type="button"
+    <Button
+      variant="secondary"
       onClick={onClick}
       disabled={disabled}
       className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold mb-2 cursor-pointer disabled:opacity-50 disabled:cursor-not-allowed auth-guest-button"
     >
       {label}
-    </button>
+    </Button>
   );
 }
diff --git a/frontend/editor/src/saas/routes/authShared/saas-auth.css b/frontend/editor/src/saas/routes/authShared/saas-auth.css
index 535d72d3dd..96d97f695c 100644
--- a/frontend/editor/src/saas/routes/authShared/saas-auth.css
+++ b/frontend/editor/src/saas/routes/authShared/saas-auth.css
@@ -129,6 +129,11 @@
   text-align: center;
 }
 
+/* ── Dark-mode icon inversion for monochrome OAuth logos ────────────── */
+[data-mantine-color-scheme="dark"] .oauth-icon--github {
+  filter: invert(1);
+}
+
 /* ── Icon helpers inside oauth-button-fullwidth ─────────────────────── */
 .auth-at-icon {
   font-size: 1.25rem;
diff --git a/frontend/editor/src/saas/routes/login/EmailPasswordForm.tsx b/frontend/editor/src/saas/routes/login/EmailPasswordForm.tsx
index ecc8cbd209..a7435eb43b 100644
--- a/frontend/editor/src/saas/routes/login/EmailPasswordForm.tsx
+++ b/frontend/editor/src/saas/routes/login/EmailPasswordForm.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
 import "@app/auth/ui/auth.css";
 import "@app/routes/authShared/saas-auth.css";
+import { Button } from "@app/ui/Button";
 
 interface EmailPasswordFormProps {
   email: string;
@@ -78,13 +79,14 @@ export default function EmailPasswordForm({
         )}
       </div>
 
-      <button
+      <Button
         type="submit"
         disabled={isSubmitting || !email || (showPasswordField && !password)}
-        className="auth-button"
+        accent="brand"
+        fullWidth
       >
         {submitButtonText}
-      </button>
+      </Button>
     </form>
   );
 }
diff --git a/frontend/editor/src/saas/routes/login/MagicLinkForm.tsx b/frontend/editor/src/saas/routes/login/MagicLinkForm.tsx
index 9833928247..2a669595de 100644
--- a/frontend/editor/src/saas/routes/login/MagicLinkForm.tsx
+++ b/frontend/editor/src/saas/routes/login/MagicLinkForm.tsx
@@ -1,3 +1,4 @@
+import { Button } from "@app/ui/Button";
 import { useTranslation } from "@app/hooks/useTranslation";
 import "@app/auth/ui/auth.css";
 import "@app/routes/authShared/saas-auth.css";
@@ -24,7 +25,8 @@ export default function MagicLinkForm({
   if (!showMagicLink) {
     return (
       <div className="auth-toggle-wrapper">
-        <button
+        <Button
+          variant="tertiary"
           onClick={() => {
             setShowMagicLink(true);
           }}
@@ -32,7 +34,7 @@ export default function MagicLinkForm({
           className="auth-toggle-link"
         >
           {t("login.useMagicLink")}
-        </button>
+        </Button>
       </div>
     );
   }
@@ -47,13 +49,13 @@ export default function MagicLinkForm({
         onKeyPress={(e) => e.key === "Enter" && !isSubmitting && onSubmit()}
         className="auth-input"
       />
-      <button
+      <Button
         onClick={onSubmit}
         disabled={isSubmitting || !magicLinkEmail}
         className="auth-magic-button"
       >
         {isSubmitting ? t("login.sending") : t("login.sendMagicLink")}
-      </button>
+      </Button>
     </div>
   );
 }
diff --git a/frontend/editor/src/saas/routes/login/OAuthButtons.tsx b/frontend/editor/src/saas/routes/login/OAuthButtons.tsx
index 21e76348f9..202a1c9d3c 100644
--- a/frontend/editor/src/saas/routes/login/OAuthButtons.tsx
+++ b/frontend/editor/src/saas/routes/login/OAuthButtons.tsx
@@ -1,6 +1,7 @@
 import { oauthProviders } from "@app/constants/authProviders";
 import { useTranslation } from "@app/hooks/useTranslation";
 import { Tooltip } from "@app/components/shared/Tooltip";
+import { Button } from "@app/ui/Button";
 import { oauthIconUrl } from "@app/auth/ui/oauthIcons";
 
 // Exports for compatibility with proprietary code
@@ -38,7 +39,8 @@ export default function OAuthButtons({
             content={`${t("login.signInWith", "Sign in with")} ${p.label}`}
             position="top"
           >
-            <button
+            <Button
+              variant="secondary"
               onClick={() => onProviderClick(p.id as "github" | "google")}
               disabled={isSubmitting || p.isDisabled}
               className="oauth-button-icon"
@@ -47,9 +49,9 @@ export default function OAuthButtons({
               <img
                 src={oauthIconUrl(p.file)}
                 alt={p.label}
-                className={`oauth-icon-small ${p.isDisabled ? "opacity-20" : ""}`}
+                className={`oauth-icon-small oauth-icon--${p.id} ${p.isDisabled ? "opacity-20" : ""}`}
               />
-            </button>
+            </Button>
           </Tooltip>
         ))}
       </div>
@@ -65,7 +67,8 @@ export default function OAuthButtons({
             content={`${t("login.signInWith", "Sign in with")} ${p.label}`}
             position="top"
           >
-            <button
+            <Button
+              variant="secondary"
               onClick={() => onProviderClick(p.id as "github" | "google")}
               disabled={isSubmitting || p.isDisabled}
               className="oauth-button-grid"
@@ -74,9 +77,9 @@ export default function OAuthButtons({
               <img
                 src={oauthIconUrl(p.file)}
                 alt={p.label}
-                className={`oauth-icon-medium ${p.isDisabled ? "opacity-20" : ""}`}
+                className={`oauth-icon-medium oauth-icon--${p.id} ${p.isDisabled ? "opacity-20" : ""}`}
               />
-            </button>
+            </Button>
           </Tooltip>
         ))}
       </div>
@@ -87,8 +90,9 @@ export default function OAuthButtons({
     return (
       <div className="oauth-container-fullwidth">
         {oauthProviders.map((p) => (
-          <button
+          <Button
             key={p.id}
+            variant="secondary"
             onClick={() => onProviderClick(p.id as "github" | "google")}
             disabled={isSubmitting || p.isDisabled}
             className="oauth-button-fullwidth"
@@ -98,7 +102,7 @@ export default function OAuthButtons({
               <img
                 src={oauthIconUrl(p.file)}
                 alt={p.label}
-                className={`oauth-icon-medium ${p.isDisabled ? "opacity-20" : ""}`}
+                className={`oauth-icon-medium oauth-icon--${p.id} ${p.isDisabled ? "opacity-20" : ""}`}
                 style={{ marginRight: "0.5rem", flexShrink: 0 }}
               />
               <span className="oauth-btn-label">
@@ -106,7 +110,7 @@ export default function OAuthButtons({
                 {p.label}
               </span>
             </span>
-          </button>
+          </Button>
         ))}
       </div>
     );
@@ -115,8 +119,9 @@ export default function OAuthButtons({
   return (
     <div className="oauth-container-vertical">
       {oauthProviders.map((p) => (
-        <button
+        <Button
           key={p.id}
+          variant="secondary"
           onClick={() => onProviderClick(p.id as "github" | "google")}
           disabled={isSubmitting || p.isDisabled}
           className="oauth-button-vertical"
@@ -125,10 +130,10 @@ export default function OAuthButtons({
           <img
             src={oauthIconUrl(p.file)}
             alt={p.label}
-            className={`oauth-icon-tiny ${p.isDisabled ? "opacity-20" : ""}`}
+            className={`oauth-icon-tiny oauth-icon--${p.id} ${p.isDisabled ? "opacity-20" : ""}`}
           />
           {p.label}
-        </button>
+        </Button>
       ))}
     </div>
   );
diff --git a/frontend/editor/src/saas/styles/saas-theme.css b/frontend/editor/src/saas/styles/saas-theme.css
index 3cbce19761..654fe5fe17 100644
--- a/frontend/editor/src/saas/styles/saas-theme.css
+++ b/frontend/editor/src/saas/styles/saas-theme.css
@@ -76,8 +76,6 @@
   --api-keys-card-shadow: rgba(0, 0, 0, 0.06);
   --api-keys-input-bg: #f8f8f8;
   --api-keys-input-border: #e0e0e0;
-  --api-keys-button-bg: #f5f5f5;
-  --api-keys-button-color: #333333;
 }
 
 [data-mantine-color-scheme="dark"] {
@@ -90,8 +88,8 @@
   --spdf-compare-added-badge-fg: var(--color-green-500);
   --spdf-compare-inline-removed-bg: rgba(255, 59, 48, 0.25);
   --spdf-compare-inline-added-bg: rgba(52, 199, 89, 0.25);
-  --compare-page-label-bg: #2a2f36;
-  --compare-page-label-fg: #d0d6dc;
+  --compare-page-label-bg: #0d1020;
+  --compare-page-label-fg: #c2c8e0;
 
   /* Orange scale (dark mode mirrors light values to match UI) */
   --color-orange-50: #fff4ed;
@@ -122,29 +120,27 @@
   --tool-subcategory-text-color-light: #9ca3af;
 
   /* API usage progress bar colors (dark mode) */
-  --usage-weekly-active: #60a5fa;
+  --usage-weekly-active: #4f8ef5;
   --usage-bought-active: #34d399;
-  --usage-total-used: #ffffff;
-  --usage-inactive: #43464b;
+  --usage-total-used: #e8eaf6;
+  --usage-inactive: #1c2340;
 
   /* API Keys section colors (dark mode) */
-  --api-keys-card-bg: #2a2f36;
-  --api-keys-card-border: #3a4047;
+  --api-keys-card-bg: #131729;
+  --api-keys-card-border: #1c2340;
   --api-keys-card-shadow: none;
-  --api-keys-input-bg: #1f2329;
-  --api-keys-input-border: #3a4047;
-  --api-keys-button-bg: #3a4047;
-  --api-keys-button-color: #d0d6dc;
+  --api-keys-input-bg: #0d1020;
+  --api-keys-input-border: #1c2340;
 
   --text-divider-rule-color: var(--tool-subcategory-rule-color);
   --text-divider-label-color: var(--text-muted);
 
   /* App Config Modal colors (dark mode) */
-  --modal-nav-bg: #1f2329;
-  --modal-nav-section-title: #9ca3af;
-  --modal-nav-item: #d0d6dc;
-  --modal-nav-item-active: #0a8bff;
-  --modal-nav-item-active-bg: rgba(10, 139, 255, 0.15);
-  --modal-content-bg: #2a2f36;
-  --modal-header-border: rgba(255, 255, 255, 0.08);
+  --modal-nav-bg: #0d1020;
+  --modal-nav-section-title: #5b6280;
+  --modal-nav-item: #c2c8e0;
+  --modal-nav-item-active: #4f8ef5;
+  --modal-nav-item-active-bg: rgba(79, 142, 245, 0.15);
+  --modal-content-bg: #131729;
+  --modal-header-border: rgba(255, 255, 255, 0.05);
 }
diff --git a/frontend/editor/tsconfig.portal.vite.json b/frontend/editor/tsconfig.portal.vite.json
index 8a63033eb6..93337d1dcc 100644
--- a/frontend/editor/tsconfig.portal.vite.json
+++ b/frontend/editor/tsconfig.portal.vite.json
@@ -1,6 +1,6 @@
 {
   "extends": "./tsconfig.json",
-  "comment": "Path resolution for the portal's vitest project (referenced by vitest.config.ts). Broad include ('src', via the base) so vite-tsconfig-paths rewrites @app/* in every editor/src file the portal tests pull in (e.g. proprietary/ui), not just the portal layer. The portal's own typecheck uses src/portal/tsconfig.json.",
+  "comment": "Path resolution for the portal's vitest project (referenced by vitest.config.ts). Broad include ('src', via the base) so vite-tsconfig-paths rewrites @app/* in every editor/src file the portal tests pull in (e.g. core/ui), not just the portal layer. The portal's own typecheck uses src/portal/tsconfig.json.",
   "compilerOptions": {
     "paths": {
       "@app/*": [
diff --git a/frontend/editor/vitest.config.ts b/frontend/editor/vitest.config.ts
index 5a0fc50651..e4dfd76277 100644
--- a/frontend/editor/vitest.config.ts
+++ b/frontend/editor/vitest.config.ts
@@ -57,7 +57,7 @@ export default defineConfig({
           react(),
           tsconfigPaths({
             // Broad project so @app/@portal resolve in every editor file the
-            // portal tests pull in (proprietary/ui, core, ...).
+            // portal tests pull in (core/ui, core, ...).
             projects: ["./tsconfig.portal.vite.json"],
           }),
         ],
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 81698ddde6..02f1c68132 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -30,6 +30,42 @@ const baseRestrictedImportPatterns = [
   },
 ];
 
+// Button/SegmentedControl/Chip must come from the shared DS (@app/ui), not Mantine.
+// If no variant fits, extend @app/ui — that layer (editor/src/core/ui) is exempt below.
+const mantineComponentImportRestrictions = [
+  {
+    selector:
+      "ImportDeclaration[source.value='@mantine/core'] > ImportSpecifier[imported.name=/^(Button|ActionIcon|UnstyledButton|CloseButton|FileButton)$/]",
+    message:
+      'Use the shared Button (@app/ui/Button) instead of the Mantine button family. variant=primary|secondary|tertiary, accent=default|neutral|brand|ai|premium|danger|success|warning; an icon-only button is `<Button leftSection={…} aria-label="…" />`. If no variant fits, extend the shared Button rather than importing Mantine.',
+  },
+  {
+    selector:
+      "ImportDeclaration[source.value='@mantine/core'] > ImportSpecifier[imported.name='SegmentedControl']",
+    message:
+      "Use the shared SegmentedControl (@app/ui/SegmentedControl) instead of Mantine's.",
+  },
+  {
+    selector:
+      "ImportDeclaration[source.value='@mantine/core'] > ImportSpecifier[imported.name=/^(Chip|Pill)$/]",
+    message:
+      "Use the shared Chip (@app/ui/Chip) instead of Mantine's Chip/Pill.",
+  },
+];
+
+// Raw <button> should be a shared Button too — but bespoke CSS-styled controls
+// (tabs, nav rows, preset chips) can be exempted from this selector alone.
+const rawButtonSyntaxRestriction = {
+  selector: "JSXOpeningElement[name.name='button']",
+  message:
+    "Use the shared Button (@app/ui/Button) instead of a raw <button> element. If no variant fits, extend the shared Button.",
+};
+
+const sharedComponentSyntaxRestrictions = [
+  ...mantineComponentImportRestrictions,
+  rawButtonSyntaxRestriction,
+];
+
 export default defineConfig(
   {
     // Everything that contains 3rd party code that we don't want to lint
@@ -146,6 +182,7 @@ export default defineConfig(
       ],
       "no-restricted-syntax": [
         "error",
+        ...sharedComponentSyntaxRestrictions,
         {
           selector:
             "MemberExpression[object.name='window'][property.name='location']",
@@ -161,6 +198,46 @@ export default defineConfig(
       ],
     },
   },
+  // app code must use shared DS Button/SegmentedControl/Chip; cloud/ covered above.
+  {
+    files: ["editor/src/**/*.{js,mjs,jsx,ts,tsx}"],
+    ignores: [
+      "editor/src/cloud/**/*.{js,mjs,jsx,ts,tsx}", // covered by cloud/ block above
+      "editor/src/core/ui/**/*.{js,mjs,jsx,ts,tsx}", // the shared DS itself — wraps Mantine/raw elements
+      "**/*.stories.{js,mjs,jsx,ts,tsx}", // stories may demo Mantine directly
+      "**/*.test.{js,mjs,jsx,ts,tsx}", // tests may use raw elements as fixtures
+      "editor/src/prototypes/**/*.{js,mjs,jsx,ts,tsx}", // not shipped
+    ],
+    rules: {
+      "no-restricted-syntax": ["error", ...sharedComponentSyntaxRestrictions],
+    },
+  },
+  // Intentional exceptions: ARIA tablist tabs and sub-26px segmented header —
+  // semantically not buttons; shared Button sizing can't represent them.
+  // Do NOT add ordinary buttons here.
+  {
+    files: [
+      "editor/src/core/components/shared/FileSelectorPicker.tsx",
+      "editor/src/core/components/filesPage/FileManagerView.tsx",
+      "editor/src/core/pages/HomePage.tsx",
+    ],
+    rules: {
+      "no-restricted-syntax": "off",
+    },
+  },
+  // TEMPORARY: the procurement feature was merged in from main and still uses
+  // bespoke CSS-styled raw <button>s. Exempt ONLY the raw-<button> rule here —
+  // the Mantine import bans stay in force so this feature can't regress to
+  // Mantine's Button/Chip/SegmentedControl — and migrate these to the shared
+  // Button in a follow-up PR. Do NOT add other folders to this block.
+  {
+    files: [
+      "editor/src/portal/components/procurement/**/*.{js,mjs,jsx,ts,tsx}",
+    ],
+    rules: {
+      "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],
+    },
+  },
   // Stricter rules that not all sub-folders are conformant to yet.
   {
     files: srcGlobs,
diff --git a/frontend/scripts/find-unused-css.mjs b/frontend/scripts/find-unused-css.mjs
new file mode 100644
index 0000000000..358965a729
--- /dev/null
+++ b/frontend/scripts/find-unused-css.mjs
@@ -0,0 +1,129 @@
+// Conservative unused-CSS detector (no deps).
+// Reports CSS class selectors + custom properties that have ZERO references
+// anywhere in the frontend source (className strings, `styles.x` module access,
+// template-literal tokens, `var(--x)`, inline `"--x":` custom props, `composes:`).
+// Conservative by design: if a token appears ANYWHERE outside its own selector
+// definition, it's treated as USED (so dynamically-built classes are kept).
+//
+// Usage: cd frontend && node scripts/find-unused-css.mjs [filterSubstring]
+
+import { readFileSync, readdirSync } from "node:fs";
+import { join, extname, isAbsolute } from "node:path";
+
+const ROOTS = ["editor/src", "shared", "portal/src"];
+const SRC_EXT = new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".html",
+  ".mdx",
+]);
+const filter = process.argv[2] ?? "";
+
+function walk(dir, acc = []) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return acc;
+  }
+  for (const e of entries) {
+    if (
+      e.name === "node_modules" ||
+      e.name === "dist" ||
+      e.name.startsWith(".")
+    )
+      continue;
+    // Dirents from readdirSync are always single path components, but guard
+    // anyway so a name can never escape `dir` (satisfies Aikido's path-traversal
+    // check on the readFile below).
+    if (e.name.includes("..") || isAbsolute(e.name)) continue;
+    const p = join(dir, e.name);
+    if (e.isDirectory()) walk(p, acc);
+    // Exclude the temporary button-catalog gallery so its reproduced classes
+    // don't mask genuinely-dead CSS.
+    else if (!p.includes("_buttonGallery")) acc.push(p);
+  }
+  return acc;
+}
+
+const allFiles = ROOTS.flatMap((r) => walk(r));
+const cssFiles = allFiles.filter((f) => extname(f) === ".css");
+const srcFiles = allFiles.filter((f) => SRC_EXT.has(extname(f)));
+
+const srcCorpus = srcFiles.map((f) => readFileSync(f, "utf8")).join("\n");
+const cssCorpus = cssFiles.map((f) => readFileSync(f, "utf8")).join("\n");
+
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// --- collect definitions ---------------------------------------------------
+const classDef = new Map(); // class -> Set(file)
+const varDef = new Map(); // --var -> Set(file)
+
+for (const f of cssFiles) {
+  const clean = readFileSync(f, "utf8").replace(/\/\*[\s\S]*?\*\//g, "");
+  // class names only from SELECTOR preludes (text before each `{`), so we don't
+  // pick up `.png`/`.svg` etc. inside property values.
+  for (const rule of clean.matchAll(/([^{}]*)\{/g)) {
+    for (const m of rule[1].matchAll(/\.(-?[a-zA-Z_][\w-]*)/g)) {
+      if (!classDef.has(m[1])) classDef.set(m[1], new Set());
+      classDef.get(m[1]).add(f);
+    }
+  }
+  for (const m of clean.matchAll(/(--[a-zA-Z][\w-]*)\s*:/g)) {
+    if (!varDef.has(m[1])) varDef.set(m[1], new Set());
+    varDef.get(m[1]).add(f);
+  }
+}
+
+// --- usage checks ----------------------------------------------------------
+function classUsed(c) {
+  // token in any source file (className="..", clsx, `tpl-${}`, styles.camel, etc.)
+  if (new RegExp(`(^|[^\\w-])${esc(c)}([^\\w-]|$)`).test(srcCorpus))
+    return true;
+  // composed by another stylesheet
+  if (new RegExp(`composes:[^;]*\\b${esc(c)}\\b`).test(cssCorpus)) return true;
+  // dynamically constructed: a `-`/`_`-bounded prefix of `c` is immediately
+  // followed by a template `${...}` in source, e.g. `sui-btn--${variant}`.
+  for (let i = c.length - 1; i >= 3; i--) {
+    if (c[i] === "-" || c[i] === "_") {
+      if (new RegExp(`${esc(c.slice(0, i + 1))}\\$\\{`).test(srcCorpus))
+        return true;
+    }
+  }
+  return false;
+}
+function varUsed(v) {
+  if (new RegExp(`var\\(\\s*${esc(v)}\\b`).test(cssCorpus + "\n" + srcCorpus))
+    return true;
+  if (new RegExp(`["']${esc(v)}["']\\s*:`).test(srcCorpus)) return true; // inline custom prop
+  return false;
+}
+
+const rel = (f) =>
+  f.replace("editor/src/", "").replace("portal/src/", "portal/");
+// `mantine-*` are the framework's own runtime classes (applied by Mantine, not
+// referenced in our source) — exclude; they can't be validated by source refs.
+const unusedClasses = [...classDef.keys()]
+  .filter((c) => !c.startsWith("mantine-") && !classUsed(c))
+  .sort();
+const unusedVars = [...varDef.keys()].filter((v) => !varUsed(v)).sort();
+
+const show = (name) =>
+  !filter || name.toLowerCase().includes(filter.toLowerCase());
+
+console.log(
+  `\n=== UNUSED CLASSES (${unusedClasses.filter(show).length}${filter ? ` matching "${filter}"` : ""} of ${unusedClasses.length} total) ===`,
+);
+for (const c of unusedClasses.filter(show)) {
+  console.log(`.${c}\t${[...classDef.get(c)].map(rel).join(", ")}`);
+}
+console.log(
+  `\n=== UNUSED VARS (${unusedVars.filter(show).length}${filter ? ` matching "${filter}"` : ""} of ${unusedVars.length} total) ===`,
+);
+for (const v of unusedVars.filter(show)) {
+  console.log(`${v}\t${[...varDef.get(v)].map(rel).join(", ")}`);
+}
diff --git a/frontend/shared/components/index.ts b/frontend/shared/components/index.ts
new file mode 100644
index 0000000000..86117f0eaa
--- /dev/null
+++ b/frontend/shared/components/index.ts
@@ -0,0 +1,45 @@
+export * from "@shared/components/Button";
+export * from "@shared/components/ActionIcon";
+export * from "@shared/components/FilePicker";
+export * from "@shared/components/StatusBadge";
+export * from "@shared/components/MethodBadge";
+export * from "@shared/components/ToggleSwitch";
+export * from "@shared/components/ProgressBar";
+export * from "@shared/components/MetricCard";
+export * from "@shared/components/NavItem";
+export * from "@shared/components/PanelHeader";
+export * from "@shared/components/CodeBlock";
+export * from "@shared/components/SectionDivider";
+export * from "@shared/components/Card";
+export * from "@shared/components/Modal";
+export * from "@shared/components/SettingsShell";
+
+// Layout
+export * from "@shared/components/Stack";
+export * from "@shared/components/Inline";
+export * from "@shared/components/MetricStrip";
+export * from "@shared/components/StatTile";
+
+// Feedback
+export * from "@shared/components/Spinner";
+export * from "@shared/components/Skeleton";
+export * from "@shared/components/Avatar";
+export * from "@shared/components/Chip";
+export * from "@shared/components/EmptyState";
+export * from "@shared/components/Banner";
+export * from "@shared/components/Toast";
+
+// Compound
+export * from "@shared/components/Collapsible";
+export * from "@shared/components/Tabs";
+export * from "@shared/components/Dropdown";
+export * from "@shared/components/Drawer";
+export * from "@shared/components/Table";
+
+// Forms
+export * from "@shared/components/FormField";
+export * from "@shared/components/Input";
+export * from "@shared/components/Select";
+export * from "@shared/components/Checkbox";
+export * from "@shared/components/Radio";
+export * from "@shared/components/Slider";

From be57f1174729091eaa942ee1707b4b9c5baec896 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 7 Jul 2026 17:43:06 +0100
Subject: [PATCH 17/35] Improve type safety of tool definitions (#6895)

# Description of Changes
Followup work requested in review of #6867. Currently, there is nothing
enforcing that the endpoint chosen in the tool config is the correct
mapping for `toApiParams`, so theoretically it's possible for a tool to
be set up to call an endpoint with the wrong API params for it. There's
also nothing currently enforcing that `toApiParams` and `fromApiParams`
are compatible with each other (using the same types). This PR changes
it so that instead of creating the config object directly, tools create
it via a generic function, which enforces that all of the relevant
mappings are using compatible types.
---
 .../useAddPageNumbersOperation.ts             |  7 +-
 .../tools/addStamp/useAddStampOperation.ts    |  7 +-
 .../useAddAttachmentsOperation.ts             | 21 +++--
 .../addPassword/useAddPasswordOperation.ts    |  7 +-
 .../addWatermark/useAddWatermarkOperation.ts  |  7 +-
 .../useAdjustContrastOperation.ts             |  9 +--
 .../useAdjustPageScaleOperation.ts            |  7 +-
 .../autoRename/useAutoRenameOperation.ts      |  7 +-
 .../tools/automate/useAutomateOperation.ts    | 15 ++--
 .../useBookletImpositionOperation.ts          |  7 +-
 .../tools/certSign/useCertSignOperation.ts    |  8 +-
 .../useChangeMetadataOperation.ts             |  7 +-
 .../useChangePermissionsOperation.ts          |  7 +-
 .../tools/compress/useCompressOperation.ts    |  7 +-
 .../tools/convert/useConvertOperation.ts      |  7 +-
 .../core/hooks/tools/crop/useCropOperation.ts |  7 +-
 .../useEditTableOfContentsOperation.ts        | 19 ++---
 .../useExtractImagesOperation.ts              |  7 +-
 .../extractPages/useExtractPagesOperation.ts  |  7 +-
 .../tools/flatten/useFlattenOperation.ts      |  8 +-
 .../hooks/tools/merge/useMergeOperation.ts    |  8 +-
 .../core/hooks/tools/ocr/useOCROperation.ts   |  7 +-
 .../overlayPdfs/useOverlayPdfsOperation.ts    |  7 +-
 .../pageLayout/usePageLayoutOperation.ts      |  7 +-
 .../hooks/tools/redact/useRedactOperation.ts  |  7 +-
 .../useRemoveAnnotationsOperation.ts          |  7 +-
 .../removeBlanks/useRemoveBlanksOperation.ts  |  8 +-
 .../useRemoveCertificateSignOperation.ts      |  7 +-
 .../removeImage/useRemoveImageOperation.ts    | 19 ++---
 .../removePages/useRemovePagesOperation.ts    |  8 +-
 .../useRemovePasswordOperation.ts             |  7 +-
 .../useReorganizePagesOperation.ts            | 19 ++---
 .../hooks/tools/repair/useRepairOperation.ts  |  7 +-
 .../replaceColor/useReplaceColorOperation.ts  |  8 +-
 .../hooks/tools/rotate/useRotateOperation.ts  |  7 +-
 .../tools/sanitize/useSanitizeOperation.ts    |  8 +-
 .../useScannerImageSplitOperation.ts          |  7 +-
 .../tools/shared/migratedToolMappers.test.ts  |  8 +-
 .../hooks/tools/shared/toolOperationTypes.ts  | 78 ++++++++++++++-----
 .../hooks/tools/shared/useToolOperation.ts    | 18 +++--
 .../core/hooks/tools/sign/useSignOperation.ts |  7 +-
 .../useSingleLargePageOperation.ts            |  7 +-
 .../hooks/tools/split/useSplitOperation.ts    | 12 +--
 .../timestampPdf/useTimestampPdfOperation.ts  |  8 +-
 .../useUnlockPdfFormsOperation.ts             |  7 +-
 .../pdfCommentAgentOperationConfig.ts         | 17 ++--
 46 files changed, 239 insertions(+), 249 deletions(-)

diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts b/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
index cb5624bce2..ba8ca13b32 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/useAddPageNumbersOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -73,15 +73,14 @@ export const buildAddPageNumbersFormData = (
 ): FormData =>
   objectToFormData(addPageNumbersToApiParams(parameters), { fileInput: file });
 
-export const addPageNumbersOperationConfig = {
-  toolType: ToolType.singleFile,
+export const addPageNumbersOperationConfig = defineSingleFileTool({
   buildFormData: buildAddPageNumbersFormData,
   toApiParams: addPageNumbersToApiParams,
   fromApiParams: addPageNumbersFromApiParams,
   operationType: "addPageNumbers",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useAddPageNumbersOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts b/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
index bdceee49f1..71510694b0 100644
--- a/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
+++ b/frontend/editor/src/core/components/tools/addStamp/useAddStampOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -87,15 +87,14 @@ export const buildAddStampFormData = (
       : { fileInput: file },
   );
 
-export const addStampOperationConfig = {
-  toolType: ToolType.singleFile,
+export const addStampOperationConfig = defineSingleFileTool({
   buildFormData: buildAddStampFormData,
   toApiParams: addStampToApiParams,
   fromApiParams: addStampFromApiParams,
   operationType: "addStamp",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useAddStampOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts b/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
index bc9fb738bc..ddbf20f247 100644
--- a/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addAttachments/useAddAttachmentsOperation.ts
@@ -1,8 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolOperationConfig,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -48,16 +47,14 @@ const buildFormData = (
   });
 
 // Operation configuration for automation
-export const addAttachmentsOperationConfig: ToolOperationConfig<AddAttachmentsParameters> =
-  {
-    toolType: ToolType.singleFile,
-    buildFormData,
-    toApiParams: addAttachmentsToApiParams,
-    fromApiParams: addAttachmentsFromApiParams,
-    operationType: "addAttachments",
-    endpoint: ENDPOINT,
-    defaultParameters: DEFAULT_ADD_ATTACHMENTS_PARAMETERS,
-  };
+export const addAttachmentsOperationConfig = defineSingleFileTool({
+  buildFormData,
+  toApiParams: addAttachmentsToApiParams,
+  fromApiParams: addAttachmentsFromApiParams,
+  operationType: "addAttachments",
+  endpoint: ENDPOINT,
+  defaultParameters: DEFAULT_ADD_ATTACHMENTS_PARAMETERS,
+});
 
 export const useAddAttachmentsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
index 0bc3c1b396..f6eca6ffbd 100644
--- a/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addPassword/useAddPasswordOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -85,15 +85,14 @@ const fullDefaultParameters: AddPasswordFullParameters = {
 };
 
 // Static configuration object
-export const addPasswordOperationConfig = {
-  toolType: ToolType.singleFile,
+export const addPasswordOperationConfig = defineSingleFileTool({
   buildFormData: buildAddPasswordFormData,
   toApiParams: addPasswordToApiParams,
   fromApiParams: addPasswordFromApiParams,
   operationType: "addPassword",
   endpoint: ENDPOINT,
   defaultParameters: fullDefaultParameters,
-} as const;
+});
 
 export const useAddPasswordOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
index 75651f7bcd..423110a2d2 100644
--- a/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/addWatermark/useAddWatermarkOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -87,15 +87,14 @@ export const buildAddWatermarkFormData = (
   );
 
 // Static configuration object
-export const addWatermarkOperationConfig = {
-  toolType: ToolType.singleFile,
+export const addWatermarkOperationConfig = defineSingleFileTool({
   buildFormData: buildAddWatermarkFormData,
   toApiParams: addWatermarkToApiParams,
   fromApiParams: addWatermarkFromApiParams,
   operationType: "watermark",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useAddWatermarkOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/adjustContrast/useAdjustContrastOperation.ts b/frontend/editor/src/core/hooks/tools/adjustContrast/useAdjustContrastOperation.ts
index 4a26de244d..18981b58d0 100644
--- a/frontend/editor/src/core/hooks/tools/adjustContrast/useAdjustContrastOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/adjustContrast/useAdjustContrastOperation.ts
@@ -1,6 +1,6 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
+  defineCustomTool,
   useToolOperation,
   CustomProcessorResult,
 } from "@app/hooks/tools/shared/useToolOperation";
@@ -195,14 +195,11 @@ async function processPdfClientSide(
   };
 }
 
-export const adjustContrastOperationConfig = {
-  toolType: ToolType.custom,
+export const adjustContrastOperationConfig = defineCustomTool({
   customProcessor: processPdfClientSide,
   operationType: "adjustContrast",
   defaultParameters,
-  settingsComponentPath:
-    "components/tools/adjustContrast/AdjustContrastSingleStepSettings",
-} as const;
+});
 
 export const useAdjustContrastOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
index c25e12e3a9..db0ce22da2 100644
--- a/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/adjustPageScale/useAdjustPageScaleOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
@@ -21,15 +21,14 @@ export {
   adjustPageScaleFromApiParams,
 };
 
-export const adjustPageScaleOperationConfig = {
-  toolType: ToolType.singleFile,
+export const adjustPageScaleOperationConfig = defineSingleFileTool({
   buildFormData: buildAdjustPageScaleFormData,
   toApiParams: adjustPageScaleToApiParams,
   fromApiParams: adjustPageScaleFromApiParams,
   operationType: "scalePages",
   endpoint: ADJUST_PAGE_SCALE_ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useAdjustPageScaleOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts b/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
index faca5b0ae7..15466998e5 100644
--- a/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/autoRename/useAutoRenameOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -44,8 +44,7 @@ export const buildAutoRenameFormData = (
   objectToFormData(autoRenameToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const autoRenameOperationConfig = {
-  toolType: ToolType.singleFile,
+export const autoRenameOperationConfig = defineSingleFileTool({
   buildFormData: buildAutoRenameFormData,
   toApiParams: autoRenameToApiParams,
   fromApiParams: autoRenameFromApiParams,
@@ -53,7 +52,7 @@ export const autoRenameOperationConfig = {
   endpoint: ENDPOINT,
   preserveBackendFilename: true, // Use filename from backend response headers
   defaultParameters,
-} as const;
+});
 
 export const useAutoRenameOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/automate/useAutomateOperation.ts b/frontend/editor/src/core/hooks/tools/automate/useAutomateOperation.ts
index 2ef3d33d96..d1d6436fa9 100644
--- a/frontend/editor/src/core/hooks/tools/automate/useAutomateOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/automate/useAutomateOperation.ts
@@ -1,5 +1,5 @@
 import {
-  ToolType,
+  defineCustomTool,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
 import { useCallback } from "react";
@@ -55,10 +55,11 @@ export function useAutomateOperation() {
     [toolRegistry],
   );
 
-  return useToolOperation<AutomateParameters>({
-    toolType: ToolType.custom,
-    operationType: "automate",
-    customProcessor,
-    consumesAllInputs: true,
-  });
+  return useToolOperation<AutomateParameters>(
+    defineCustomTool({
+      operationType: "automate",
+      customProcessor,
+      consumesAllInputs: true,
+    }),
+  );
 }
diff --git a/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts b/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
index f5a213d48c..7add5d126c 100644
--- a/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/bookletImposition/useBookletImpositionOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -59,15 +59,14 @@ export const buildBookletImpositionFormData = (
   });
 
 // Static configuration object
-export const bookletImpositionOperationConfig = {
-  toolType: ToolType.singleFile,
+export const bookletImpositionOperationConfig = defineSingleFileTool({
   buildFormData: buildBookletImpositionFormData,
   toApiParams: bookletImpositionToApiParams,
   fromApiParams: bookletImpositionFromApiParams,
   operationType: "bookletImposition",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useBookletImpositionOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts b/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
index 9f4767044e..01cfa32b1a 100644
--- a/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/certSign/useCertSignOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -136,16 +136,14 @@ export const buildCertSignFormData = (
   });
 
 // Static configuration object
-export const certSignOperationConfig = {
-  toolType: ToolType.singleFile,
+export const certSignOperationConfig = defineSingleFileTool({
   buildFormData: buildCertSignFormData,
   toApiParams: certSignToApiParams,
   fromApiParams: certSignFromApiParams,
   operationType: "certSign",
   endpoint: ENDPOINT,
-  multiFileEndpoint: false,
   defaultParameters,
-} as const;
+});
 
 export const useCertSignOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
index 045b029522..6b0cd8b5d5 100644
--- a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
@@ -75,13 +75,12 @@ export const buildChangeMetadataFormData = (
 };
 
 // Static configuration object
-export const changeMetadataOperationConfig = {
-  toolType: ToolType.singleFile,
+export const changeMetadataOperationConfig = defineSingleFileTool({
   buildFormData: buildChangeMetadataFormData,
   operationType: "changeMetadata",
   endpoint: "/api/v1/misc/update-metadata",
   defaultParameters,
-} as const;
+});
 
 export const useChangeMetadataOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
index dd0c532706..a2e3eb3d1d 100644
--- a/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/changePermissions/useChangePermissionsOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -71,15 +71,14 @@ export const buildChangePermissionsFormData = (
   });
 
 // Static configuration object
-export const changePermissionsOperationConfig = {
-  toolType: ToolType.singleFile,
+export const changePermissionsOperationConfig = defineSingleFileTool({
   buildFormData: buildChangePermissionsFormData,
   toApiParams: changePermissionsToApiParams,
   fromApiParams: changePermissionsFromApiParams,
   operationType: "changePermissions",
   endpoint: ENDPOINT, // Change Permissions is a fake endpoint for the Add Password tool
   defaultParameters,
-} as const;
+});
 
 export const useChangePermissionsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
index f62c981879..b24bb8c6ee 100644
--- a/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/compress/useCompressOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -90,15 +90,14 @@ export const buildCompressFormData = (
   objectToFormData(compressToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const compressOperationConfig = {
-  toolType: ToolType.singleFile,
+export const compressOperationConfig = defineSingleFileTool({
   buildFormData: buildCompressFormData,
   toApiParams: compressToApiParams,
   fromApiParams: compressFromApiParams,
   operationType: "compress",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useCompressOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/convert/useConvertOperation.ts b/frontend/editor/src/core/hooks/tools/convert/useConvertOperation.ts
index 1da1b96b31..a9488e373d 100644
--- a/frontend/editor/src/core/hooks/tools/convert/useConvertOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/convert/useConvertOperation.ts
@@ -8,7 +8,7 @@ import {
 import { createFileFromApiResponse } from "@app/utils/fileResponseUtils";
 import {
   useToolOperation,
-  ToolType,
+  defineCustomTool,
   CustomProcessorResult,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
@@ -300,8 +300,7 @@ export const convertProcessor = async (
 };
 
 // Static configuration object
-export const convertOperationConfig = {
-  toolType: ToolType.custom,
+export const convertOperationConfig = defineCustomTool({
   customProcessor: convertProcessor, // Can't use callback version here
   operationType: "convert",
   defaultParameters,
@@ -311,7 +310,7 @@ export const convertOperationConfig = {
       params.toExtension === "pdfx" ? "pdfa" : params.toExtension;
     return getEndpointUrl(params.fromExtension, actualToExtension) ?? undefined;
   },
-} as const;
+});
 
 export const useConvertOperation = (parameters?: ConvertParameters) => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
index 24dc35daa3..b3a69f9dbe 100644
--- a/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/crop/useCropOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -59,15 +59,14 @@ export const buildCropFormData = (
   objectToFormData(cropToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const cropOperationConfig = {
-  toolType: ToolType.singleFile,
+export const cropOperationConfig = defineSingleFileTool({
   buildFormData: buildCropFormData,
   toApiParams: cropToApiParams,
   fromApiParams: cropFromApiParams,
   operationType: "crop",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useCropOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
index c395ed0521..8473ea972c 100644
--- a/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/editTableOfContents/useEditTableOfContentsOperation.ts
@@ -1,7 +1,6 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
-  type ToolOperationConfig,
+  defineSingleFileTool,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
@@ -64,15 +63,13 @@ const buildFormData = (
     fileInput: file,
   });
 
-export const editTableOfContentsOperationConfig: ToolOperationConfig<EditTableOfContentsParameters> =
-  {
-    toolType: ToolType.singleFile,
-    operationType: "editTableOfContents",
-    endpoint: ENDPOINT,
-    buildFormData,
-    toApiParams: editTableOfContentsToApiParams,
-    fromApiParams: editTableOfContentsFromApiParams,
-  };
+export const editTableOfContentsOperationConfig = defineSingleFileTool({
+  operationType: "editTableOfContents",
+  endpoint: ENDPOINT,
+  buildFormData,
+  toApiParams: editTableOfContentsToApiParams,
+  fromApiParams: editTableOfContentsFromApiParams,
+});
 
 export const useEditTableOfContentsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts b/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
index 4f43ddf3ec..0a70f43424 100644
--- a/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/extractImages/useExtractImagesOperation.ts
@@ -2,7 +2,7 @@ import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -41,15 +41,14 @@ export const buildExtractImagesFormData = (
   objectToFormData(extractImagesToApiParams(parameters), { fileInput: file });
 
 // Static configuration object (without response handler - will be added in hook)
-export const extractImagesOperationConfig = {
-  toolType: ToolType.singleFile,
+export const extractImagesOperationConfig = defineSingleFileTool({
   buildFormData: buildExtractImagesFormData,
   toApiParams: extractImagesToApiParams,
   fromApiParams: extractImagesFromApiParams,
   operationType: "extractImages",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useExtractImagesOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/extractPages/useExtractPagesOperation.ts b/frontend/editor/src/core/hooks/tools/extractPages/useExtractPagesOperation.ts
index 4119ed191b..0cd5273f0b 100644
--- a/frontend/editor/src/core/hooks/tools/extractPages/useExtractPagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/extractPages/useExtractPagesOperation.ts
@@ -1,7 +1,7 @@
 import apiClient from "@app/services/apiClient";
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
+  defineCustomTool,
   useToolOperation,
   CustomProcessorResult,
 } from "@app/hooks/tools/shared/useToolOperation";
@@ -33,8 +33,7 @@ async function resolveSelectionToCsv(
   }
 }
 
-export const extractPagesOperationConfig = {
-  toolType: ToolType.custom,
+export const extractPagesOperationConfig = defineCustomTool({
   operationType: "extractPages",
   customProcessor: async (
     parameters: ExtractPagesParameters,
@@ -71,7 +70,7 @@ export const extractPagesOperationConfig = {
     };
   },
   defaultParameters,
-} as const;
+});
 
 export const useExtractPagesOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts b/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
index 7e01678e73..4027b7048e 100644
--- a/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/flatten/useFlattenOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -59,16 +59,14 @@ export const buildFlattenFormData = (
   objectToFormData(flattenToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const flattenOperationConfig = {
-  toolType: ToolType.singleFile,
+export const flattenOperationConfig = defineSingleFileTool({
   buildFormData: buildFlattenFormData,
   toApiParams: flattenToApiParams,
   fromApiParams: flattenFromApiParams,
   operationType: "flatten",
   endpoint: ENDPOINT,
-  multiFileEndpoint: false,
   defaultParameters,
-} as const;
+});
 
 export const useFlattenOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
index 9b43f35fcd..fc742ff410 100644
--- a/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/merge/useMergeOperation.ts
@@ -1,8 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolOperationConfig,
-  ToolType,
+  defineMultiFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -56,8 +55,7 @@ const buildFormData = (
 };
 
 // Operation configuration for automation
-export const mergeOperationConfig: ToolOperationConfig<MergeParameters> = {
-  toolType: ToolType.multiFile,
+export const mergeOperationConfig = defineMultiFileTool({
   buildFormData,
   toApiParams: mergeToApiParams,
   fromApiParams: mergeFromApiParams,
@@ -65,7 +63,7 @@ export const mergeOperationConfig: ToolOperationConfig<MergeParameters> = {
   endpoint: ENDPOINT,
   filePrefix: "merged_",
   defaultParameters,
-};
+});
 
 export const useMergeOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts b/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
index e9b1e92b2d..f995ef06fc 100644
--- a/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
+++ b/frontend/editor/src/core/hooks/tools/ocr/useOCROperation.ts
@@ -7,7 +7,7 @@ import {
 import {
   useToolOperation,
   ToolOperationConfig,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -151,15 +151,14 @@ export const ocrResponseHandler = async (
 };
 
 // Static configuration object (without t function dependencies)
-export const ocrOperationConfig = {
-  toolType: ToolType.singleFile,
+export const ocrOperationConfig = defineSingleFileTool({
   buildFormData: buildOCRFormData,
   toApiParams: ocrToApiParams,
   fromApiParams: ocrFromApiParams,
   operationType: "ocr",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useOCROperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts b/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
index 448d70346d..f71c237e9d 100644
--- a/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/overlayPdfs/useOverlayPdfsOperation.ts
@@ -1,8 +1,8 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
   type ToolOperationConfig,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -60,14 +60,13 @@ const buildFormData = (
   });
 
 export const overlayPdfsOperationConfig: ToolOperationConfig<OverlayPdfsParameters> =
-  {
-    toolType: ToolType.singleFile,
+  defineSingleFileTool({
     buildFormData,
     toApiParams: overlayPdfsToApiParams,
     fromApiParams: overlayPdfsFromApiParams,
     operationType: "overlayPdfs",
     endpoint: ENDPOINT,
-  };
+  });
 
 export const useOverlayPdfsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
index dce2101cd4..5de635f965 100644
--- a/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/pageLayout/usePageLayoutOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -67,15 +67,14 @@ export const buildPageLayoutFormData = (
 ): FormData =>
   objectToFormData(pageLayoutToApiParams(parameters), { fileInput: file });
 
-export const pageLayoutOperationConfig = {
-  toolType: ToolType.singleFile,
+export const pageLayoutOperationConfig = defineSingleFileTool({
   buildFormData: buildPageLayoutFormData,
   toApiParams: pageLayoutToApiParams,
   fromApiParams: pageLayoutFromApiParams,
   operationType: "pageLayout",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const usePageLayoutOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
index c7cefe1f43..d93e3953c9 100644
--- a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -64,8 +64,7 @@ export const buildRedactFormData = (
 };
 
 // Static configuration object
-export const redactOperationConfig = {
-  toolType: ToolType.singleFile,
+export const redactOperationConfig = defineSingleFileTool({
   buildFormData: buildRedactFormData,
   toApiParams: redactToApiParams,
   fromApiParams: redactFromApiParams,
@@ -73,7 +72,7 @@ export const redactOperationConfig = {
   endpoint: (parameters: RedactParameters) =>
     parameters.mode === "automatic" ? AUTO_ENDPOINT : null,
   defaultParameters,
-} as const;
+});
 
 export const useRedactOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removeAnnotations/useRemoveAnnotationsOperation.ts b/frontend/editor/src/core/hooks/tools/removeAnnotations/useRemoveAnnotationsOperation.ts
index 4f9d3fbc7d..de4f384b9e 100644
--- a/frontend/editor/src/core/hooks/tools/removeAnnotations/useRemoveAnnotationsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeAnnotations/useRemoveAnnotationsOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineCustomTool,
   CustomProcessorResult,
 } from "@app/hooks/tools/shared/useToolOperation";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
@@ -78,12 +78,11 @@ const removeAnnotationsProcessor = async (
 };
 
 // Static configuration object
-export const removeAnnotationsOperationConfig = {
-  toolType: ToolType.custom,
+export const removeAnnotationsOperationConfig = defineCustomTool({
   operationType: "removeAnnotations",
   customProcessor: removeAnnotationsProcessor,
   defaultParameters,
-} as const;
+});
 
 export const useRemoveAnnotationsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts b/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
index 2cde7832e4..54e45d43fe 100644
--- a/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeBlanks/useRemoveBlanksOperation.ts
@@ -1,9 +1,8 @@
 import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
-  ToolOperationConfig,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -41,15 +40,14 @@ export const buildRemoveBlanksFormData = (
 ): FormData =>
   objectToFormData(removeBlanksToApiParams(parameters), { fileInput: file });
 
-export const removeBlanksOperationConfig = {
-  toolType: ToolType.singleFile,
+export const removeBlanksOperationConfig = defineSingleFileTool({
   buildFormData: buildRemoveBlanksFormData,
   toApiParams: removeBlanksToApiParams,
   fromApiParams: removeBlanksFromApiParams,
   operationType: "removeBlanks",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const satisfies ToolOperationConfig<RemoveBlanksParameters>;
+});
 
 export const useRemoveBlanksOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts b/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
index 55d053fe09..fd2b5200c3 100644
--- a/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeCertificateSign/useRemoveCertificateSignOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   fileOnlyMapping,
@@ -25,15 +25,14 @@ export const buildRemoveCertificateSignFormData = (
 ): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
-export const removeCertificateSignOperationConfig = {
-  toolType: ToolType.singleFile,
+export const removeCertificateSignOperationConfig = defineSingleFileTool({
   buildFormData: buildRemoveCertificateSignFormData,
   toApiParams,
   fromApiParams,
   operationType: "removeCertSign",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useRemoveCertificateSignOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts b/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
index 2ba770c822..96de39321c 100644
--- a/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removeImage/useRemoveImageOperation.ts
@@ -1,8 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolOperationConfig,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   fileOnlyMapping,
@@ -22,15 +21,13 @@ export const buildRemoveImageFormData = (
   file: File,
 ): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
-export const removeImageOperationConfig: ToolOperationConfig<RemoveImageParameters> =
-  {
-    toolType: ToolType.singleFile,
-    buildFormData: buildRemoveImageFormData,
-    toApiParams,
-    fromApiParams,
-    operationType: "removeImage",
-    endpoint: ENDPOINT,
-  };
+export const removeImageOperationConfig = defineSingleFileTool({
+  buildFormData: buildRemoveImageFormData,
+  toApiParams,
+  fromApiParams,
+  operationType: "removeImage",
+  endpoint: ENDPOINT,
+});
 
 export const useRemoveImageOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts b/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
index 8d8f14f3b4..c8a8aca2d0 100644
--- a/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removePages/useRemovePagesOperation.ts
@@ -1,8 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
-  ToolOperationConfig,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -42,15 +41,14 @@ export const buildRemovePagesFormData = (
 ): FormData =>
   objectToFormData(removePagesToApiParams(parameters), { fileInput: file });
 
-export const removePagesOperationConfig = {
-  toolType: ToolType.singleFile,
+export const removePagesOperationConfig = defineSingleFileTool({
   buildFormData: buildRemovePagesFormData,
   toApiParams: removePagesToApiParams,
   fromApiParams: removePagesFromApiParams,
   operationType: "removePages",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const satisfies ToolOperationConfig<RemovePagesParameters>;
+});
 
 export const useRemovePagesOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts b/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
index 2d516b861b..644bbe3b1a 100644
--- a/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/removePassword/useRemovePasswordOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
 import {
@@ -19,15 +19,14 @@ import {
 export { buildRemovePasswordFormData };
 
 // Static configuration object
-export const removePasswordOperationConfig = {
-  toolType: ToolType.singleFile,
+export const removePasswordOperationConfig = defineSingleFileTool({
   buildFormData: buildRemovePasswordFormData,
   toApiParams: removePasswordToApiParams,
   fromApiParams: removePasswordFromApiParams,
   operationType: "removePassword",
   endpoint: REMOVE_PASSWORD_ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useRemovePasswordOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts b/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
index 2bdb75f31c..457132887b 100644
--- a/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/reorganizePages/useReorganizePagesOperation.ts
@@ -1,7 +1,6 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolOperationConfig,
-  ToolType,
+  defineSingleFileTool,
   useToolOperation,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
@@ -54,15 +53,13 @@ const buildFormData = (
     fileInput: file,
   });
 
-export const reorganizePagesOperationConfig: ToolOperationConfig<ReorganizePagesParameters> =
-  {
-    toolType: ToolType.singleFile,
-    buildFormData,
-    toApiParams: reorganizePagesToApiParams,
-    fromApiParams: reorganizePagesFromApiParams,
-    operationType: "reorganizePages",
-    endpoint: ENDPOINT,
-  };
+export const reorganizePagesOperationConfig = defineSingleFileTool({
+  buildFormData,
+  toApiParams: reorganizePagesToApiParams,
+  fromApiParams: reorganizePagesFromApiParams,
+  operationType: "reorganizePages",
+  endpoint: ENDPOINT,
+});
 
 export const useReorganizePagesOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts b/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
index ef60151d07..af05cf59b9 100644
--- a/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/repair/useRepairOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   fileOnlyMapping,
@@ -25,15 +25,14 @@ export const buildRepairFormData = (
 ): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
-export const repairOperationConfig = {
-  toolType: ToolType.singleFile,
+export const repairOperationConfig = defineSingleFileTool({
   buildFormData: buildRepairFormData,
   toApiParams,
   fromApiParams,
   operationType: "repair",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useRepairOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts b/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
index 94bbc32d9e..33223afa43 100644
--- a/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/replaceColor/useReplaceColorOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -62,16 +62,14 @@ export const buildReplaceColorFormData = (
 ): FormData =>
   objectToFormData(replaceColorToApiParams(parameters), { fileInput: file });
 
-export const replaceColorOperationConfig = {
-  toolType: ToolType.singleFile,
+export const replaceColorOperationConfig = defineSingleFileTool({
   buildFormData: buildReplaceColorFormData,
   toApiParams: replaceColorToApiParams,
   fromApiParams: replaceColorFromApiParams,
   operationType: "replaceColor",
   endpoint: ENDPOINT,
-  multiFileEndpoint: false,
   defaultParameters,
-} as const;
+});
 
 export const useReplaceColorOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
index 7e73aab99f..f8c6d32216 100644
--- a/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/rotate/useRotateOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -43,15 +43,14 @@ export const buildRotateFormData = (
   objectToFormData(rotateToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const rotateOperationConfig = {
-  toolType: ToolType.singleFile,
+export const rotateOperationConfig = defineSingleFileTool({
   buildFormData: buildRotateFormData,
   toApiParams: rotateToApiParams,
   fromApiParams: rotateFromApiParams,
   operationType: "rotate",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useRotateOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts b/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
index 93fd64240d..26a5ca7250 100644
--- a/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/sanitize/useSanitizeOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -55,16 +55,14 @@ export const buildSanitizeFormData = (
   objectToFormData(sanitizeToApiParams(parameters), { fileInput: file });
 
 // Static configuration object
-export const sanitizeOperationConfig = {
-  toolType: ToolType.singleFile,
+export const sanitizeOperationConfig = defineSingleFileTool({
   buildFormData: buildSanitizeFormData,
   toApiParams: sanitizeToApiParams,
   fromApiParams: sanitizeFromApiParams,
   operationType: "sanitize",
   endpoint: ENDPOINT,
-  multiFileEndpoint: false,
   defaultParameters,
-} as const;
+});
 
 export const useSanitizeOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts b/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
index 27aadeb98b..26db1414d0 100644
--- a/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/scannerImageSplit/useScannerImageSplitOperation.ts
@@ -1,9 +1,9 @@
 import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
   ToolOperationConfig,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -54,15 +54,14 @@ export const buildScannerImageSplitFormData = (
   });
 
 // Static configuration object
-export const scannerImageSplitOperationConfig = {
-  toolType: ToolType.singleFile,
+export const scannerImageSplitOperationConfig = defineSingleFileTool({
   buildFormData: buildScannerImageSplitFormData,
   toApiParams: scannerImageSplitToApiParams,
   fromApiParams: scannerImageSplitFromApiParams,
   operationType: "scannerImageSplit",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useScannerImageSplitOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
index a809ae9604..be81fd1884 100644
--- a/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
@@ -117,7 +117,7 @@ describe("migrated tool mappers (sweep)", () => {
 
 describe("redact mappers", () => {
   test("toApiParams builds the auto-redact body from UI parameters", () => {
-    const api = redactOperationConfig.toApiParams({
+    const api = redactOperationConfig.toApiParams!({
       mode: "automatic",
       wordsToRedact: ["foo", "bar"],
       useRegex: true,
@@ -138,7 +138,7 @@ describe("redact mappers", () => {
   });
 
   test("round-trips through fromApiParams", () => {
-    const api = redactOperationConfig.toApiParams({
+    const api = redactOperationConfig.toApiParams!({
       mode: "automatic",
       wordsToRedact: ["secret"],
       useRegex: false,
@@ -147,7 +147,7 @@ describe("redact mappers", () => {
       customPadding: 0.1,
       convertPDFToImage: true,
     });
-    const roundTripped = redactOperationConfig.toApiParams({
+    const roundTripped = redactOperationConfig.toApiParams!({
       mode: "automatic",
       wordsToRedact: [],
       useRegex: false,
@@ -155,7 +155,7 @@ describe("redact mappers", () => {
       redactColor: "#000000",
       customPadding: 0,
       convertPDFToImage: false,
-      ...redactOperationConfig.fromApiParams(api),
+      ...redactOperationConfig.fromApiParams!(api),
     });
 
     expect(roundTripped).toEqual(api);
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
index 93ade85368..8a895a78da 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
@@ -3,7 +3,7 @@ import { StirlingFile } from "@app/types/fileContext";
 import type { ResponseHandler } from "@app/utils/toolResponseProcessor";
 import { ToolId } from "@app/types/toolId";
 import type { ProcessingProgress } from "@app/hooks/tools/shared/useToolState";
-import type { ToolApiRequest, ToolEndpoint } from "@app/types/toolApiTypes";
+import type { ToolApiParams, ToolEndpoint } from "@app/types/toolApiTypes";
 
 export type { ProcessingProgress, ResponseHandler };
 
@@ -53,7 +53,7 @@ export interface CustomProcessorResult {
  * 2. Multi-file tools: toolType: multiFile, single API call with all files
  * 3. Complex tools: toolType: custom, customProcessor handles all processing logic
  */
-interface BaseToolOperationConfig<TParams> {
+interface BaseToolOperationConfig<TParams, TEndpoint extends ToolEndpoint> {
   /** Operation identifier for tracking and logging */
   operationType: ToolId;
 
@@ -82,15 +82,16 @@ interface BaseToolOperationConfig<TParams> {
   /**
    * Typed frontend params -> backend request model. When a tool provides this,
    * it is the spec-checked source of truth for the request body and its
-   * buildFormData is derived from it via objectToFormData.
+   * buildFormData is derived from it via objectToFormData. Bound to the tool's
+   * endpoint, so a spec rename of that endpoint's model breaks the build here.
    */
-  toApiParams?(params: TParams): ToolApiRequest;
+  toApiParams?(params: TParams): ToolApiParams[TEndpoint];
 
   /**
    * Backend request model -> partial frontend params, so a stored API call
    * can be re-hydrated into this tool's settings UI.
    */
-  fromApiParams?(apiParams: ToolApiRequest): Partial<TParams>;
+  fromApiParams?(apiParams: ToolApiParams[TEndpoint]): Partial<TParams>;
 
   /**
    * For custom tools: if true, success implies all input files were successfully processed.
@@ -102,7 +103,8 @@ interface BaseToolOperationConfig<TParams> {
 
 export interface SingleFileToolOperationConfig<
   TParams,
-> extends BaseToolOperationConfig<TParams> {
+  TEndpoint extends ToolEndpoint = ToolEndpoint,
+> extends BaseToolOperationConfig<TParams, TEndpoint> {
   /** This tool processes one file at a time. */
   toolType: ToolType.singleFile;
 
@@ -110,18 +112,18 @@ export interface SingleFileToolOperationConfig<
   buildFormData: (params: TParams, file: File) => FormData;
 
   /**
-   * API endpoint for the operation. Can be static or a function for dynamic routing.
+   * API endpoint for the operation, or a function for dynamic routing. `null`
+   * when the operation has no backend endpoint (see {@link ToolOperationEndpoint}).
    */
-  endpoint:
-    | ToolOperationEndpoint
-    | ((params: TParams) => ToolOperationEndpoint);
+  endpoint: TEndpoint | null | ((params: TParams) => TEndpoint | null);
 
   customProcessor?: undefined;
 }
 
 export interface MultiFileToolOperationConfig<
   TParams,
-> extends BaseToolOperationConfig<TParams> {
+  TEndpoint extends ToolEndpoint = ToolEndpoint,
+> extends BaseToolOperationConfig<TParams, TEndpoint> {
   /** This tool processes multiple files at once. */
   toolType: ToolType.multiFile;
 
@@ -132,18 +134,17 @@ export interface MultiFileToolOperationConfig<
   buildFormData: (params: TParams, files: File[]) => FormData;
 
   /**
-   * API endpoint for the operation. Can be static or a function for dynamic routing.
+   * API endpoint for the operation, or a function for dynamic routing. `null`
+   * when the operation has no backend endpoint (see {@link ToolOperationEndpoint}).
    */
-  endpoint:
-    | ToolOperationEndpoint
-    | ((params: TParams) => ToolOperationEndpoint);
+  endpoint: TEndpoint | null | ((params: TParams) => TEndpoint | null);
 
   customProcessor?: undefined;
 }
 
 export interface CustomToolOperationConfig<
   TParams,
-> extends BaseToolOperationConfig<TParams> {
+> extends BaseToolOperationConfig<TParams, ToolEndpoint> {
   /** This tool has custom behaviour. */
   toolType: ToolType.custom;
 
@@ -171,11 +172,50 @@ export interface CustomToolOperationConfig<
   ) => Promise<CustomProcessorResult>;
 }
 
-export type ToolOperationConfig<TParams = void> =
-  | SingleFileToolOperationConfig<TParams>
-  | MultiFileToolOperationConfig<TParams>
+export type ToolOperationConfig<
+  TParams = void,
+  TEndpoint extends ToolEndpoint = ToolEndpoint,
+> =
+  | SingleFileToolOperationConfig<TParams, TEndpoint>
+  | MultiFileToolOperationConfig<TParams, TEndpoint>
   | CustomToolOperationConfig<TParams>;
 
+/**
+ * Define a single-file tool's operation config. Infers the endpoint literal from
+ * `endpoint` and binds toApiParams/fromApiParams to that endpoint's request
+ * model, so a mapper cannot silently drift from the generated spec.
+ */
+export function defineSingleFileTool<
+  TParams,
+  const TEndpoint extends ToolEndpoint,
+>(
+  config: Omit<SingleFileToolOperationConfig<TParams, TEndpoint>, "toolType">,
+): SingleFileToolOperationConfig<TParams, TEndpoint> {
+  return { ...config, toolType: ToolType.singleFile };
+}
+
+/** Multi-file counterpart of {@link defineSingleFileTool}. */
+export function defineMultiFileTool<
+  TParams,
+  const TEndpoint extends ToolEndpoint,
+>(
+  config: Omit<MultiFileToolOperationConfig<TParams, TEndpoint>, "toolType">,
+): MultiFileToolOperationConfig<TParams, TEndpoint> {
+  return { ...config, toolType: ToolType.multiFile };
+}
+
+/**
+ * Custom-processor counterpart of {@link defineSingleFileTool}, for tools whose
+ * customProcessor owns the API calls and file handling. Rejects fields that
+ * belong to the file-based patterns (e.g. buildFormData) and any property not on
+ * the config, so a stray or stale field is a build error rather than dead weight.
+ */
+export function defineCustomTool<TParams>(
+  config: Omit<CustomToolOperationConfig<TParams>, "toolType">,
+): CustomToolOperationConfig<TParams> {
+  return { ...config, toolType: ToolType.custom };
+}
+
 /**
  * One generic source-of-truth for the props every automation settings component
  * accepts: the tool's parameters plus a typed change handler.
diff --git a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
index 17e4c47442..7ee69da142 100644
--- a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
@@ -40,6 +40,9 @@ import {
 } from "@app/hooks/tools/shared/toolOperationHelpers";
 import {
   ToolType,
+  defineSingleFileTool,
+  defineMultiFileTool,
+  defineCustomTool,
   ToolOperationConfig,
   ToolOperationHook,
   CustomProcessorResult,
@@ -50,7 +53,12 @@ import {
   ResponseHandler,
 } from "@app/hooks/tools/shared/toolOperationTypes";
 
-export { ToolType };
+export {
+  ToolType,
+  defineSingleFileTool,
+  defineMultiFileTool,
+  defineCustomTool,
+};
 export type {
   ToolOperationConfig,
   ToolOperationHook,
@@ -69,10 +77,10 @@ export { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
  * Shared hook for tool operations providing consistent error handling, progress tracking,
  * and FileContext integration. Eliminates boilerplate while maintaining flexibility.
  *
- * Supports three tool patterns:
- * 1. Single-file tools: Set multiFileEndpoint: false, processes files individually
- * 2. Multi-file tools: Set multiFileEndpoint: true, single API call with all files
- * 3. Complex tools: Provide customProcessor for full control over processing logic
+ * Supports three tool patterns, selected by the config's toolType:
+ * 1. Single-file tools (ToolType.singleFile): processes files individually
+ * 2. Multi-file tools (ToolType.multiFile): single API call with all files
+ * 3. Complex tools (ToolType.custom): customProcessor takes full control
  *
  * @param config - Tool operation configuration
  * @returns Hook interface with state and execution methods
diff --git a/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts b/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
index 175fa744ab..d54be4ecbf 100644
--- a/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/sign/useSignOperation.ts
@@ -2,7 +2,7 @@ import { useTranslation } from "react-i18next";
 import {
   useToolOperation,
   ToolOperationHook,
-  ToolType,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   SignParameters,
@@ -50,8 +50,7 @@ export const buildSignFormData = (
 };
 
 // Static configuration object
-export const signOperationConfig = {
-  toolType: ToolType.singleFile,
+export const signOperationConfig = defineSingleFileTool({
   buildFormData: buildSignFormData,
   operationType: "sign",
   // Signing is applied client-side in the viewer (see createStampTool ->
@@ -60,7 +59,7 @@ export const signOperationConfig = {
   endpoint: null,
   filePrefix: "signed_",
   defaultParameters: DEFAULT_PARAMETERS,
-} as const;
+});
 
 export const useSignOperation = (): ToolOperationHook<SignParameters> => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts b/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
index 835959c484..432aae59ec 100644
--- a/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/singleLargePage/useSingleLargePageOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   fileOnlyMapping,
@@ -26,15 +26,14 @@ export const buildSingleLargePageFormData = (
 ): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
-export const singleLargePageOperationConfig = {
-  toolType: ToolType.singleFile,
+export const singleLargePageOperationConfig = defineSingleFileTool({
   buildFormData: buildSingleLargePageFormData,
   toApiParams,
   fromApiParams,
   operationType: "pdfToSinglePage",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useSingleLargePageOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
index adeb65546a..fad5b1f04e 100644
--- a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
@@ -1,9 +1,9 @@
 import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
   ToolOperationConfig,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -33,7 +33,8 @@ const SPLIT_ENDPOINTS = {
   [SPLIT_METHODS.BY_POSTER]: "/api/v1/general/split-for-poster-print",
 } as const satisfies Record<SplitMethod, ToolEndpoint>;
 
-type SplitApiParams = ToolApiParams[(typeof SPLIT_ENDPOINTS)[SplitMethod]];
+type SplitEndpoint = (typeof SPLIT_ENDPOINTS)[SplitMethod];
+type SplitApiParams = ToolApiParams[SplitEndpoint];
 type SectionsApiParams =
   ToolApiParams[(typeof SPLIT_ENDPOINTS)[typeof SPLIT_METHODS.BY_SECTIONS]];
 type PosterApiParams =
@@ -165,20 +166,19 @@ export const buildSplitFormData = (
 ): FormData =>
   objectToFormData(splitToApiParams(parameters), { fileInput: file });
 
-export const getSplitEndpoint = (parameters: SplitParameters): ToolEndpoint =>
+export const getSplitEndpoint = (parameters: SplitParameters): SplitEndpoint =>
   // Default to BY_PAGES when no method is selected yet.
   SPLIT_ENDPOINTS[parameters.method ?? SPLIT_METHODS.BY_PAGES];
 
 // Static configuration object
-export const splitOperationConfig = {
-  toolType: ToolType.singleFile,
+export const splitOperationConfig = defineSingleFileTool({
   buildFormData: buildSplitFormData,
   toApiParams: splitToApiParams,
   fromApiParams: splitFromApiParams,
   operationType: "split",
   endpoint: getSplitEndpoint,
   defaultParameters,
-} as const;
+});
 
 export const useSplitOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts b/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
index f607a727f0..0769f37952 100644
--- a/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/timestampPdf/useTimestampPdfOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   objectToFormData,
@@ -35,16 +35,14 @@ export const buildTimestampPdfFormData = (
 ): FormData =>
   objectToFormData(timestampPdfToApiParams(parameters), { fileInput: file });
 
-export const timestampPdfOperationConfig = {
-  toolType: ToolType.singleFile,
+export const timestampPdfOperationConfig = defineSingleFileTool({
   buildFormData: buildTimestampPdfFormData,
   toApiParams: timestampPdfToApiParams,
   fromApiParams: timestampPdfFromApiParams,
   operationType: "timestampPdf",
   endpoint: ENDPOINT,
-  multiFileEndpoint: false,
   defaultParameters,
-} as const;
+});
 
 export const useTimestampPdfOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts b/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
index 2d3e22fb06..2212d284bd 100644
--- a/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/unlockPdfForms/useUnlockPdfFormsOperation.ts
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import {
-  ToolType,
   useToolOperation,
+  defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
 import {
   fileOnlyMapping,
@@ -26,15 +26,14 @@ export const buildUnlockPdfFormsFormData = (
 ): FormData => objectToFormData(toApiParams(), { fileInput: file });
 
 // Static configuration object
-export const unlockPdfFormsOperationConfig = {
-  toolType: ToolType.singleFile,
+export const unlockPdfFormsOperationConfig = defineSingleFileTool({
   buildFormData: buildUnlockPdfFormsFormData,
   toApiParams,
   fromApiParams,
   operationType: "unlockPDFForms",
   endpoint: ENDPOINT,
   defaultParameters,
-} as const;
+});
 
 export const useUnlockPdfFormsOperation = () => {
   const { t } = useTranslation();
diff --git a/frontend/editor/src/prototypes/hooks/tools/pdfCommentAgent/pdfCommentAgentOperationConfig.ts b/frontend/editor/src/prototypes/hooks/tools/pdfCommentAgent/pdfCommentAgentOperationConfig.ts
index f9aec1718a..8994ee9df1 100644
--- a/frontend/editor/src/prototypes/hooks/tools/pdfCommentAgent/pdfCommentAgentOperationConfig.ts
+++ b/frontend/editor/src/prototypes/hooks/tools/pdfCommentAgent/pdfCommentAgentOperationConfig.ts
@@ -1,7 +1,6 @@
 import apiClient from "@app/services/apiClient";
 import {
-  ToolType,
-  CustomToolOperationConfig,
+  defineCustomTool,
   CustomProcessorResult,
 } from "@app/hooks/tools/shared/toolOperationTypes";
 import {
@@ -104,10 +103,10 @@ const processPdfCommentAgent = async (
   return { files: [resultFile] };
 };
 
-export const pdfCommentAgentOperationConfig = {
-  toolType: ToolType.custom,
-  operationType: "pdfCommentAgent",
-  endpoint: PDF_COMMENT_AGENT_ENDPOINT,
-  customProcessor: processPdfCommentAgent,
-  defaultParameters,
-} as const satisfies CustomToolOperationConfig<PdfCommentAgentParameters>;
+export const pdfCommentAgentOperationConfig =
+  defineCustomTool<PdfCommentAgentParameters>({
+    operationType: "pdfCommentAgent",
+    endpoint: PDF_COMMENT_AGENT_ENDPOINT,
+    customProcessor: processPdfCommentAgent,
+    defaultParameters,
+  });

From 43162c40adfc072c253c29b155935600d35369df Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:56:16 +0200
Subject: [PATCH 18/35] chore(frontend): remove unused OG images (#6826)

---
 .../og_images/auto-split-by-size-count.png      | Bin 64795 -> 0 bytes
 .../public/og_images/auto-split-pages.png       | Bin 59845 -> 0 bytes
 .../public/og_images/manage-certificates.png    | Bin 61723 -> 0 bytes
 .../public/og_images/split-by-chapters.png      | Bin 58098 -> 0 bytes
 .../public/og_images/split-by-sections.png      | Bin 61572 -> 0 bytes
 frontend/editor/public/og_images/splitPdf.png   | Bin 46238 -> 0 bytes
 frontend/editor/public/og_images/view-pdf.png   | Bin 52283 -> 0 bytes
 7 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 frontend/editor/public/og_images/auto-split-by-size-count.png
 delete mode 100644 frontend/editor/public/og_images/auto-split-pages.png
 delete mode 100644 frontend/editor/public/og_images/manage-certificates.png
 delete mode 100644 frontend/editor/public/og_images/split-by-chapters.png
 delete mode 100644 frontend/editor/public/og_images/split-by-sections.png
 delete mode 100644 frontend/editor/public/og_images/splitPdf.png
 delete mode 100644 frontend/editor/public/og_images/view-pdf.png

diff --git a/frontend/editor/public/og_images/auto-split-by-size-count.png b/frontend/editor/public/og_images/auto-split-by-size-count.png
deleted file mode 100644
index 59c7ed77cadbbe4fc6b4f91e42f4b5a6bf9a409c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 64795
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H+$3o-U3d6^w7LGp5fe
zmpSlp?`$uXtEV5TG%nGdu#L-wnT16`VME2XD|$J#8@?sHb>7+J_Ao#t!(s)8*X?ag
zk+bvWs_j%N4?X{M((n9+#=Q-H?d0#9fBgIIH@CQo=dbdcKPt3O?`m)7WcU$p+%jp&
z|2u~kFJ@toaPkZ~a7}CK@~>6vFMBdHC{9sf&B;wl(mua`?i>|{0|IP5lS+0+-97br
z(`{b|2ax>AxYf4VCa2=`85tSd0wyi_^(1AthTmx;DEI5jmt}!GIf*_XvnSQfoLPA<
zhws;476uj>C(lXmV)pIXy|J*aY#KvDgR_QbP~F$8JGv|k&KjPV?(W<vzV_OOKQ@dE
zjO_uFmQ-I~zyIDH8NPN-1`dmsNh+p!_x_}F3o{55bEtamvbW#AeeYa`h8ZBO&8@9}
z=gwteI0CXmPEYUO$4{wD42Sp@s+<(7tNN_Q$j}xrNo2#-i4)zuz3cZ@PiFwx$aUk@
zix-cdK3)9xFE}K)X6wGG`7r?^7hz`hEhY8o>4T0;3_J@}j-C<Qw&~52&(FasgAQ!^
z_%Uo+X@8#(Ljs4YC*$vrmzFO7TJ`>i1=OmoUa9af^qRy}1`9(-5WiU-^)_;G;I}GH
z27{JKOB$}KtKW7ljG6}JuJ!lb+MSfZ&3Hh-Yf{p;&u7kjPAk6fUY!BNXDUlCD=SZa
z{O64h)UH3LM58&tKHMJv{8`+VsBHouCu?SuuaB+XyVFvJPZ;9L-Q|zlAc5U=JOA_N
z>f5&=7S6c4zcjl(T^(ZHW_E7w{qNtYF?5_1@S60cpz!1Q@by9rEvX!;p4&cLzP+83
zfyt<4lFHh?9-FABUwgJs2fIsT!_|uykDoq${QZ4(kgrr)?;bh_3O!IXAK0{Uqq??s
zyj`6S*eP5QW_I^ZZF=`GkqHzNK?mw~RBW7@y7%#87LZ4lG^`EP@_+qx{ain&{53VT
zZJ+kMDH8@KD^PfDZ3QzQg{{9j&s6H^_4S+}PkS;(&!3egel#;u4eSWkoZ6~gu_DaT
z9H6wTnO2^bKHq$HbDh0oMg8V-IX~Z})$;${^X?y7a&fBT_8rqw%id1icv@^`Y&A2t
z%SvXciE6?Qj;{iaboq%Kz53ef#8zd#Z|^oRDU~MO`uwkD_w%!=igGHJb0*i=f37^8
zD$gPPly83Jyw87*oZP)`ox1or^RUossmtO${6rk86ss(&0;@8gePduzY!PtcDDRbz
zkB`eUn<>HIATz`F*ll)gKE2o(ufDFo`~TPL4iEj<tvP~66>E)oAR1oW%Tn`m5o1zd
zle;qK)O?e^Nj@si>VKbYo^=_f;@dLcd3P3Ej?@uTvtVH8KIzhKw(_7$#@TBgn+2m=
z4=^_gIB_VpybNB>HK&z<VR2mi&I-Gw(=(Rl^P2}U`g4LL1+t!>&0e)Om5G62LxkU&
zNY9I^Mg8kJmgi4pe4yyaq1YmD=*@)-?9=rO!<iU%thwvGQ<d}e=FJiea-twlDV~Yk
z@E|c(mYHEk!@6hBOpZPe;yh&XGkxya^%4vmPX5A99ExYSxvT3ws}*Z8Gz3qSZq3|T
zvQ&KTPnmz$E%%yE@|^$e8=r5~yG<W@SDPQbawRV1P?E_kE^q$U_4mGgUZwlfbt+qP
zBO^EnS9a*sRQ@(AW@BLZdwYAe-T&nbrZZ%1R{gx@J4^e-|KM*m-_9R&6M1EAJ#)&-
z7jI_C{VKj-ZfyBobc%8Mg4LG(OU)0gzApXmduQP3wzZwt*6%BNT(<e<83u4LO=$@<
zicGBdvD&&^f+3;ej%AFh1MjqR^Dh4VWx7}9zk&|;T;JxG?7x@$9`7^IoLs%&%&y}n
z9(>%Kaee}?^sO(C_o=0)l`Z@_E89Hp_PUj}{mZuswoDRo;!y0Fbo%tQb-9&aI%;(o
z8eU!1j)`q9sn;~uYw{OZR`ct7@_wEDkzqwYjxTMlJG*uDj46TYZ#MdFlHUG~L%79#
zb#~76C!(PS4GL3M2sm*}Y+dU=&w$~;1<hH%=DrRxc)Gd%O7>1~$4XX3+w=;(Joc*#
z9xLd~v%A^pe>rwnP3Z3R713+bj#hnLH2>P!C;>bBoUi`cO39Nhom#yreos!C&4N>>
z&S*YaV(Y-(&F!_C?aK}E$<NBl$~c8vczerpug9#}eTbncU=b*(WG&rfq_pVm%V0JJ
z39efT_2O3(+PuCkcxIwp!M?C;N`CAwIj@8KY>8zB3esk3lUFYJlX2oq>J;Zb8T)Rh
zkN297pHZAL@!EXT#8Xb}-PP4!i^bP(h>I`#V4=*y>Et9kKWVRmlGVvaGnwTCK}qXj
z*-V|ll{en5z4Q9{<OKm9w%q+IuF9T0%foPh|JIRWSKfE>-(6q-t?qds+rsXo7IXHt
zyX*;dj+eL74j)c1Sku|DQ0&pm8=l2l{PRl$Dz5bYX`b-n-OGi!o?d6yT9;iEQ&nc+
zaoT(|s5E4Io%f$xCw6olR=0WNCJ9bz5>KCsDo<C}7R|J~7gaxh55xUS3mQ%>a5!gc
zr&WGKH)N#-xAjXlZU#G+0$1KkwFY~0*Mi*fMbq57OM|JBP4Q%#dr{Z4dfuYw*5iKj
z5@q=K5{n!)Ec%)+G&_KErS+3dDpQNLZ`ZnfzB+zE{K<@ZFT3MuKPz{i-@k8teyNjF
zc(%5%0E0k_X|(cLH)Z7?tcqu+UC50&?z+Ih@yC;!-48f7|6H!{{K(4gTldRu)HVn>
zb|`?t&E03KkJ$Q<H$j@2uk~-=->z_B{hZssq`Q7I|Go2OZs*6()=MvbDJwBxh~a6P
zaOqu?quk>Mf-NPjXYxA>uhcQICzi!&rd~Sknf!MKujb6(wz?cIPiXh9xA^{k*RR#)
z^Y>SzZi}c`_T#Cx`M=tg|I(a=mzshz(4P~@^S6AR{%Y|n`)?<6|MK3SbdfRd=dz=0
zECFJ>@+O%wa2(qEZ`JbYb?Gec70yT+|0)VoYn}hWQDWaQKhue`7fpJ1uRg^<VnxBW
zH#aiNeSh52xYm9!V^8(_izhGdPtD+7cINNJZ!?{%EH2!7+qv?N`37Ut*}pB)@7Av~
z)-L*VnoY-|_?^;s|LCauQ^Mqar^cGZb{S{hdURLv_YZbOTb|6{ubA_;u3Wj-B7w2i
zeog;%-P|wlovts6+JEGUrTshoH4C=qZCD-i@}Jzh*hg;qm&&XEhAHb-e0ehS?e;J8
zv$qR?!uEdm+WmL$d0Bm%Df}SX<kbGA+rNq%MI9S28qM6jZ{|lw$8=+(FR`&a3=gg-
zoSAL$?(AW9P_i(2*R)M|<u5lC4(BwTt!tNkoGkwB)z>?-%HQ+cKg+c_R?Mh4^FPzw
zm-pMYZ2eK{q4E9b@^-!Lu@2k!SloNv-RJ#s{{gqj)2tty(0;1@U!lj>YkRD7u(?d$
zqM%QI9pslMlojY}Up3mBzs+<<V)mhg`9^7vWV-xsd;V3CJ@R!8C{=W<-CxnV=l>1$
z+`muRe@zWs!kIV6>D|5e#ZCnue%^^;{+=z*z;WndrA7|t_P^(}IqZK%U)|(t?%l2V
z(@llrtXTJ5c8<l5%8IjPT7+xY-OQ1js1Wnx@vU|5=E>LfKCx3u5twxL?E2;H|K9wF
z58l1M<iKqY<@d7nr*^!5cKHGyKNqO{Fz`})ZU4>Fd|%4Xzu#}9vwoeyu|(->i+$4(
z!(<Ka-V;s+HUcfrleR~<8Et%U?%}H7iPAftNKaH)^7DP!W|i3LhUmkxx3=sKT7SLY
zL!j>C+dWTgZ*H5f5g~Bv{)^2w9hW9-yO%N7BG+*KcXr1Y|C~4!^J-3hSeiV4oB6(u
z(<OPITG)3K-`U~K%6hE)y#xctA;np*zH;V%->CTM_**uuy%TwzZav#HTfQW#@W820
ztFqV~D}JB5yX0=vq%_W3>lV7dc_AO^{oJNqxaH1^Zb2TWcN5fW|Hrqs@NIkW@38uv
z>nm69&nxFWs%xw2(QkLjyayEQFRnHJb1QzU&iiswkpJ)C+op9jwUs+>rX(>aaQs}!
z%T-bOS4!F{U(QzMqr#HYx^JJk2X&PlIQ4kfX1=Bg&gIXV-bx+c-t&pyiTzTn(Q31I
z3)XaX_$`wBeuzc!?(WOCuHD=Jb^5HS`Q^P|w;W?uWq-SFp|n?SdzptmsNzm~tskhk
zUFys6yFZi?x!rzNKbyZS?GQ_fqJzMvjRjsF&rgf@Oh^-u>Q&qQbE8Sk;*h2ZdAk=L
z-4<T8%Zejik7IfH`CoIlR3GGtH9xg>VQt`T*6#W^`v<rG8Kua9a{R(0Y=5T)+U;DN
z>c}|n5BprJ%1>LB-6ym%I9kj&9^NKhT`j42Q$giToV-`u-g^mq-yA%wZc=(7jBBAF
zkJGMet!(xMr(1XqZHQO;!Sli6@-yqYwY<^7;Id!U?8W+~q?5^a&iT&!5OR5$Pv(V}
zI@gM)F**p;ecH}_va{#+&Iv^VZf@!~bJylC*U!w^b^M31kYh#b>M%i;hqF#Z+)gd|
z%)7loP3)Fl!13h@pz!D_xgfv&>+_RpS|VT09q4&^S(96khr!WfnfBgy^B>j8sK~d7
zw)<P`Fl_a+w5$CWG{@1R{3BQQQKfkbG2)W#;P}jI{+G~o)pc=zwA8JT=+ib54WOcI
z*UpDxx@EH!-n@J{_eq7=p&ya^*LB+!zf+paCmJe{*ZXi2FQjmOaY42ya*|hO?PKoq
zGELQgYuNV8G)O<#)LvS8<}(Awp-mTV?#*4h<<i`y2^!WFbIxn*(JZb%qi=WP=2hKE
z3O;vdw=1}SYL7o37VO`Yc;_4EcUB&&N~XvkEB4K+<Y92E&?=gIG9kgw>Hjm|%NGwT
zaXKlPSvLC%f3uJFFy{1CyWGL9xKy@D0MxKsC))fkVdCMF!Up;}Z;q~w=3yx3cZxm2
z_RQwie4D%#8jH_7&dx0SxaEDUR7=|CnQa%@{b!st=B|$sym{|lqrww#H6~JWK|c3y
z;0g|d7yOr|t_rmIS2CehUs_s{;hl8L{`WV}&S9}_^5{K&Kby7E<n4uz?^KJ0czesk
z*Mxu0Ike$}FWcgYiX7l5zgvAlzGrHE#V3}YNhi4uAD%sX)(r)Q1_cx8UjKi!bsnY>
z>(8E&lzy^<&GT8vy1P66?#n%P{#SzVrNiy><XSimY3S>-=QRsBop^lx#XraTEnlZU
zRX^rfZxFfk$<O7Si=TYjv^6_g&fYDGf#o3skFD+Z67}|wX7Ncv#vw*krHaiH9^d>N
zzT5a)t*Fo|1&+)Q%+3Nz96!5DS_GUl`F=I8w7Vz&F}+tOr}o#BuZ#>$8<syUef)5h
z;?)Nyzh-}{`Q|@wvEa<p8UGfip6;8=H*12J0*7FWyx3h1#Us7?KPT;dE1dP$u<}uI
zi1yT}f`Yl{=NX=7Q{cEQcPC#%{*<VZs%z+Jv5VcGrth3Fcje7y)`v?^hYPlFIQ{d|
zmsM;LX#STFw?O`1Tm6=-sjoVs?*2S3e}<Wn!>N1e&ts)oHvi(z-k$#dt@)R(LoA7j
zHx+l!3@`sV>#I@oMG2$gm3OD^n)R8(iDluIyKIUr5?|P5y$;)axL!9S@B6o9I&ZQv
z6Xlp41ZMHJ9e;kFcO~0vqsv<y|9vS+;&xIBoSa&odi0?%NcU_|SRA*@e64@g{prc(
ze+#18<k{6F9zPGCJK@6JTc;QbzAIcQFS}=3SmR+DA-&iyxW;e2YKp+LDe_MxTiCt$
zZpC`ay9<2caq7ylbNq31JBQN}WsuhvoLFL;_@}|*v_$>?U@6|eyUs8aTvo{0TmJsr
z!LEgIijzORy#KP5h3`<adr6t``#(odGl$7pm7RKb>e8uX4ySpJGj^GuFLMmJlb7b2
zo-SS+;N>WxJNa+8zJB&%g<XP97xVuf)qY~b{?~EE$FPUXkL^6h#-hO87|o`5HTLW_
z-9Nz}+yWhM&XK&s%_-CJg=N9rKMU4LZ`icq%D;z~9`D)=vSG*i1$W90&gzgzbG^K`
zeG;$JKPB0TeF9#&7vx(c_sy_*C?wp}bS^FB#qQmb443$wCLb)&DpJ<9+iN;0oj300
z^vUKAvwuyQ$aQEouW#As#S6A{ML$j`@7`1R`W$<+LB*k*%{O}#Y(C$9UzWY|Z!Y_G
zweJoy*;y8Dc-c_`3ZYYlZ-n`7%hbpJDcE`Lh+*=%=g*|RRIxRrG;jFs8-4Uo<(5hH
z0{`YMy7~IO?`wAhj+YHdAAUq``za_n*CgTTsovYU(|hNdEZ@ESc-76F+@)pJ&))rY
z=Wv?!HUIlr&iKu5Uwv(3@1Hj<JoGYi3&){;p}QR=EfQa@*FWaI#lP!VQ{cZJoyA)_
zlaB|9Nlk2ZXmb3q>!shj@Pk`=>IJUlbo+e$)gsoPBOv5GEq_CFmH)iG53ZS*-CZ7Q
zcRO|ex^B4-SJ&Oo+H%{t<e*xvP*sJ1(C5Qpm)T_{jFMmeILR&8;^DqT8I&xKs=hVm
z{(Qf^;JW$!E7PaX_ElqRaB2FG`1U4GzU116(k)Am9<Phs_j~gGi(ZB-if_Gc>P}wy
zxlU`XMb)!Au5bTM>I@dY85>;v@6rM8(p$IQ=2=cM7H`SFGi`^aR;QWt%4Igj9J%=)
zH_AT#cz2D#?f&rB=c)<>z!BN}ui%Yv*MYZ1mUU*V!N!S9n*=-*ICQ5~<%*SCYs^>J
z6IZdI<eEv|Qi-Mw+r#Z`zohHg{P=x(SH|X}hjJqJRlR1n|NeSHz<D00TWYZz<7{u-
z-jtZ#bTVa;Ldl(b98M39Hup7^DIZy2UzqpTafZr|C!8~W{r!HuPew3ZjEO~2Hh)>9
z;2kDA$B6lJr~XbA&=m+35W1ds=b2pW<Ckk%_ix#<&9M5;uDdDK`$Qa1BpOJ)d^Y2K
z`hWkgXJ^R!ecutpdx>ecV?_PaWgg7|x|4Ygq?Bau8p<lN{dJu2$k=GIdcv(ICwZ;r
zwwfu$@Gw-{{Z>D(@FpuyZ>C|Z-8p*>eHHa0b?>>_wYPI_1mw4zi8-~I?YhgcOBVx<
zU)I?-!(@7Nzrq&p+q27dd9*DtpZt6Mj)P4fj;>BS$)Z@lSkZ5Fm5)^ts1|tYU2{Rc
z#bk2|OZ|d`Ut2QQopWN?)a?F|^HBKpby>|!FPi@}fA})3!*+i0)|V;8$Jh+hFWkK9
zds(e6Zfok9BbFfwW$Y>!M85u7y=U91xP4iEC-2zjpFG95yEVSGMK5ljUE=jPmWK%!
zqD>xjU--B7X3n%aaO?&7xpz3$3%ui(_<2$|z&bxJI9Iorm%-x3m&Z*TUjDdf@-zL5
z;6BHQsG1+o4Sp?ny`)`eX7J0GFPFY-dafU5SN6&0=t5zWs1Ki}O83vV*<PD8fnTiq
zsqgRG?fvsFZe6-Q`j!sgevXWPi;upG;d1k^=eXGG;m)~S`ADz6fLQXUmW(reytM)0
z$LH`e?BdOqVO@B%NK?1<H^+R1J!J~(3yL^uk1Ty<wk}zS-Qr&F8SPaL0$moe9~Xd<
z!+8Oxs(YqUZ4$y0ExE;PcGb+Z<Y#y{Z-t!BuDb4i%T0gWf7SnBPmE2gDl1s9I(x#N
z<<=*c@Gs!Karn6Z#m&>V87pSq7I5q+nNnxv^pgKqv%oP;gG#58XRWQa`(MsE{hguW
z`d!l-8!Ga)v7A@1nJ+Sb;Uvz0=FCn0yta3JtQf3Xy&t~}&+l58_;=Qqm|cY?zO&_J
zr#lr(Y5vdY^*)!t(j@Tmh2u+(R@-l$(e*d~?dhv^;wWD=Wzk!ul!vEpZ@;;LaY0#o
z)sKl`AMUE?Da5|rxkJ_`h+)^x_Wu?AD?is|<-Zpw708=@(&B2sgOVf7eE~Nd>je&(
z$mbin3+8Rt;^D8qdgVwPBg5X@wRZ|QK6=ldV7peAXGf-h-mlENm!IoPDo#~+vR-P}
z8tI9B6Y7o#P3aQJe;Q~1K8EL4^M#e58rA8I+sUV?+1Iz(R2^aX5wT8OZi1J<Jq^8-
z1G3EpkFK~{{!C?SZoIbJU%<*%R`HVHONqPYFZ>q=E!%JZ?PW1T^FM`>jV6A=M^zW<
z<kWs@Vf+wyC8t}Yp7)iKnL#E~RMdSFlY6$s?~;x_6#jc&K<(|dNhUitu6Sd>`?KQv
zyYnJ00!53YC-zlbFm%)N4$}<Y6B@ODqUASEMICOgDFGsmTZ1Ac1uuU4qA9J!FoUNp
zdB2W$G4G}A?)O!g85}!GT&#A*TNNF*Gp%j@_u@vnVqQ&SfJxr;(*jYGP9IXvDs?Y5
zmKI`&(D`~x=UtwJ;Lnry^;FcO&ZMz1fMSO2Wyj@JU;LAwewyp$dVk~jeU9~ukKV2m
zIOMX_sVk7>s+MSK;`7(nb2Jz}{3(ikxhC_`%7d3~UXH(#{720}KuK2hc5gv@%)BKb
zZ$5rJ_v!OJ|K@*9Oj;kL%~~b}J=T4AQn;WUHWI<yU@vyMdDi8ttHV=%op4{pY+Ng<
zer-)n#j>`2l4@EEO$F^fZh7q<?n@T${kC{6i`1ui?_N)S{65;^)P9-$KF%7o#<i;U
zl}yKe{GNX)qsqF?>=rk}=8HFKKC>Nt*t>|y%2%u5i_@2)v)l77c^gk;5@;#1^z=P(
z`K`d+7kw{1?)%Jfaui;Dx#o9Y?XLIN<Xa4m-@k6Vh~pS&aN(7;_00lC1_l<z`iXsq
zmMfQ>y%yiqueCb=!hHAKzm6Q-?mMqO;gpaUDKS%azJK*70|NtxV9Os@bFTS)7w%n)
zKQ#Zi-F^OF(of$%Z2qUv^3<_0&?v^_Rh}9P`~34~O<#QV(P3a<XbSjH(&BO4qIFJR
zZISuDDVLVCKM4HsRouzqfW*!_x{Eo~`eeN$GhD=&7#a>Zc9e+3Em8h!H~q@?uiLMm
zPmlk<(Z3F4y1~u0>i!4jK0X$!rD3qI`Zxmv!;WZyM~?3OKJLHR9{tX%@%;Yv+{f=H
z`M+o%USQAh(7@+w;Lci+gRzf~Ux!qR3=9rVptNItEQ0sf;<fu9UEJ|j*y%;e);c>m
zA=d!o!bOX9SU|z?_tV+nC5tcb61*kz`^<;0Cq=U^$hQbQW39OMgmVU@x2BV3%*?>>
z;UdU9D?azCbRm(hSgq7m{oAj-|GV-0CBdpE{7xL17gn&l3Hr>p+UmG`bA-;BrJ(Q-
zc-c|X^Y->H@2`QGzx!&%Ix}DMJ8`^JsM@mJZ(f7s<>kR*M$18A?Np+CX=2>;ZU0QP
zQkSjgzxyM|q4}T7{;%wcEg!l1=h-lBUAWM9>((3(sHxUPFTz*Y_t#cE_bdZB_+5~u
zpewYO#KXWK&?2XC>0|S;ud=^=eimPlm;HStcfNqrcEiKhr7c-@>ePh9pJ!lTaOAKx
zlYJR)?6~sEp8anxTbm#F?r{Iw{eue}{)IVlEL?KtnCs#X^=G-ct1n(Sz`$_ea?=F8
z|34NOUf6rda9#e1>RJ8Uuia0tUl8wkf5P`>r$|o47NrSt6@8yRNhvJi2ol?ulas>0
z(4eqI^rgnpyeDmY(tlmr=)eD8@_csHB-IvyT|T@1b#YDDKW}oMftQ*#4}X4MRuTil
zhd`ON>o|X<rR~4<S5;1+Mak2B$zrFA^=~F``?u+DE&rd&$K4^H{2ze&9aRyt>KUt|
ztPW}H+>`V6*0kgOGdmdP&W%k!7klQ6UeEoRD?QKaYOKx5+0`F7x$ouMtJmXqX1-o~
zY*{tG-1hx%3qI^ro1A$d{qOTzYj=N_Gd16DCc)FgzWx23r*_vH`{&stH#@99s{1%I
zJK9=UjAfy~U5>}1T`5zI&TjvILw);K_Mgj?TLjcJMgQ#PyZho~<c(inG=(J{*4Iy8
zc2@rT-I{mT^Ug(bA6i|Sem2c`Gy9JJA2|1V^YP5wsiUUZ`)k6@3s>(N-$?JBYw~>g
z)aWAqDSI>PUq84it{?B;ZJ!ZS#3tP`>C@snM)O{si*XR}GUc$G*w^Xx^!IJM+S*_F
zH47*E9e$(KQPLvt?qk>|elveR_Z4AU+R94zZ0gS)VSMrCRh-zqi-pWB>u+AWckdv>
zeT6NBe{_7K*4<2cDA_V6zO^MtENFr<s28Sr$<PrrknHt-_ea(J|F`*z%lvM6;l`0T
zZ9e~h9%n13tzM-rYv28O%+KaF>%<F{*YV#o=NHu7cva~gR`>C(&Fg-7>&iAu7DtP;
zM{_zai+#`j`>ya(;hlp`1{HsFeyu6Ie}4Pzgw^Ip_f)4l2q<w(?2|WG_x^@DZ{_{l
z<&V8LHXOH8yd>!4@%(N3tOyVH9d~cf-n3!$($+@7rg<g5|EtY3*!}1NXY<7qzg}E@
zUAnw}_U0eq$6XILD)7Yb?Tx&6@n-4UwB#jLH+M;ZMqkZ2mbdGr*IxMj|I5$Q&F&?j
zVf1qbR^_iOINsl@ckyq$HT9pyO@)ATz6hW8ke%y)zWt)QExz}+bdo%aBCmXTf=)@0
z)v<4~zn84t@6+D=PeDXSR<Y&i;=hac?)lZ*<m~B==+iYkNO?ZBXn)r7ly}>ud0LmY
zzo`Gbb8=hsG2zWeFDZs3T*$sy{^CL6iFfnlxYX6z6x*%rTB9e&hrG1lSi64C!r*1s
zd@DA->uOf0`MGMQCG+BoM{3Vbko2y!Z(Ft8{KI2Eoy+mk>8y%>1uyTmy5zVbAm9h@
z{fLazCZ~mgn!o#NpA~|f7i{Ik@iL$-O0E0fgcuV(5BH9|o{!({mtK5fZ7nGvuq$B7
z@6g>*-|OGZZ7r9+e(mV~{mavKpE+~pPTOhT-8{=uxo)zy-!d>ZHrGCLa?;_Lv}ga`
zoZMbKKW&YV$jQY=p0E2GciZ}V-;$X}=FLB6`CG^H5s!BG`qyDGRY!f*ja1&(tPoC^
zd81=ek;|(`^Ilw;J7dZAZk4NokC**<_Tk3#_}b66tWD=F2>b8prS*Ex;s?{L`LAUv
zi_JPy^X=#K{O~W!CHlp8J=^BK|KGFvd(wWZ<~;mmE%#hw*TZw__g22>*G=bYEVw*P
zHtKVgXRd_8l>+9Txp6h7mm3Q1Hy#$<Du1Uc-a6k_bN!x&SF_F4?zNV_U6eY%L|5<W
zvKNoPuaqyE(mz2&VBPH<TYs-ky%QrEw=X8fDNFm0yr4ka^o5K4YZkqFqjSm5KEvzx
z8TrJ_`D)JYlV83O>^sY}|4GV=j297Q7hStwzmDeR&Sl82x>C1zi~ot(N0I>nw_{_=
ze<!DSv)SJ{A9o{Y>7Bd%C5#4pQrr7wuGc)D9`|{E`}7ZehZeoFnJc&D;_F8WF^*SW
zIx6RJ@a>-NF!}t<&tl8DI3CKZtz3Bg_Hx!1_x{?l&d+>}w|N+yB37?UoN;gV{udK(
z<Ucs3zwghk!=I1pR<7ogw)HgEP!TZWkz6`kV!8Y6{W95iW?yuWh<mPPo|YP#mR{Yb
z-^}&7{qeWVK7F;vZj)c;g!%fFc?Dd!aPh*%Ka0Aj@yq>T|G3D6Uz%HNeTn=6&fS4d
zVw-}GPM%x6qk3cD!^XJ(o;!~9YpD2SHO6nhdw<@CSgyu`S7&}YEc-2_|HbBHGJ}C}
zUZec-qFTq7JEsdN+!4LK+BD)v3yTx4-M(pO<M${zH%wTtdfHZ&WS8v6Wrg*fit6_w
z?i<+H2wbwfeAj!)_iyZ00+nKkdG~M5_~~#X?83w?=U=5ApWeoF$!@kx{JD)={3oBh
za4}`o>GQ1TjiQeAri)sI#Z;|KOx(r(wfej5y%cHX*wV|+PbMBR=rq5^Be6tRcD}ya
z$4L#+I*c1v%vZeG{7%e>^R9>A^mX|Y^0<y2DSN;A&Fur5e;+%0J93(nLWq*a&CbW_
z=Vuv|etVR<dT;86MYppjes@!q-l%!+aO{77og2FXDl48jc+{=ApJ8Gna7pRYlW&g7
zi&&jnE4M!TBrPZL<>QXMzxf5v9O;_2uiMJyQ|_H(;??^WFaB<GtM$Dy$NZ%B%kTFt
zWRY%tq#eGVpR;Aj#jfX`&Z1>PW-5gxXO2ip&Nr%hw<tNac(J|y+s&F^(*6IaO<uTo
zC2vMTV%#agbD+q2^=frEzx==DiHWz^Y}#fnu@AWX?&iG^Q8uf6GXLKc|L~1rcREsP
zbisI67w1WXB>@5I^{e;9%VcXx8ihKnDC7Hg%i~7B#Uzh6yWiIr^b1K`DeJmCiOp#)
z@3CuAr7QUPTNbRDHud_x`$7WyB5!Tq<lh|Mkd)Q<q2K=Bj>iZ4qKxw&7JYxw*zEqp
z%|To~;L1YY+1q#j{dH2d)Vxo|Jk(wO^#xH2e&&|z_sSmiJMPxoYqHWPWbTm$gS{^z
zF24B@G=KW(;)d%__U5+z^8sb4&ihQ6hm4)wosZATUKeRz_vd~+qufe)vlp!mN4;eP
zw5qlhoLsfzt8-gFzlzMwT^hF*FW^;e&CANzFh5<YVS>lR`uCfrW^YOO^riA2tI2JF
zx)%0B?epp;o`2mb<igZE<<d^ai*oBjGm<M5STeS*`SJGE<+sir=Tfp7Cw!PI7Qp)=
z{=>lsfl(L!H}^Ad_Brl5>!rR|iFNLq8&@URIP!Nr*IcUc+PXF4`2RqE`4yLnou1yj
zX}Z&r`O{}RjT7=-i}!PP7t}0##UJ^0{>hXV8AiRkH*h!@EnR=%;*O2qcD?4|zI=UZ
z;~!glF|FW>yxTPV`{$f-P<B6h-@!fq*<VLxVUf<vB{r!h8#o<9_cum4FIrsRc&6w?
z6)%6w@--_L+Zl5z%rVPuoR-)jWhrp&8t*lxJ&DZ8=k!#v@10dsJ@MwghuvDShRcZ!
z6V`-m&sLge@}%31zvbc7lP^wKXL|i!a<ba7_||jQ)_IS;wLs33w3>A;@}kzXXTphJ
z(l!~DnDFlSdhP7xWlK4^b1x_}a!t~8Pw;3Lm~ZY`^dLC4>etdTrYmig(HTq!>$P%b
z<SB?Wv(EeT^xpebF}ffAYPWyenU_D$QlQB2boRafj_YPG=WKD9J}t5PmXLtc%ZO(`
zT=~+o8aEuzej3%V+&jV8;d<7I-&zl+$JZ7At!CQqKEoz?UUa<#8;9rjz27&cKR(mg
zab#WO_MbXzhdeH9Tx9vBUGl(zMKv<<$6{{Wd1A}@=K8h^7gLNR&1Y$C-rTVF%B!;q
zGj*c3zWa82`}x_^mq{r~N7N?hGVAYrC~hin+`VO{fl~E_+n;K_Z@+VBPe$W}s?8JL
z&wp3;uyI1UQ`=hgI4LLP1?FjozMS9x!|Sy(b7Fx&&XF0K6K9`#ptyup*HpalwA$Xb
zuTP41SsvE?y5)*gO@kk6%PP@7yRJ)5je1b_L*dWtpAHg?=0?rBJEniTdF6$F=KORW
zXZOjVq;M#ZrzP7|(p<{w+WpG(UmGs4O<SlZEM)WL+0%QSOW7ChXPFecL^>?VC`#c7
z$MLnNyg&R?_nTY%OmA_|lEw)kaodZJU3<InMB{`Ni^UoWW|iAke>vWk6{IiWp>e)+
z6K~DSo1dp=@rv8?2xR5l-1d5FdG^y%mDf@ZTh=lw-oNtg^yylC`}~51v%k$0lQf?N
z%4?T@|J=E@zp1USt&f-AP9l2KksrFU%qJ{gs_#sgY5w!UWPOd)FY60-?tbF)%I1e>
z8;jG=xy!^j6xr8WmOP1=@m*e2U|rPagSl@zUS?l$SkbXmr?Tn&+@?mQ=u7UV@2z%c
z)tD4DiG5MMX<;I;>!Q=E*wo@KuT`&ZYY6aZb}78Q430aiSto2exjysAuDwurLAn1;
z^yXs%?@EsU^1c0s_lT*+qRX32pUt_Kk{P;J?d1dUXQ3|wrXQGf$=+jgiS)If3tQX&
zEoq!k<zdcgoZL8pHD!L5@Bi=iNk&BqB_Dg9{p*Y^$Y@(wS!D6Iewsw5cniBz@3FhT
z*YEp!M7}@zefD*?#t8`v1m`YHetkN{sKlgq&jN#}7UL3=5}7YA7XQA!&h!korCI)M
z&pT||Cmi&>7Nu*kDRTy#o1krH8Tp!Z@``N+i7%c>Z~r9V9$bID@&24Rk^O(aS>J3k
zN-Y%r-(fnn!(%d&la`9*@)_+Lg4mc8#s7coySs&f;hJlQ7{|`3U0)0R`Q_}Srt7~d
z>yOx#)XOL6cg3c)qi~<m?Xn|NGOGU0^-pjTzQG<}>r%q|^&qqI?Fot5%!!p@VRKF`
zy6|8T)8j4IrY~H4GUZOjBE7$Fc@7vmyPppGyCZh@;@jIK->b?gu!k8w+B<K3_=O??
zc|N&KmL{do{#eVuTEbo!lelH#BHuL@cbzvZs-B|dSmg3J%UV0jzTm97y6<fF?&9|W
zYYO!%7wQyT*ESS=$bHJYp^0Hem6Hm4%RdEm{Vm4Zj@zE9f5d*cG{aOuW$UEwhJrgY
zjgtSZejoC9+RDYJuJ?*@m}ar@T#~9XyOe%t_WxI}^W*jOE-rMpE_pg_=b9H~Tk2Qu
znLj67(_eMUa%X3Ep9|}D=qq?>y?(T*UNdE`L8@7P^yC;WSC0AbE*V!T@T}i-r87>@
zExxT!ZSu(rhC);4mdp9faL8X8f2_By@6e%S>oSQSKig*=<>nCXPJdU+&bPaoU(V{(
zlGk7RzjDt#o*AhqJY`4UxBLG;D4(2PxLlP(?G209_1qg$H>UdWsYd;L5Uf9kQ=myH
z?t5itITOpixFGIhCzQ5|HW>I^=UU^nRXa-Iigo$nhK_su{adO}wnjwto4mUzzg_Uo
z)5kju&R^Z<UC%J<>c5>y`!qRrop_b|L+In-9U+&b-_<nPS5MH2Tq6>_E3|JWe@mw0
z@w%Os$3kE}34Na8T>CKfMaGL6VI@z5dS6|7x;f&^2mJyE!Bs+Eyh9^Wrv3UpDb*`R
zJLNpvQI*!jx<o<GpEJcSC(c>^$H8HiL8%$zu_p}y%@ZCc%l+P}@ap@9Go4}_ok#L+
z?3sIXCUc9|?pB8As@p#<tc#St!#QC+=aprbroQrKwm!Z4=H`s!>)g~<8i#ED?QpTL
z>ByBAjRr!Ysp<Y^L7<Y=r>!q=g`U2;%_m8#ZGAkl_fMUYy1w=G^xxm58QJ=_N^hH>
zzpBXb`^J6y5-mEeUOJY)?=PRZ2W!d_b?fg7-g%pdx;y@8>i8m(@aAvYQt5!8SId+F
zlWZ6~zs)|$xR5Qh`|xp}wu-+RC-&?qixTGeY4IdfNOg6#MBDv-v2-bcs=d$JdF0nC
zY`$kNI&XgMH`fPZt<z6-_GSwf-u^4g(V}JcqCYME{hyhNW)(`8en0kqGF|J0&fR|w
z>}#4`nsWs?1oux$JY-;0;<J!P)>m!v!er;fI*%^nJd=_h7ViC46&E-R@>U$_ULYSR
zeyF6PG2!Zo&m|r$3Cebc#?N(^RS8_47@YU;%<iOWaoyOX(@e9?KStbtbgKTJqKrxU
zL8Ej2ov~JS7F+vvf0uip+$>pBvrDbzes**8PUCIW_ZEqk2(~07zWHFYC++UD$j@S*
zk2kz$5-JfE{T=9YLf&td{Hh-T$^Q=?J{`XHsYZJ9rT_o>_wN3Xt784Y;$Ho8Bc5+1
zD@CT>)=;+)o8lOdcO>!j$#t8jq|9{MH22Qb+sSEZX)$SYC$;XeD(<N~S@mr1#{KrS
zrHdZ#zB{-7P38N;_R+@81xoKvHw#z^m8h%=-%;rQBAe@w#S0GE-8$LJ7C(ORdOi0s
ziR=V{cbt1>6s%;E<+KuVJib!n!u{$Cf>vcWzu8+^`@gxbFOj^aPeDiGSo>G)+}ZE7
z3KU9IUU;y`hCkUAJ*`vwg@;!}#is|32PKkA*%#LQ<=k?!bjk}pke!PbWtPO2Tugs`
z#pnfxY<2B_`@ese^T~_#7%pRIIeB4YO0?IRHfc_Cp^Fo8OSf*R*>*m3ky^=--U}Pe
zIo9b<y=PnKWN_@pC&!FglT_axTa<Wa#Q_PB-7d=Wgt-H>*1q77U6>p%aV^54`qL7R
zk{&~c8BDU;fivtjE>L!KSGpy*W8>>f9Oh2PRkYSc6n_5j;myk6Cc|SP%>_S8WX}I|
z(EIyA$kBb##yR@>RxeiMUf8&!=&7uA*_@ekMSBd@_?>ERiE8brYyug!$V=puHLq2c
zT!~D?)>X$2ZQd}!P>uP}qReYrFD{0i4}B!l)Yl^2S>>yIEVTJZci)ALU(V*=vo<R$
z%k$H*IwqkoW&MN{Y0<kjjyonUP`(&-`b}Qu&kgI^IIJEWTX^jnyVlgt&(CollUU8o
zA-wdlm8-eG0LZ6XE^bWb(zATgA^mmv<6rsp(qcx(f|wtEdKs}rM-`^#YVi|6P)LZq
z-0{=hzUs;Q`uX<taR$d`FbSLrJ;y$wZGrMqfA>Xq7pnVPzu=JF?0x*<wr%R`_m<Vw
z#bsC=lTf&`{LwQ`r57F-CaQgERQmVOjkRRS#c$uFxLfm*dl(PNHa5*x?<i1y=r*hG
zklf*b<<>7wNLq5;Dtx*0{JomZ2|bKXwNhVYVjM3_T%fGEGGW%Lr);td7dMr~Rz5xb
z{hqc&azjA7nT1)DLQ~(8mcEcpXXP?21WTr9M(fmkZDeOj<`Gzxdts9SgJ6k@YRMA8
z>+2c=_T^<+SUDZ9wg3Av+TTVIWJKasjVBN1aaaZYDp~S&pZ5BLZA+E&TKWvR@7Mjx
zJSf53;x#L%@H2~`qkB_d@<R3eJ;#<Qm$dY4-GAyye%<E(H`7^@c?6c-nHO;ItguUq
zG^hEr#SV;2re(?{PkQF)9bWP8-}m<TN>_tp42fB}-(y+%x4N*%a$2oB@%5#j;|mU1
z(F+@`(;i;D9xo0`XikUq*n5Q>-IYvBWVZPH?Ooo|$0A#u^LtibUvmB)MXAgl#zTyk
zW40vi;<ap;(6K;y<-*5ow|@y436>n`-P`wh{ke0K+4(q*MSN}u*q3B0_23z&Qd8fO
z6TQ*4%eOC0y;#LzZe}j~yY~Mrr-xS-IyV`zaZFy2?0WR9u#3x%iDm6^>l61(@8Maf
zT#}P!^^N@?@6t=VkN0yQi)eGqhzweK`sl|wP0end9Sf9wpEO4_Z*p{h!6D0?7?J$&
z&B@74hSxSI^mtG1+wI(+?yJ<)H>K{XMo;hbh#i7fW*V~WVQY4zR!E2$v2nb1KAt;o
z)@=2Tjs?o1y2X_@n)@yYTJf!kseFEJZh9IxOyfLe$F@IrQc_YaSu!a(p5w^^<&q=4
z&8x$&M^u;z>!k1q@I_slZn8ilZ=Qlu&{MZtZ>)YPPY{>=TCTkI|1<OVveMS(=IRp3
zznTM<O?hc?*m1Foi`EN|+qK)z8|+(gZz(7i@-lL3S47#?zngR7mjrW*=H-oRm|9$1
zSY*FH`*WkN$kF`{hpg(YA8+#yI~`+qc<I)3?uu7RN=<z)%|%&1y#hP>l=-K_@^;_8
z?>`Sxv(RTZ)B9PXmNVC_O9q*<c!Ry+?}u(LIAq;#-<r4UTa=-_zC?1v2k%?2c2826
z;yJGmq>5cvJMb1bD7SCh4l?H9^sN^+CLdiYTcV<Ls8>4Hnsu9_`?(Vbd#&~Ne%TqF
zC)i`yst}VMIsf*8SJ!T4IdI5!b}V?j;`tIcP?5Os@jLBx6+iD)vnKnfa;SRE@4Kqu
zBVTc0Vn;_AYux_CnpJjQllp3+r+$m6e7gEOs3^YGWKe76_q6%T%{J-Ijtr&e$2q2O
zSv_)l5pn!j{kP5A=T$fv95Z1_{8e&C_*XoWdeEn%t6r`Mi|9O5bmxkb<Jyxywm;pW
zRqi1acx<)HLYw~!KzYP-!-u!a=Lz)~E>#G*f9{uziP!1p@n3C!>n7;WIl-RH{d1D<
z6Y+m5dLB*aSdlSn<4qA(*@epbR#I+1&G+B@|7LTO;k7LaGG8w-D<;kPcc5<a&jcf`
zW2$e}FIL!TxIZjeCdbm*(U#+F$y5lkZSOM6&+Yaybw5)NN@P0;sFi(Y`BwdY@%{xd
zo8$ik-mAD5pOx&LZ!~{q{$wG++%nn9HgJdsCp?^ZJx;i1<F4j{xv90Qwpx{%w(NHJ
zeYNY*C#Rxs-V6LU8*qL3zhy#4#_ac5Pt9L&$W~t5cz)aedlw78^qRW}CG!Y)EotZz
zeK}h_L#-}x{U^o$Nxxr4yt(8h@}g#smf*#E7qlhZWYk*vb_6P0eX~Bd-`d*$-F^Ka
z`Q(NGMp<>S-IYwgeUHWemN}m=InY43_0E}v=`JQy`IC6PrW(mE1o@5i_)q`z=PR4p
zUAvNb1hf`Bes>}J)BBopN8bMq6|H?Y{g8X><%xaf#R7u9?hE%YFI+5SE_6Rkm+j!z
z)<Z83w;%m<TtZ>X+oQqH55L`a-NoG5<>B#lKe$EqykD-t8qYIrfwJJmsMA_Ao;{Lm
zbFvaDY3XC$dB@k;d9%7-$C6_b3O&J2#|5uvzQ~qq`u?tL{+Z>c?R_|8J3SWlu2W`p
z`dI*SVyEeZ^ZFY;T+y6(LxQ=5>&1?H+oWC|-G8e3&*`QM28wwqivsh1Dzt#|xmM=g
zRiWE^dk#1qd-8qiq}=)&R=Tr0jrg0p?(D7)xq7nY!o-d;ws|%W7c91ObiWf3wfEP$
zxz^{;o#Q$-Lx$sNu*319w220?PfrC}FtScBI(DYV?ElXN%7VR5n<Zjr_K1VROeSjc
zvUi|DLTka}h;!%fHCK!HJv@+VdeT+-)`f{3rvd{^d{1&kvB?%Hm)yB=tLpxbA3Jwi
z2KF1Wafn_h44+{r5T^I0A>h(;<HQ#pF3i((I2JBGm)Fv_<>l@Bb&w+CLP`&#)6Z?c
z^3wWxBPY)8dF9|Z>)PQK7THd(ZMwR)cVBYIE>z~Ne{RhmzWVd?^Poc1!QxFCb4zHP
z_?mdraApJ9L%lAC=S^0Dgdo?gTi3q*u>Z%%EqR)Uqdh13fBS<Xkwq4MGP!#eC|@+Y
zADUqE;zW1fNp{)oTesWSzTKKs7iVzoiGobm(a=lQs__ag&2#jeFHFqve{p<D)){bl
zd0T&9MPn<-p<Y_Ef*74lPRs_mQ0<c=k4jVDj*Syv?s(p%J#YV0v4au{Q@j~vzrU)w
zkip8Uc2h(_<%P$p*?mqY*ku<cPrgw2J~Vu9)&1HgLx&l4OOM_XtgyOgeO}Y(WP3D+
z`J_*5x;pLB3zOTT*|_7YA21%2P`I*c?Yz|wla-{NWJoH#xWSWKk~4u#c46}7i-n(_
z+t>d-sm_|*5HQ(nXI~zFeXyX^ljy}R7dC22eT{j+Dr>2{+;aA>pXa~Z|J{<nBcPSP
zcd<B!c80-PHH+*i3zS#pr896WT>NXn;!QrAKi$4BSMkpBpoBt5wCi&JF14Zn-MwiI
zjDjU0w<6B9d$P#RzSGNkde^i5dYezLRyS=t#{97A_Ou+2%wIJ@A^#rrvu8e9{V;|1
zjCRo;w;Kk6c}tAgdyfg0wDh?i|LN|299%h@s&ibuROr9rwBzDAs+(2h<9^Iv!o$(I
zVDT$9pU=hGLJyBUTm1O{&E4GZ)wXTze_S7!JUPX$d-ra+^78WXB}}=6)=L*o<9hdQ
zigRK4>hB>d#NP$W-N?RXGDUIbNx!1{>e~BrCM;82f4AB`TY6)`TYvkjQ>QTrNiZZv
zyxei%=@HW}6XV0~&y&7iReM`q{!;S46%UuqxUk%7o{SquV_)Ys3$X<o9gg4NFFE3N
ze7_7|QethSq(vj6K-<bMCw5dS3BTgL@i%pg_5Od0w*0s-_tU4oZDzmruf4T8e0%-J
z$QSbSI&X6bGRdY+f3=~V<Is#H%1pA3$1}S&eeAcF($Z?^%8+ANc=ukdAd}NBwp9xE
zKHvDXR)_s^bAOz;S8&tU?Roch+rQhk{r=k*51vQc)%Y(k^jg2%oujeub4=g<$B&rO
z4pbQWxwBX$ZGC03y*fK7sW>;cr;3qTLFDAJWVzMnr!+<DzY0w`yT4FywPXDG<ym@j
z_8))zF1G96&5O6Z`nU7TX~@{O-IrX--mBE&a9lM{{ImX&2W~7@$4q3?D{SWKtXa)$
zV2~u=vgw6~T=MBwOU~mbS8#poJooB}``do2|0}d6vK=zEjQp<YvH0=5!w1htzc+dF
z_v>@^HNEGW-2|Nq9v7`olBrvu?DYS9iI11ZjhWM~#l-WcCAjc%On&?A__QM@mnFBk
z^KtC7xw`kx>sNNc8aF~?b~>{^<(1b-(U_#?{LgFlz1r7}4Axdhcodr_Oz)p}?o;cJ
z+^6@PIt7?yi$k^-o@?ymcvx|D$voTd`Y|_d-QmeeIKshU`LZPDO_?W4B46``B}_pR
zYF+zxI<v2<{<?JU{y!y2Hz#S&Hovs$^z7f?Vs7tydui9!<6^omYz`Ek@i^#uvfH)#
zX!v|<_y5z6u%9$wJu0FoxN-5?uQ84BFAR5VN|86|5?~TZKXTMpSaN~X9S$p{3x+$x
z*Z=Jn+j^9T+mONOWyzfN7OG7Kr&n)ys^b}Yq<Ginhlfrn-I{bgCiwETD@Q)(ByHKg
z<wA0D>eG)$xw+MQrrL#8Jet4MinmKK?*8x7{Y#Dq>`Pe|Zp0zz)N#&CSjt511<01d
zZw-v>#zsHv4<#lrv?yLQys9bOVz)kNE8BG&>!-)o&HZlDY;vPAN&Wi8gR2dXGR`YM
z<@NpVH}3y=7QPxByB>ZGm(tdLvD=XKXQ0i)_ctQ~15GkxR&1UqcM=r;0lQ8gJix7V
zK`_r{LGr5wj_yUp*0*jS<mYKH_!0ExTTP`x%sGWEYn(6t&l9+AR#H+@_Pvqer|aCU
zEZpaxK41Gn)PMejpHpuC$hs=<c(UuuYmOVk4IX@7vhn@*_%lCVt27HJwuot+6WGgc
z)zrsP;v;P{BjUt=O+IF31)gOwS9M=62<(2w_VeS5KRfqKXh^$#qj8tEOhwX$*L=2h
zQB^xE$_xJc3D5dvyZgSa$8YJc@taP6QCM4R>fF4e(y5MPVXEA8&1ucjj_xex=cH|a
zMFa{)bTA6AP4*Y!_*=86$8_qF<!le`-{n(ue*56-%qYW4+F#Dk>K6ZVn0>OY<jiYN
zyT5;MbGOoUJD|USZT0!NXQj;|7$$XJnyoJ2q;Y!n3=h)_f+a2)|88tdH_LhO|4oZx
zF+<B1zRj~IDX&Q_%A5DVdxg$SxjVlu{!W^?;zC0DtcyY6(bZ3j?rvQjRbF^&<)PQs
z+kUt6ZVPGNqc!zOWbL;e3u8B)wP`Oc=G?tsugsv?1-7c=n&ymi1{Va=pD1i8xMQ&)
z;2#4AuloExZdF;6S>o?Ea)fUUUvD?#d$mPGd2VlS$!!*2xxBjPzDaTSCNO5to4f1p
z=6?S)o$T6*t1D+XiCive51zE;))tLjznV-}6fgMp`~Ho++DFzeyuV4~_cP8G0k17b
zeYZD6EKq*YabZ*XJj?yL(kV@XKNY6<AFo^|!Kj%3P1|pl=Nh4P!qptod3S%6hZQ~i
zadDqqR(P<euY`B?=NGwAo}c7jdL7t$-v02dEgl<I&!6dYTeehMwzS*zCGYBGen!`q
zM&3Ix`S4E;MUizuvSmyQKQ2?e@X@nL`l9`L+w#i)bw5~?Cpl`&@7p|=&$F7tcA37I
z>YGp*Yb^oQXLnw$i;w<&X!9-e;1)w8727Ux{<Cw`(w?wzSVu+s>z?26C9fy?_qVS7
ze&st>R7^C<w)3)Gcfp^{iDO~Ftmj2i*A-rL^!6=K=33YDeE$Bb7Xnk77zNn8UY!+Q
z=D+n~>Dx6LhTD(bX1%`m%bst!yKc1aG4EHCI6BX^Dy9GG{T+_>n=-Cy=z6}j(mvrY
z(XuCE%Kn`%;}vrLuRhN&;>4j_X3U|>U&12m=sxA^t?cc6^6jAp42Kw=dRS$cT)tAx
zQOkLcTbujnEdPhvyXu?N`FH;>ooD>yr`5cuD_pt9r_cXcVRbR&;JW&+s`vJt_`tp5
zVB78OnXao{WzIhSAM3$Y;=-Z(T`TdK{2dOfq{Ye+5mm3Q*z)i+1Vk?jKj*mEZgR`v
zAT0^wO)EDAS#&M`@gk{e(E`U4AN5>r8Qus9RSh||$7b^6sm2TXBefp$pOn3_{?QLZ
z!^t;GnH8_zyR+r}_IMTrU;k^mQx+&Yb({{n`*4};3l6KMJ`Fv+?{~|+&(CR$UL(cu
zP-nMog670qL7wLRDV1kg9-cb+xRsgpiC=13M{m<H^RKb@cRE*lE80$zvx>0Dn-Xd8
z_~wbn-QrpM4fx;g75@@{eS7}m@6qAgLIe)=awzU<^5DDe;C?}Hb?C&iVINMahfddb
z)}O}HaG~PUOO5x>I&(q|Kh^~9a%kGd{c4@eolpO)72myn{Brkyy||d~kBXNyOt`u8
z+tKvW<Ht&3b-XS&m*}ioY95!evMXk7V;{#tk=?%2j)TlEajCzZ(>lK<$ang*#1qmC
z3u~;-O)a^QvF??bU`vTx#_PFkW}?ljR_?0$tF6zraK~Eted=3|$(Jr)Q*xU9{ipk>
zr%o<<s_OnF{CT!qWz?j9){o4ir=Nd4Dcj(JpyHHwC1*Oit8)w#UvwB3Ik>-`^{imc
zuV1fcy}rKm0V6Xg``qNSR5)YI*|KKMqa%{LGWVVeRuA`+5oh5D_nqhP{huMn&&yHL
zQf2kuOJ68_*%+Jdll<wW>583Ni?{r^&=vRb(dlTBe0f))mmLC84~$rx&RJO<>g5RT
zTkyDKdGTL=`>WHZdOl}ibI?$%|8n2Pv3)&<fYG|FbMrs*%geN^EMohj%J}NsRK=q|
zh4w6Lm|*JRwsdh`N&3l-gZh{5@B8;uyv1HuH-6Q0ffpSYg0^e3{A=u6p!|ZvD(di|
zPem)(lvxC<WbTU0RG6}Ldd|*DbN`(Ge}r{8Do<uy{9)+N<`kMJa4D7lPaspK>dTcn
zyA*;&>z)W_AK^(n;LVXKyqICh)t{j=xtt1=o$NwqCT{MWkyQjLnnAIiUS%`;->=n;
zejAP-;E-)$o8*7|>AZ}6l}@26OwZfi{Td@?m3i!k=Heu`yvNb&FE4Yv+o`Wwe97tm
zD)&oiuk&O@oO5dTY|K`VoqDk0O8ac}fHM~b7sgyYD`Fz_LgE}a=6$|YZC6(_yME1X
zCYu3+)2&I%v!^vaxm4JBTXe6v|Ax6?U;I|=uXNsi?(-9S@6ErzKl?86f5qXGomNXO
zT1>L)zAx~_{LYVKtCLh$^))@>k)Cz+$<alL%!y`vQmnFqlVTSYvNVB;l-<&f$6Z3-
zrX<$Zey}^hz|pIAzBjP;bIS(dvuj_z<6mP{oAuRr@=x1iiJt7cI;Jk-aayES?^iJU
zSB=YkJKMZ>x0USz*qsWe@%SoU`h7T3?A%nxO)onx<h0+_c<bP<(g})@8J9LcU$@1i
z8&sE_TAsY?a^!>uqONz(3dfwh^Tqw_8%aaO^*VPyKmLBJx8u)^py=IS7k{5w_Ncfg
zdqVzEjxDhP85^d`<;&i9@BN`GUua&<rgRR$7abRDj#^$$<DSEpQ?NM1>QL_j<vSLu
zAq^N)^XLW+o`wJ|*_XLLKgwNO@X=}c;&{`~ccz?uzxQmoU{-(5&-a%OTR+{san7m_
zSL9`#f~%i)<;nHWH@_ZoIa0qwlqEm1Mv3>*-%q|%r#|ZLR1Dkx>Exo4=)FIt8mLLO
zaFn=YY`lH+o3YRfjk~=Il$m7HzrWL+-73MbkoD<G$3_Dat7o&j<aebsh4&h5{K4he
z^=`g~gl*IP#mNi(%EPzkT=M4+k~$H4bHlvreNr=uo|u0)o+sArBwzaX!A924FXq}f
zOFVm0#h|!DFtx&oVWA4RvB4sHnVnDP+=&OLR~s56F}6gmn*CJlnUQsPuhy-mU|#S1
z)9mlNxSv`wDV~4-_Rp{GHTP^wxLsT;o!MjW?^`=NbnYKZlPtZs2TvEXT`zn0`)j(|
z(r?M7-qG59vR7Z4%z657K_H8j(#q7;d5ghqkPCu&JsY0!$;C{Xef!{Kb_t0<-b3{^
zT_OVa_E##sh}rccW9GMMV%HYr*+1O6HoBwrW^MH+>teQVi%l2JzF+zI#v;}uHg)Q%
zH<n31TE4~L>w)?Ev-4L~gnW5uVyLmNnQ!Kwr0U|!ZP(+>OrCbkRu|}UwNm;&xk;b|
zR27M2>c|+iMEpqj$H1)MQ)=O|dGYe2d6o)i9!WYGpX&L3>G7-dWg&Czbj51Awk}Ru
zwEoeNLZ`=5d!^Uq-j9kaYFRI{MDgBX<qyTY`u@MCm8Uy}F8q1e^t@l@%GHl0oj!K|
zIeKKx<CCf0Di#Kl^5!{kl(=Y?O$!xizq)FH@*NH<JsIn7M@~&mP-JWV&^cRo_s=eG
zE{@H<jEdhsEPk=%!m%!{yNY^eobK)wNqUhca<usFoO$nfQ`@^U%aso5Kgja0J8GYF
zVr^}8rqqOc`gMUB8$KQRIES(J$n2$4RIA$r6fX##EwxHITn#R+n)<qr^;&OEY%a@U
zWL7YlRAaTwQZ~q8#%;^J%Vy*qx_iI&@RP^VvRh8uMW%iUjymJn&$9U)>x#<@BHo@{
zw3yT3llt8_i30D16;E#*`g!*MUv-}on_F{xdtb-bdM;wy=_6y(H6h1*QLCPMtpECK
zH741IZWj!*Uhb$k)Z!<W#L%Ls(%4tGuTp8x)4TD{Gk0;;e!Q0}U+<BA^25h@XEv-`
zcX^V(gg?*6XvW$Vwf|?%dGqF<$wl|mE?@VFs@?hb(w%pE{^vUi$y-%yr`D@jFa3N;
zutng7#`@GeapemY6aC#U2$rzO1|BOuKllDVSqCPL#R_bReOinyQ+6smsrf#4XV$Bf
zeH~6~1XGW8Rys|r;FtXLrRz-d<$upymnWI&FW@}t|1;`mQ=syVmY$%AKOV0-DXiTm
z|M>g#=~F&*ADSTKt0CUPp?Klq^U$8p{3Shl=1qMZI%jGgwytL9Yw%=96nXMltCjO!
z-lkX2I5(S~_$d@pcjxnEepB&t+f7aHR^QpNGyi>`zWwv~<wxgCRrll2ushY#<5Q@7
z^w{>ebVjacFC#qMXV25uS->Cj|CIM5g*oc{pngVDSD)po<6i8i%0V@b(gnlcU$5uO
z+Vkl!wg}!e;%_$ik|Jxe%D+H+wf}kF{QZ>+S8RCm;o+~>*Jl=#ShL#d|Nj2r=+)I-
z!s!=2F4+~YFJu2KX5ajKC#wZ}=h)qfhzy)#5$yAq^^e^e->P#iTZ|e66h&l9bUZ$&
z-F*8=lfx=$tJVt+^QiNOg60(+=tvY;W+@YrC9=(<(D3=8=~ES+u<T;FbZzgCKgZ1D
z<G)|x-qLW{J}IMY|GhURey>fcoF?7*|9kyfUfw<86W=a3Uij@(RoxP9{_bP_Z~y)N
zFquP>+uUD4#rlHb)rTDR&mG)38~X~BUu10ldB1x7n=_IJG><uE?77mBIq&pI5ANcf
ztJE*Aw%K+e)kDg}&%LhoyVAPak2_agUM^A1*spkX<^;F9U$bx9|908;x5rh@+-kA(
z`;AI10(UIVt2#*hhSu4B+i!Q<{oV5FlIjOeg&qZ~OYwmU%q^84d7LgAop7r2E9Eyc
zOFY-GZ@T%K>+|e>t$4clkwD<BtsdHerQNQ|n|;_8Zgg<hcH+<to8xIFJzZiZ*xZga
ziHTpYu67V{kkBkqncXVi^7H%osS_^<&+~VdjW$@nbzj_u0E+;dGTY3yb2_O_pOTj}
z1)NMj>Zy6JS-?qB&b8q}MdwBN7aZnIeG4A*EH6H5e*a3$ZZ<E*mQOEdtlg!Wqx?kj
z5Qm@j(e01B&u6WV5u4n|XzG#igtz_Chf7Ttl}pvnx<vh}cs6s+1GkodY33XPO`xEZ
z;7)&{aPSbX{r{NwFtz~37NgTon%xf1>whWwaAjUykVVy#wYAl|?|C?yhKA<;|B`IA
zy6xSrjQqT1;XinNr%v6y@9(Yak5_h>D*EzyACY^}A@J#Vb<b-)aM^jmFwDDTXGbgV
z)2A1Clo~F)tO=ROe<(F?x`;s9#;uFGT9+G5%iJ#VDd%D9p(asIt^MtJI~SbRdQsYV
zY_sLfN@uoD?JiOr#TC*E_c*w>1a#filW!>irSh%^Zk4LlHqrlntzNi@X-Ai(fRsNM
zN9rA$gQ=T0Ejrs`ZTEl6uQQo;Ra35a$a&6nwSQ_p=j>Ur-#kaB9lCV*sJ43F<yyb*
zy8PZZS3Qw*g0w&{<hHbJy6ND4!SETgtmE;N_2uqCLB+YbQz|(We9EnO#TrZIyq;40
z*@Z7(xo2LDf8~#pCsVyoR42XF$ko5|<yiKYU#C7MXRnWW_|y5Vi_(3MjZgQMe^KMH
zHO`;sut3>KC~Cou8`W*hvdQ+K4rxQ5=BisK5ACvY&}MU#m|1eBe|q6(my)J}uUAek
zv2L{e7Wen;?4?KBXJuzabpBanp!j>k%3Z$-E}dbQ7k%H`vN^PtLGeY$gg4WwrU<-Y
zw>nk?F2T>eyIJgCRmCk|F8`ZZVT#xBn9yTqg#%fg=3P7eYHGpn2aIoJ6lMq5@c-C#
zBlkwx^K)0v&i=&qRa|Y#oK-9q3}!uwI|LW{te=##U79<OMfRZ^=fU1fFK66ZeZA4O
zJ8JgqM!kj$PF86rcT_fYSqaF^oqg_raHst%(-Y2n9F0S76#V{n?fd<!b!(1%a^BIp
ziJ`HNqcx`Ql^LHCxa@U2{y*Ak+1GczIyubTj85IBCX{||k@8iD`F?2gTV35>uU~$>
zcX|K1+H=n@e6auT>v?IN%haj%ECQhRq0=%Eraunu-A&T}kKe1@;aa&i_W$qxdo5CL
z_8wh#QDvKo)a7nn*I?6+E|=eI3^y=wTy=?s`&-+kjR7v1m)2(dxmNi6?)%4k+dno+
z&XA1x9VIS4^XBIH>Bp4Y=YOwV?^>c_Ri$a3Cu8&^CS%2~-YMM<FZ|x}d`SP)BK-I7
zmc5r9H)~8g8tYcC{H^1CX<cn$NXnCjee-lh-82=x%<1TJaqo)y|H=E?&$q6R+!iTc
zoTy}Fb?sT=;i5&0<Q`x5(_>n=d&|_5!f&}Hn}1aOn*NmQ^Of+)Y_m_F?yK4OAu4Fm
z0=vnaYZ)pZzqoj0<@(AEArgXb5*1X;g=96eCf`3Td(;?Y<_nLD%ITj!JUrl(8glSy
zrGiV*;o_%f9bT+_!Z~Gm%_1`i^E#e6uBIm}Q*5p>NtsqKIBCu?R!phguyf6u8<W=C
zKDAqQ%-vRFk@C)oi?;nP7vkvblPOtpqF2W<Pu^Tl-|n9Ih6xTUo@{;bV&ap|+6VIS
z9E<gREmts}f7p?5^r6n{f0OO?t1Fg&ed#SXYxdfL73%!l|M<G4Y&QIU-6HY$i_Qi?
zS<OYtTde~mdxKou7b#!dI9bW+orL{94OQ2_hfY3y>+oXh3yG6YI?GDZo_77;bo=q~
zw8VgRfn)yj7BmD1$DW$AUE0e_#LY@x^T_5`@};Zv=eYmQ*xoNv#wj2KHhO>ghO=`s
zLL>g#|9|XbHlb6=YLawkpUd&NlhuCei3xGo_V-oKw0XF~rXt~53CpS3i<_%N1opJ=
zsN5RgBYVi;Sya&@=c%e%Mp`^-A!k>VuUc(n|J%iAp}4yLj76YG)T(os?`(W;%YJ(+
z3xN~Q#RO$7UwD+LSP97<Ugp1l(o|O`Wr4B){j^Uk9o{E@&7b!2U`Ji;DPw-kgv%Do
z_pjo+6usR4_4L_?+b_Hn{hzrva^*q)1q%*;sLEDyHBWeGcYRl@CMY7kWXxWi`F>xl
z{oTIOHy+upt-n@IGyKc@TYU}V>7D-Ipqu!@BkzuNaoWw5!B0$>64|#LzTbaRSn6;{
z=lds{<k#Lvv+CY<ckk+1HfImozi!ste1Da`&X4a)j`z(F*kqu%DfQH)%Zu80-pHx-
zq_kczohW^>_sYfod;gEW2(a3ivG1?&hkEC{=e9-4yF)wsp13Va{&8leX!^Mc*Em|X
zZMphBm0#7LrOf!vOuu<6o*lfPns?~N3CF)*n|~kg+gJX3o14W%$MyRxx4+_lerB2c
zee<Lny^GyVgdaU^;ymi1*s%HOvED0|?>jD~hHG5fnwQx1!b4E@@-n}?6X)wcz1g+r
zng8$2t<isXb8&R`K|I?v%X+((`Sdex3N`ya)St99t#nEVt(ZSy%lCVGchtpZW_iWF
zOWjg(FFz+oYj51dsWatwS^qu!edF_}qDiY*vMPj2_q-~8p7V@-74Ly_cjn%{o$M6Y
zb)>X(R%?QHzW2NZ9epAfKR&n-zPc~nzOpQ~^T%(=j5$UhZ!DLWm9Rebkkgv^&#qb5
zKq;VXwUBIQ>(xi{?{{#tIQ_O^Z27(GZiYzjf>OW#y-)IDb6=mG&GpA8=kVgJOZqQ+
zHOnS3vznxx`~4-)xA%~@%+m{*Zbu~Idi%Ry+;>k>Y@DEEB_zAot<#x3?zXsY-88dl
zBG3P9+w{kw$l1|O>dn>W=XFu9KD1nL_^)@|0F*R9LG}N6eUkmZ9m_UM_~WKfvSi*2
z8%2dz9}fNe(7<@Qb4G=SdDgb+3i>DB9@=Hv#P-%W@y&~g8m?Uvo!b43f7KP-W>52b
zz3M|1lOm{4+qLYA`7(w-^KL}^oNa!n`HGFAk_E#)BR*F(6{}0i?Jqn^O4k3Yc)7Ht
zmHV}~w`U=X)5;ABpx7_}c_*P_|Go6O=*~-X*mOhZ7SAxsw_Cbjt8Vq#lQ+$iG%QX{
z-FEf#?QI#`gW8uZo-kG7;>E68%QhI4PPe+Q>l66IZPDXa(f^efuBiM=JbhBjx5Hb?
z@Q982vy~TD)C$T%WB#IU#EpQkZ!O&pE4Er+*#BIzw~4LM|9SZOqKJ-Q#)bwxkH5=L
zHa^nUak%{KT%q^TPe1za+h^oW^Ldf6B;e)6ztyaX3+unv9ewK~;cb!WE^=|Al|>?t
zkBj1QhadCj%bS?lZQT2+Sbw>X%<B&;zUtphw_l{Z^P+9icCCvO@BCOk|Ng<F-O`~+
z0^*GY)eip5PFG`RZcUi??);S#&r>*cu7oUG#;(66_U$pfYhS)UH=8nLMRoI<J-6a2
zYOl_`{Bg4Sj)|O{Eg}~u3f;Q@eClKFXH!*G@2p)JX5Zvc`?YeXc=$gd`xWy`)4%QU
zf1mIoN`LX|xb^M2XMMxhEl3qv*vi*faQU=8<JDd9Puw7JUlQ~5{rqhuncTBp?y%x-
zsjK6A8tt&-=y~J7mKm{c7TsEKsybukiVJlMlZxIK-adRSdV8L@$d$NLjhB6D0~J>l
z9OAg*)jak1=C2Rm?Q(t+ec+;qtJBOF{+TOoeG9mGFXin2J)g~tS)96*K7Hj4yt@A}
zx843dd8Ls_HQtqxg*WE4EM#8z$aZ%_<+Y7jd)FO(=UrFYVyFIjZlrJc`WNX(y`#Lm
z&+EstZ9CFB@AleVwg=9?b#VumjyKnOm5OjjXJ=a<c4j%`TUW=o_2Pu-ix;~eP*|lM
z?Y92N+i=^NN+ypU&JAN>o)`5`IOy^Be(AN7UMRDFvHf)P&};Tdt}6pJN2Y!=EVta<
zQS7JtU-E%gKtSDMg>Mg?kFH)3T6U{;ii1a>%kk9{ANtRWo!V}6;e6!8S&ue6YG1mK
zQTUZ}f;zK#pv|3t2!<sh`m0XarTwofV`p7c`EqI5RoxhnGa*%l>A{2Tbw8i_#mY*a
zw{^%kb^4;A)s5|w)m=Wmy`U~{8|Zx@Av^oqcJDKCerpeRi<yK^;Z{46ZRijowAp{|
z`+L!?eCK8b7Jpo{BGD=*?rNt<YUav~$#GYoUr3#@sH5-q@0Jz$e0|crb>~iJhfQ5B
zv*OGdi$C{dHVU^MR6oD&_Ri@CTb}KA?yQ&E9bKxOeeU+IOEXNeX8e-lUD~Ah{_3>_
zzpp%-+s>}7P!j6mejSv7g=AN5J$TSPeC;m&?cD3~n4NaNO3M4<p%UA(YSPZ=hqcvH
z)8#Jd`s{l9*|GTY!R_gsB3JHbuj!Jsl)3o1>nzI>)xDNiWB1N_wCkcX`_$AW)|~6b
znR_G7rlziZf9~3IgZ2qk4_)%!$m+;3{@!Yr&3~cn`?;C#r*-7McydMhh`(i^l!#A<
z{Hp8UTxXUSRh_(Ub=`ga7xU#eYLo*HHfG0Hozx27FacC(b@r|6ez8MO<;nht8<!q2
z9#9gf;*u5QeKYZXuhVXYN~OwM(z`Y+Yh~}#`^VKgYl3jiq0L;HuZ#2_t3GO(<6FP*
z=#^L>4LvTSGq<-s-s!WVds>!|knD06r&mV>FMd2QW8!hU-xm3gt3;ljN#C4yJ}AvV
z%z65>)7jzOxtf!Yaelgd|K8el`=n$mvrdK|e_r1<>*3<x-{;%xz98H6EU5Bs`Tfkb
zdlbv&{VAIG_e*!_g9Cn@cRWf|%!@8ed~u`n)`j)=Kk`b;ZQ1sVZ>}Imti$oSjq?(l
z_r^MerPu!ttv;!-Bgl4|gvb%L*=`G7$nFgeUHZ%9t76AgcfN&9+x1Reu>bXSddIh*
z>#aWD11~GEYql!f@H0qEIo>#7(TXiAC;QcI)hNIFYSISVqYHO`HvilD>&C~*`OEy~
zT__c|-T2`1v`v@Td3k@SAKW`DOIUWYd;bBK`^NSLw{FQ?`||FwM)E>U+volF*R&r0
z)O_-hyMVyQ7sus0E?-*ax9<FT;pGbruhwlXUVQ)bH^m7rJn}%TmCnAqD|`R`ntN~C
z+PDAy&T}hbaZ*(AKk}8UNaw!iyns1u%o4__a)$g}yL054ydGR_sfbkx`EoTNW{%0*
zQr~%b=}sPB*M!MgcX@ZI@O++Kzt%lFn}46_X5sLjG%Z`#o0kt7DqpPNboL9Fxj<Q9
z`mcRo-H!g8KfUbe)yKbD9z0P$zi!*LYs`z?XUxuDvYhkq`B|5jPjcrKei1Rf_~M`G
z%U=IZPSt<0z5Bi7J0|hENWE=|S%P{-NwclaF5C9&_f2<eaA|nsFQ|EE&L?r<@Wu%a
zJ8s_RfAD;l)f}6L*D7tkZvFO2b@Qh7H+HifR(wBD=Qg8{Y43zz7fc;A+$HsM?=8u7
zy`Ai2>)){`LtRf?_|yJ+0TI`)d}Tj8E?sbZULO@Twf0L~t}a)`|A^D6Zg=<ny5jje
z+{Pg5$Hec?7VPS%N`AH`vqEKG{rhib^0O>?!^NlDe!KYlS+4loTOVKCvwgj7nYOCr
z<z-#DOF#ZT`@Qhl@BAy$+ta)sJWYze_--!K^GR-eru=Ixi*MNpyyFURcyaa70_BSn
zUz~7sU-Wod;^A}cZHIC{a!zMEbhfU}Y2WFV1I)i4Jl8Af;Vavmsm{hBy*^fWVZ`+9
zdGB22r{6hJcw)r`hYsdIUW?zy^JCdt4w-(r@o4>pYfGEIstQN#JI{ajFr!n~ru94a
zDgKycS89~-=G6Vf<@^2}DoiYRqhWAw^0(<fv~NblJo&SzecArP!l(6GL44b$O@AG3
zo0GS%__Z2W;Z=422Yy0qUyb9r^{(n)<aVEFt-mhf-nTa!*!kG4x^h1#h%Qg8x^QQj
zRi+GA&!IXtR}aJ2680PPqtcHaZ+ch$+d)F=$$M=XNNX9?CSQBFJ-(}}O2;{yv*p{<
zwJ$j4n-@fxbDtEhZglXwx{yop605w4`RhZojKq&liG8l|uFP@Yyr;n}ksHi;BpbSJ
z?rP)=e!i#qLe29|kpow}qs>ZR@D?>pSfr=(-}Ar5exZ-scRn<zn_*%$>q@%b+dWN6
z^RmvFOf}f>e&<sA1sUHyRQBbD9^V|S-fQlEAp7XKNgD!+Z+EtSzLNX8bpJoIU$JKw
zx)e&a3Gtt=jLz|vF<PLb7#GoRCMG`nI%^cSz|mb_p1*$;S@AHX{@=-^SL+ilT~ZWq
zvoV!gdZO3G9n@~F<&fRpE5oTX#qKJL)ALV7B|PuT6hca!6z1<{Ip;aUi1YvME2*|M
z{KjAWzE|F}D2gba&U8rock*I3{wsfO@^;O)c^Flsq^Emo-VRmX)iV^|ywE)=z_~&^
zdguSyN7<K)UDe7Iz3}4P+1W}Zj=#&UJ%2jw*zu?NcM9r$8u46Nc&qLIo=O$&6ph;!
zSHGW{d$e+9;LDd;C(fUq@om?|Cz9%ypBVGce6Rg^tz`M?RV^1Y-rc&o>5F;c8Vg?A
zSL*vC669uVuUo4Wce?Rx=6YX|+XaUuHi)zazi~OPX_xr=Ph$1PEe2ApK5pP%(IVxG
z7iVwH{`2F{kBZ+B9tvNwN_cp=UeqbHB$&K%Q@dkcB2f1`aDUXxRZ`0s4V`~{*KU+u
zYjtRL$p1v`FT18q(U`2hYhOsmtS2j<+Amz}vsXD`VU|+p`*nKy;)ZSC-nai<Br?@v
zM}20@oBdz+R)2SK<@24rHT}GWPul)U3-0FnwC^h~ZS=Qmx!AqHvBtH3sp-x0F=>~0
zl;pph^xCC<xw2g=Z^6O?22#D9X65(RuNP-$niP0a<o3Cm-9P@lwF*=@^Y2aaMqcI#
zAEr+9J8?|w#wO3V=35yZGQd5pofBWY$W^j>H_u|Dg{rIB6#<T=d*o!xwH9B@3*Rxj
zA)r|`jpOM49q}>y#T-_AyJ4@j=essXxA^{RG4>PQ#68*k-fou7-?OWV)7S2waxitv
z*R<4Izu%XAIaB*Zd}&<8)!01?KJut7y0%<z?XSa29RJ8TtmV<2Qf8Cs((2nX>s3?z
z=dG)^7waXpT}W}_d7zkiA<Klzz_{0KavQ(d`iPkm^Q3wY9X|Gl<wzsP3J)2pfE?$u
z!R>dg^}oc%{e50+opYLB<@H~u4`!SFn;~7P7cW|stlIYfe0Ft>4%0&Z?A`m*8w?KJ
zb*T7U@$LWD%2k`<lAK)j->cwqb^7hD>ND#?NYtwOz~Eg%+wUtzw3TiQ*{{7T^r2nX
z%0t_#zY9$62n#xrQ1W9%Lj55I*M)n&t>=7xb@eL7AaVYwwcQW4PujcC%wO!?f*0FG
zmfO~SP<Z}*Dkt-ATh+bcetNU|e>!YE9@WaMXIFfs$9(GN4W%oKmR`7eq9BBocX8m&
z=2h8Cs_t49SyUbo_^jKJ<Gkk4-Q8ziKT6Kg(JHyayLxT*s=Swfoo+M7usbbMwk-m6
z&(3$tSw1vQn=;qNQ{hYK+wUv_Zmlf4#5uZ^4qcV+XFGKJXJu!w+C$ANoNwi)nw9sh
zI{Z@7sp3ss%yzdqmkoEGX$iRV!%#ve#8Ik8e#r_yjnqF97K>NR7dF2XEIM2B;I7L$
z#S3S&NhPT7@o}vT_#0uh{f&F6tL~Mj1`X+EQ<4-u%(Q))dQQ9amD>82_oBC3F0Rmc
z@v`;ii7ADPpQf88^1ShPZPxCZkTkm~`bqSHL{WR)+wblPGI#l^9<2y{x6AbH((E^U
zU$*<_!CL&4mR4?O=0w*0`ohiF68-1T7PH^`lALTFXbUfHxKL}g@eBLi;FS#m`xZYB
z|C_kqiQ`(+x+BM4)CK-MyRhG$MNcc~O_pVjylFd+wTW$qb-yZqfc~CM_P<?Bvyx)_
zdn=di5ffEx`};t4*8al1$JX+3eluXwzgRcZBxi$X;q-q$-Z~~X8>Aj=zBbp2@z73t
zEun{3InVXF^`HNL=84-CMc>7N57V0`JC;9NzR-J(hSsw`|FSRk<w|(j?0vGj$9(yX
zpKHFcu{Lb2n$*$vCQKDP8uR<vxwX4$c0OlbSX*gt<@RgeMU9rE2aA7yFIm0(Q+(z+
z4R+pJiHAPK9sD6>p0}l_{do4*aGR#XrJNUo4_!TKTTnG&k;3mYY}UTK)epq}{%8z$
zKj3$4gJ`bUjFk8^U;cl34r;~e&(^$5W3hR0W#>hWtnx=DB40w@v=~US&Yro{ek1Sv
zV<+{+t%_1&l@Gn!=yT?^hB3D*TeY%)kSuttL;0zg&YE+ll?9ya8u}hOGVXh+t(^Gs
z*h8JC$5z&@K5Tx9-|c<o`>kB!Ulo)r0_HC;Qh&l}r^;a8xbXE6H6NGT3n#HHKl`I@
z@2;P(J~IDmc$$;M$rDw=p=c!?cxY2p>Z&cAfh&c3r<k>RDQLC)5-{w}cqFODd9+m9
z*w`hc&Ejob?%A37Vy}63_@@M}usxLVrRt5HyW8UJyo)cIE}AQ9wf#%=UPgN!$DIa_
zu8S5_{})JhYPz=nPto}&w%~RVsEXb9<<dWYyOnx6Dgss3R_{2!^nZS8=wy4h{7HA~
zcj;Gazcsw#*Qr0h?gV4)+8^vQOTvYApSNmS(fqP-&AyiNoLBBPZdz*_81nB~FE8uQ
zU4MmEo7C+uSyi%~Vb05ZA4U$*w|Dx!?7uy|$Uq=sYOToTVvc(Ej3dSVJ3f`q`1bJ3
z9MiMEuFO5<CA?zOy?Hk~f3rNkI@kXDlbfLvXDMyVoVMCd)&0Y3y*c7-^V^b7+h>^Q
z-r2@l`NgAgf9V^IRW(goSDA8Wxh=Mcm*H4GbIHQyo}Pm%3*u~lKQ3=ywqLQ0?e1^&
z-5;M$zrO#=rDD)H1t{KJ+~u#nnjY^LwPVA-U!_b7zb|^s$FJ&tWEVe&Yp1{S+_XcV
zdcH7UzE=?A@cO#?-@WA<8E1d}v#@W;db@JI>YDJ4u?7lWB}*C-jdX35Wg|Iaum9=n
z;NUs;@=a;6Y3$yj%CGW=cDi_|K3l2!#@zR?zfP#@n-vEt6if=M3*KCjQFZ%zV9}x7
ztQ*^tq(6CF-D}BT5uhvdDA};r?X=LNRQK!>k*a{R_8spohS{^WY<qGU)DQ;^-zFtG
zM@lwckluRsJpcYjzpJjVxU}(Td}7YAlGcN}?q3MlVb1f-fMZ&~(|tDr5A*BK2p5sO
zxaR-z%oOeA`|ZP-m-lPl*x&u8siSYs1>?(?UKi;#-Hgfn=W^0dd}T|*rb|`MX^%Lq
zF17C1vU2i~)2v@LZM^4O-TW2u^I*#7gjB7|fe&M6w9U^gfA_-DcH+$sFW$up)^$jf
zJ8pYn;reGmsq~WjcGFH7uuNM#J4E7GO8u{i7rB2i^MrJly|wuLcY8q-<H|B)7OuBE
zU$*mCgX$OWJ{R|*#s1m7`~M$Q^_Dt)nzJQt`Cqw3tTX2BDDN>?<nQtBTkfsAE5Bw>
z{?!#49}`lox%}m?t?g^qrWH)9QxubNpBVgpvB{3}pG`bUzNjwT_~FEzn+?-0d+$3I
zk#Nm=^QHKDUfo%zq=R2vxgOsk-`#PSIqJq9u?+URGY(98WV<_0)^-sS!^RIBM$#<Z
z&(_7({x6HIo@yxjs$uD8l{0Fd9Pe2#a%A!AY0YD8p80&Sz%9!<H}&O}hu2Ou2X#PF
z{bLUOku0sbw|tX>)wj^MrmOC+jQHVvaQ*_0x*hTH^+^Y9<~%sd#rsM`06bdYK21h5
z{@9@}OTD94t*({e*#7Icb976MB*%AF_NsLrFVf`C)gEpSNl9Jx(Z07V;#Ad@KcPX<
zle*#`F!X*DKE5(JQd-6Qo54b*<<CBP9s0H)uWbFcFloOei??yUrZ#3%eV3Z)3ueB|
zvX9XS%w6qa$?;g&*ZSET`KGTA0-7R<Qx;^i`xQUUjZmMHdG6nbxj(qOts-1cF{b=t
ztkYW;5jVg3rjL{UoqbpL@V4yCp3;=vJ<;RiM$Q(ANj`H;_DyzMoVxVau`k!3y}q7s
zpGm^*&pT_&{p${Vd0_8$bp5M}ZHtl=Z+v@UzS=)bqt5!d(j(O=>6veT7JpFCy|-6*
zbN!DSR|8kEz1Zrsx}(-i*-A*Zx(8GRFM52dfgvF=J9jNVw1}_Z<5=8$H?ltX>Yk2$
zdk?g5OfgpscszfWu}Np(<%CaLuGdaxV@`7Va4=|zUHYLNvdd1-v&mPCkm1woQ<f1s
zo4?;O*mdv!ra-IC`XbM4;R&nk7~7_muU@@&&zBzunHi>j)mjiRg@rY^ako$V?8WkD
zuI6(|<Oms^@XCD=GtuDr_o+X8*6g$15v{$(iEH6mCG{nfnde&El##LKTDP#*we?ll
zM`7-BRvV@@{_ei@VDX{-9)~inXz@Rkxd<9$SFx&ca5-Lj@L;5N*qxQDUq5ts@%KeX
zMneDJYwzB9I_0v@+Fw0Ai;MMn<Cj~n&4XoDobFsPfkEx@vA%D<{(=7^7Aaf|^b-4?
z@?mbwB{|_^>S}f`b=c4RTiDnBV$WxL{jE{8vyN#!6FRClW8aL)UH>y?U7BjkJo$)a
z#%z|pE;GL`i(kb)pRRv+Zg+9Q8m0?I^#Kbuyj)@}5@xl+Hm;ZBIH=$9SHzC%&RPbi
z6DN689{ju#-hF2EjJJy$qW@TSSvubrt;@<~V7VoHaie<|bh6?)JG*@J)>n1G!i^X9
z-8s{{d+Nm%?JfU~tvgZB-lr3FAs}c`ZBj#x)PIE<<yY<evu2<F`*U~yGCnsJc8Sdk
zL@r*Ov-q_5f4fIAmjarLZkTm$VK$l7wWVbBMGcwAdBuBnF?##)bjAL9%I?-LkXiR3
z)$;38rO9lY?SHe_u6y)WVY<Hv=fl&Byvs5KOz#Vx*tYY_u3d{9Oy?}~$#B_m^y2sX
ztemgUGbT!0OAmBhYgc%uW<Q_!tGW|s>l3}N&HnrMKntI0#6<A$%(n-5p^KDv7CNtw
z`+xM%voxlK>=y!6{VM_{E?B=V(Wyry?$(#<cbD(q$mv`b%J1UK@Ur!V;NC5j!GBsd
zDjh%Mo^sf!P05N&-&Zi{-;2P{TUSdYIRCJ?z{kjcK>ZJErj{n#w;ArDZ*M%ilMy0u
zzJoQ}w@_NChTqlWOIcU=!MAKb+6(r){+(QC*<(G6W%X`1<9l<GY(Ka~b+H+rd2IQo
zhHG1%SnixzkK{~D5~4O)l$gJoW+3RQt?83=<n6*QSz(_G)TA8eUQoyroo2Qw>E|J?
z|MDy!HtWNy@oxzwcW$h|f3jCve#<r?j@_ZRnV23`u~&cE{(OSNOTEWoIzBbIN<wN~
zi<JaIB5MELdHZM2vP-YOy0*UHJ9~Sl?eE*Fp7}nG6?>f=PqeGCEe?=S;k_krQSj%p
z7fVH)vl;AtIJKT!7F(eC`1pcPZ3(-Q<?9<RTHNTJwS3{uz&|NDYgah121%TMvHE}m
zYwgqxjgHN#RRMxp8t+_=JUw_fWM=m&UfI|c=C3;Ko~~lDm;NfU<9dyIm6G5cjX4Q(
z?l)wxxF%k<F-uH{7YUhom;X|prtZ<@ja3SB{J6_=oUbTyb)Ne5)b-jthv^Nlk*Slt
zw*Iq!f4ARVTYdZQZ<a&vf_s+N>mHNf{IE=Wf@e*$%CDBr#}nNoY%3a^{iWgqL)@!e
zG>eprp1T<GKCI(d>72VtIItx_Yx9fpKcD^ARG<65MPx-LTe!j<r>U<^eHXq_`?kPe
z^oiQV)5i|w9?*YYmD4lTAW%1F*RS`PFI+^g3k3?CXf@y4@wUgYslwHNr9gq;d+r(y
zx#fqNnR1%u=of<LZb2=Mb;%DK7!MqBzuVl(a!4c5<kjnqEqx~h>WrT?dpS7HmyqJ&
zZY%a-kan?FT%@ey&vJV~TI+G^wPuT_GnX2yzTe|Hbrsk3h?pE+ewQGpPaTR$#%bSP
zeJ+}Blm7BfH?u?}OS;nYyNbt|_|~pnd+xq?18+mu#H01MZq4gnoUz9BDE~jh6Zs*^
zQ$o~5BxPPy{s9%h;O6V%?ODG+JQR0wo~ZD^)nUik`}e2SaB+lwYB?_YwoYxzC(b{@
z<~$rM8z(cb^wZ{yomK5TKSC_SJyokD>eQE`yDo5KMNQ(Gs(R%0tp&5rI>*f0shfI8
z;$iTw^TF;KDIXQT2^?T+p1DO+__p?u)U)%J?lW%`Xr7|<_JX3bTE7gJyi^R|nasZz
zT;5bi1~KhQkDbG?B+1E!zXjAf*g5fqN6D8uojo$Le}7z5mS=X7cRFq`)#hW9!NPKP
z_XGMO|Ks}3Gk%QOsMz?1`)iTvm-n*wpNsa#NL}B$|MRE$`)8->{aBoEO)vFM#v4yb
zYpv{STh7e9%-18c>i(?BtCD{<rW8tXrJh@zV!40qm5SvO{JBf{$`2`v9PV9Y!fqaD
zy^`nY$<7bu8}FUG`F_9am3@8t&C|d6s9ibSu3-}w_c#6HyjTU#8@)^!7i+2?+S@C~
z$R$rpu`JJAJl_N~u(J$Qzky}|%X?%vbwZ}S+{fP%*Veb2*_O9OX|3H4*93cxH{t@K
zLLDYQBl7hbf)1>jaHO%;P`v!(^rsG*6)g)^${u{d?#A<STlI;GzgsVN@7KBU<@!?l
zy4M%DjnnsV?)EO$d*_&}{3ju#U8N?*prL(5XIoR#t>ScUvwWL>H`P0te_PsI;F-1~
z*Hp^1<jdjja%SeMy<e+T70*^Pym5ZU+gaC>7RjD_(0F#k|6BX&H?w>!6Hs0_zqPj8
zj-|45?g3FA_EmWitGZkMm*4*J>9kXdQ#)t|5;WUZ^myLK$DbcRZfxDh-*T^|&zflu
z2Z!Q?z<!;-uC{X-TAKORI@X4SUs0KtdUc*<ZNilg>-N3-xzyf7Oe~^()%xS_nCF(g
zm=Nv0>5a?M?mIR=66NOEp0?rjo&89)V5Q}kXCm#>{Um>Daa^v-{E?e9?}DYuf!SZ=
z4_{lVWBBjLp~_!dUs$+46lDB$BLBei#bt}m3s3dWezB)Y*X+QJ$zPtf-V$BWaA6%N
z0*XK*r5+_bb1gPnn1=o_a#kqel>Oe$QYk6Swy@z@_nYOf>Q)pt{Y`S>2(<NLFrKMg
z{x$1Yw(#Ae9h1L^2h7}|_o_wK_Wy@B+oMjMUgPTYxA$M1&AQE>F8FF?PYqVLHjyf=
z$TZ1%by)QA++Rfxi}NLp-k7%OQvFMjO)(tPjCW|y4b510r!>2yaJ`XotZm0-qh-FT
zwUrAEwq4-lQ?UX~8GyQALb8YBs(lj`8!zy7eLOWQw4}fxVncX!-M{GX)m`-)kL;hP
zcjeR(f0iSQ<!kf()DP(AermZKuY2nL4o0<^rz$Ql(Of(0@^X^^O{G)+o*X`R=fCyl
zS9);)9jWTk{`JB0XJ^m*wqdF3o-dzP*$c6K5qvLF+_@vMbk?hPJLH6O=e503s`&ln
zP-Vv1tNinRKeV3m)kOH8_Hyp>*6$rm%anMJXuV?Twl>cf+Pf$C;lakaX*SSc1uZI3
zPCv6_+EiDCl28Mqk5SUK4%4r1h*!Az-c^k4mCux28)_nJ;*T1Xm1f*}UA}ttQA-Wx
zWxi7HCrlAYT^H!<`}&~8mg0Oy-gPs0T%NJ$m;|P0>*~9gHDxVt$?iT`A;sNa|7+rg
zjfRsICmd~;7G^!a>+|z998ty3z8t)$e8HtE?d0{=XtP9)%`2BgT>tgK&sF=)N!HKr
zLc;9qIX0~2{p!Eq*~jyC*Xm_n_4~;7Su;pJ(w(qxPryYzX2pvW@2+xjFH$}_Df!Bp
zNYUkfrR)NE-@n(d+xBz8AyI*<)fcKISDs1R)%v$!?TY2O^9{fJ{36I`AG7i4mi5yv
zy?)g0^l_c6XY=pq?@N58*n3X?EIryffBK=lmmm5*TNkOSRn&j`)~Ekb`EiE77k@u0
zx_VRpPW8T|7Y<*V<Ys<0%ad5Z@mSI!>fW!dC$1Sc3T&ItboJEa$wzwco;l+oXLn=Q
z@`BfC7e8|z7gt|9uVCv%v*l4QgVmm``zLI{9xWBH+LTFfO+=*zv!3<x{r?_a*s`*-
zc?m0@U42XRinHdIf~=k}Y}qgEx|8)hC>JbJ2F?C4ap%vmeO;*#@<|so=K7)YLT*9S
zj@=tB1bq*F)4ogo<N4=PF02=Kc)D}PjE~1ew#U4CmUweQK%s$U<qL(cI;&a>US9Fv
zdUtQ}`fb}@RhU`XunI5pli{`t+>kQY!=&@+kw52MB&tr%i;ev?u_-MucXIw`2P3<z
z*Jck^-)R26jv+$&d_-*G8`B!Ibiew;4`Ug>6)<O9VBPBU<5=I^^PQ~ovlVpi?cMyk
z&LmJTYqR`{PEcucR~ekvB&^HxLi5&rXI@yoaIx3C528o4j9j!eQ)d4SdC6bgx$j(^
z%oFSFUw%KjyE{+TvZwEOy_~Jp@3%=C*<0AsG;VF=HPznHzheL16$(4+N*!8%ENqbT
zh<SHlMWRM%V|okcCN<|J79EQ>-J7Sms-R)-rXLoKn<`(2b$8k^L{D#%f3)aCz4-UA
z+DAJQO?F-Ayr`kEH{tX$b=i20)vM<DZ|6Ab{70WfZY{^7?e=dy^WN0G{qkLzOGx&v
zHnefZB6jV`^J;s6DsHPst@}=}{hpr|@}|10(%}fliJ&jHm%pmBoBh#&k>|oS4Y``6
zHG4|4T_zg*e$0O+_kqUsd`=y$K35(qJ$9?oybDdKMu`u<txdZXcP-j@&Do_1#*8y>
zT)3L~d&Sq8SM6_}v@D%;qj^ue@MpWL(t7J6^6Zs4N^NEwOjsgt&ivKe-L8u|L*~9|
zRkC`=S+f74hHJ?ZcRo<prC+9|_y3d0w-zbAXLrhXa6hl^A0TokEJ3GprA<ki(kj0C
zrvXoe_g~hY@AG=sK7FqOWhs|H5hGiJ*!j9F>pGGRMcQA@JXy*o@A!U2*~O5iqbnA;
zv#>4ekzQ+lWsX&*E#o%r87p6hZ1|@gxp~=Q#;ZTgT23$iwaUTozP*)wV0LMW$t@lG
zCs+Tcn^e77{QaV#wpm7bSj1z6*>d$78yXL~Zv5{mcCj$upm74IEpH_xyW7j<_}03*
zligybQ>F=V%vZj0`B62iWk}5SjzvDF#e}~(2)3O(75LC)l2x70*OS6Yx2JyCd;ZN#
zgJ(C|-<OKG26VCL%sinkAjrx7DDtcC+n>c&+Xb#_P0g*?|8LvFm|v6kdAis|6bhPd
z@#Bwv6!pT3wez4N+t*9V@AokWOPX%w@NqrL|8~~Ymzfy_ruSth@t^%9_0CtS*X`f@
ziyD0O7jAU0e-ssO-Ktq2D7U=o+yo`7EZ1FmCSHQFH`jWVsF(+tZP>7J&m4yv>y$(V
zZi()^_;-=d4QK6TA0ki2?!Lv7BjCWX-utu06&}VYiA&DkA0J+(_VvNfRQs|oYF`5u
zt$1^H?Jm~&q6t$!_3RW9>k?s~EOD_!i*Jvdv~r(Q2y=jdzwGaXbzF}wzm5uVIUX&a
zS}B}d`fB#IE-nXI9vj9+zhAK%pFdcwe1`e-WZ|RT0q1?>%pz>LjgE*iK0m+Lu<Hef
zc4knRc?Yx;xbiC_<4W&oCZQoEavbF>EFM39Xa6)2Xxq)x;^KbFRWa7#&s66dbKlLs
z(%aE{)OCeRq6@E?qCttFwS8b~v-UG#Y3_?3Rvo>#FE1^Xt02gA!{+<-%4Jq1p_<+u
z;<x+G%;lZ2#YjRy;H%Hqw5yMIeOn<@Vx?ZN>C~6Y>9-;o5`Nsbu-Q;>TP$bA{u<7F
zt_5{P7i*sW;f#B$u_?&qxUY%STRqS!peJr!FLo#ze7LYFb*-uCI_8DOKV_`i*w`4Z
z+Gs3NX7v{O7|yq(rDo6bzP$&Z1WV7nvp-fn<LpT%`NgaBZi&0eoGo7G>ORvtP&Y?I
zL%_UQ(c$tD*1fYHIb1O?PWN;64Bi{CS?OHKQ9BXa)r%Nj*u0gUyFHDsW!k4th20uO
zkGC<@I|;g$JXrv0a@<%OAtAz|vnM$GdauKayDxTVAGp8yjeE(G3+kHxPARUF{m7Oi
zo%TP$Eohg$7@Kjy@({t|Q`KtePxU+W>yxSzxADH6D{CzE_oKD4?RwTH&kTO<Rmth!
z8ToLvzy<EPbI$j0FIyIpwq$WsM(tWD$2VIp#AQEEZj9G>^xnUA<AU4&UT9{S_qhH2
zlhYOOL{AX3-tpqZ7ds49o}B0sEziII%}8O(`QAL&;}-tTvKJ>B$%cKpw%%9f#`#^#
zug+lGCnwDNE6DLldEVWcJf@bc(?={h>H>_rzP0}IH1?CdJBiPH{@;JmS8lpY6j*9s
ztgaK$vYc-Pk9nppKa<qOZ!b?B=bj$ele(x-B&U<niG%g(aenznH5N^aehSavUE!v`
z?pMSvUlCC;kqsx$pI_F|_fB-@L{M3OvRAtL>#4ZCzv_xNr#D{s{6b<iXjx`di{S2e
zJ%y`x7wogWahYk$mgly`72l%IhOd8hyj3~FyE5`zzP5k;R*v53>uMBMO-YXx|Nq%I
z$L8!=gR3lsooB7q_;Wb6?($fnk|8#4^}6~)KNf^^3Vp6KkaF!%+IQ*K(Z`FFnwTA{
z^2B#u+^4ZfnH{vC?6~jVYG!WvEnB{rC~VPh*}4A#i$|WzvAZW*KkNP7CsfeHbKsEf
z>`!KEc7OT3e#TjAo9eLe_`8;GG8OkOuzf$%`SLO?@e9jVhezdy%y8fNR4wte=3_CX
zLsR$m3d~89ld=y!r}J~w-oD5qe^=hIFFwG(rXxvnW8<rpU3{EHvj02!L_no-o{H73
zb-I6l&%d?fqht2#ZjP3T2lZu63(8Jr`|iGtaRvX&S2K<a`%dlGecLCh$sW3NU2#)+
z_bT_5bF4I_H!Lsx^V#3$z2w#QPNTVfJDIO_t-H88G&Jw$g}gL5BV*kOtMcEuJevPP
z+;#V}iI(}>%Zs*c5-pvQ*MHNaq)14*YQqa#X06Xc8>6R!A_qJT&&)pW_P)Ju|J8D~
zSTi%pWV!bT{NN5#RI!qiv0apKIo?<GXo5Yj+*?M@LocizWL&b25I(o{#ffQ~f^z3|
zN*vIxc4mESEB?*p-JX~2m9I{_ZnFA*SI9U{KlxS4bbIsG%A%=nZmMoOIOS<vZtp*a
ztJjxltNJy+|1J9dp6WlHlHaSlek@)wZ<X%9fA^T`T->|vfYv}LFWpdZK_TJcVs?HO
zfm@UG7cKUh_u`|Hl~$B<lyh?7#sz%OD@$fv5OzQMo%dk)nI#8*8b7}-nqXg`yhbPZ
z*uJjgpUu~`=XP2awzqoPr|5QEesg%9<&1Wv<sarb+P*#Kn`yB4PJGOjo$~vP8zmJR
z8SZZJe7u1%U;c2{k0UI+NeczP?|goL<sQYj)>gYv*NY-ogSRRlkZzoCcNHiOPdK_~
zUH|Y<{P3ZM)^*Gaw=aIY&LNDWdJPNjqH8TjSgjLlZ>b3XoB!cM$&=ZiHdb)%QZg*y
zVD^8WH{U|?a;L>Y;SJ&C|K@y|*LhdnD#|#n-uF1etJXKwHcuCAx;HCvpXT3tq0iSk
z_PjD)<3HQx;m+sGQ#S_hk?Awis+qs2YSlN5#ev`zvz>i$nu{LKGfd_Z7LH|i%6C65
zu2R{gb!S)P%;_8oE=^9g@1A~I!cyY;EdNe`(5~G!mMg!#nc3D<6H$_M;QT`VULO9M
z4-AfP`7S>^+a+0Jad3rf>)zKJ4U_m!O*&M~cGQi>ZPvV{c?EHA?@OC>Z%^3g{ybkY
zxz|iTai62fcOi)t^K^T3bH05pRx?t(c=585RS;<G|Fy%5w=X1wog!ZSJT=3L^P3h^
ztelCNg0*60LH%Cch3B<Bn}4l*FU<bs<i8Jld#<Zlt+Bdwvg!Zxmqv*zzuk#!aVQb_
zCg7w0&E(1Rg^Po3+?b+ztUK3qx!<ni8DCbJNVyiT`5dKv>GNCjFR#{xl&bwJnJ~>U
zVL{b4rDo=ans4B;8q_crlI3i97jDw)7SA9%*E)KGS9G@aop^`Zxz+-W&zSy|?EUC=
z>fmSZ{q}#(>FhWfB6sS-JJV~qC$_xMc(ZVw#y5t-iEs6Iq6B6u=JBkZk!K`zR=_+!
zYXAQ~o8&(R&JgU7P-{8p)4oaO^R=~N@BQ{pSX8wkDWvtnK2XcN3pBT5CB$)e9fwr!
zJ_f6QC)*cID_y_LDl_4}pM1nTiT4|vH)Y%w+ZZf3D`KkT%c^GI8_e>vHut6R@^;oQ
zyO?qARQ#3ACl9mB|9(+h@o<Ts%<aU*7iDiB*;sIyu}O{ZO?A@0^a3tdFZNfHS)<Ju
zSp^MlY?M42c{wnDi&62{lfp|_R~^r;_jn*yFEDF*mar>m4Zn-~BISmHaEFEfe&$0T
z6qpjvU++9`w=X_i{g-9`9^=)Q*`KYAPG(BHdQth=xi6lNrMkI}`W@&m_0O{2px(DD
z{Cmy&nP(*Pw@sTqyRoi=mxcLtyS~nU&e_%~KlVi^KmI7T&g~EHp(DZTI95tn?9}?b
zq9S|w{(ntdJ}7nEdUn*o15}5C;^mUEJJZ7ApDI>mk)K$mUNApWo%ig+nwJud!jEg#
zK25!@bohMT?jJvn%g>22`G4p8{dtjpRA+eyAKy32tT5-*jllo=_LOg^RQTo{KeL@b
zP|oDLx@7L0Rl9|fd#~j-g>U@yKdS$F)b|<pjF)cwJ*l1Viu9Ei%30a3=63n{iT{lf
z&@X)Y-oQmR&9C0s_R*pXp|`6RA6i(cd2i*XD+^c1t&e5=ch9>D6jmU&3dzPYIL&u-
zkBR-u=D%~@lyLV2mY+Y#?|-`P-{IAHJSnY$7QHf3HgemyYTg(BYP;f1T(0h_;uQ^7
z=UK+?$v(dE`!fq0gW69l!W@Z#j|)DZWc@5~Q+-w0j|Em-)fFypR$7&Pd2nK3+SgAz
zUrH5(9zAE#&vn!%<yy35!1GV5%OcMS?BiH;h-vD29*|>#T-+Bee$Tw{{i0-<Ubol)
zr}+~mf3|Dg++pg&Kjo=ct3c|yHIn&q|Gz9we!qYAjrG%`-wCri)D|~6%xMr75ZuVi
z$6s^fib{6X>+4ptyi4YY_y2yW@h0})=kks0HzhJ3AD5W6YVz#$ae~%IqunysH81RY
zC;m)A@O`3Rcv93PlOIZ*CxscK|NN2Z@_|O?lLg9+8)jc9lyAIXI`{v_-Ss@nPR%j9
z`j7KOorO`gn9*x3K9%iL;@o@vT7TbNx#wa;Oi1x37Afn=?R-T~)e1Ww&AolQn_Z+v
zLr$l++myR-yZ+M?v+n)7!F-tAdWFEb|7UvUosZnOXYq!1PmlI{#%zoBH?fCyzgb-U
z{Rn8KalY(Hts6TOH`eEe+xcI=XqftDMYKELW9N0dD;VWv|9$B{Gq=|-@X`ZrRV^zE
zfj7?=odAzPg2GaWBQ{8+*Ddz)Ma%r=J1i9%{vy^)FB4DkE%<cgCDX$NXD=Pyc<ge#
zUXD({H?1N|_M^t}^@@Jl-W}$fl?>Ko^a;lO`x{<pAr<Ve_XFg<hi;Y2`{g>NFIySp
z82pPVy1vHgik%wU#82(jpBEkUTjB3<X#(SuM)5ckDc&Mk4)8FovTI(6r;9sNB1^AZ
ztZ<cx^rs@$)iFOZS0))0aCmhTEZOs`T*B?WiqF2^=l0%`O3z`7++)sYmZx~*5AW-B
zZSU9m`0t)uym93ciTG^4`G-8Bt7{^}_RF8$c)st|TC?LE-evEFuAiFo&FWXCtDunV
z5{tFM8`vj_+%9mHUAF$};bTdUSIFr}^)g-E<2_pw)Ib95JPBle_^yFrb=g;!x2giW
zbS6w?5H;wZk>Z?ToyL?Zb>ywp^Wd6iSLEG3iTLhZ*Sxqb`>~kB`2}acez<L%Xq(0K
z@NKs^UysD6o{KLIRX&@m^nkI=YS(^|<trUnF9uZ`YX|2R@KrCnnDKe*YO(28iVAeJ
zHm-W-e)Q)ujjZ$rdx<mF;K%{DY(M^g%g3|D>%+nc{Y8)G$xX3Ys1va(YSwY1xY-qT
zFTZR2y}NSFls{=}+{@q3`~6RvyNB1=BCcA0XLKy@gN;fvk7@OYEc2JTU;3W!s8!FF
z&e`s6tS>I^;{Bdbv{>$cb8OeS5Cd}!1F==M<=09g9G@>QJ^xZ){OOuM{6ZoRcRMqw
zSOwWSS2OJu1#dwqTOH)$?!~y!_otE7FCKxeJco!GGQSh@&Yg;1=jy7U#>i2any+Ew
zy6eTRNaN*mV?ULCYk&Vz)70gj=Yzss6Rs@xj&r@eeU=Fa_sq}U^#LMN%o2G5Hm}`!
z)kdazm&mHKEA4k|=1^#nGckJ=TlQ)WSB7_Tvdp%Udmi2!cQq{f)xIq{V!sF9@{Ycc
z^Fb8>4*m{ykU<DRS<V)_-oB0d(oCYZB+t%N=wvMxH?3fMQot=0`zO`XM|1Z2_{+Zi
zq3-=J4s&nMYZHGVe4G34WUkc(Mt59Tc^4i1a^lVQBeogY0mg3YUxySL+&ok4{xl$m
zdGpC>7pI9mk+gc~{Dk+=dy(~~J7s6KGX&N!b<K<y5R}!_GO{RGy?=jbbc;tPsJy&*
zvE4<G!}d_`y2Z&Q8~kVP@R_+H{p6X@+D8@Y=Z^fC^U{|oG*#YsqFU)2jjwN7Q|;|C
zG72JiFFUk8^Z&6m!9c(Ks{D?wCeI}w5}OyOsoa{q^@4N0AEQQ;e^~1gzdgslcs};}
z_U2HG{GQx^N@4L!eoH>gt}OY#&p^smJmb}li<dG??ELoRAGt4{6QeH^{Iw$S<GZ;(
zCiqH;^zR8!vI+|E>0ofWtz<4Fd$L!i<V#^7i<7?7@f8X3-IW!W{yFul2K}BF{mWTV
z(08^uf2zVc#<pn{4{zp+%`SCiaZ31hzRGS@s}<kFBhTk&D41j?r7hVl#`f??-4(No
zlU^B2VdCAGrs#L&^&5^j{Z%@hH#)nXsO&LqVO07jC)n|$EAfPOVzt4E_QPvUI+o6g
zJ<I(0n%CmMit`LVgWUQZJZ!yIJ}8Trp_C-IG{oY?im-?-CG#Ms+e}PvoE0vDCptk*
zE2f3NFB;w{U&ImU<uqg7=T6gzJqK(qS9)3R2;9T<ZN@Xdo{fwXT<q?3p0^7;pLVuF
zc;Q=#u4egVTv^+hTUH!;81+c^&ieKKm8C6*|B6rl&ypf~qw>dE$+<tiJox&F$L9Xd
z=GRvIDo3(3wM!+s>x&NBT#gpC6uxD8-0!oxtDx*k**qpENU|$gqVb*i;k*M5OYho7
zRX5N3#=A}Xy;tdOF~PnQ)`ku0Q8E|nGM5Qjyl34jC!3nb{JV2mz#sLl%xC9b|6Y_*
z{Id1)+nH11e&sGb8NbMBMQaM{X2Y*f_V~Z8Pg3%|r|Eb4YD7qf#?fz80Y}q(Lgq!8
z%<s6Q80g}jRlb19>AoPiE9cH<^=sb>KIVnRKdsE$*w~tW<(zu_BBJ=!l8$1BrQCCS
zrAkA54qe>2d9F;-r|7RAbBd#%eK8Nn7YW_k)GK|&Y>C1G4~<jV-(Tl%7jG_1`#Am3
zBH`DMKBe;MhF-j(xhC77zT#Ck>)anNxXkiR*80lo^#~q%wb`UhUaDlS%#Q_uleCy#
zPiFh3T75&@wPeYmradCyf&vsii>w%0_Vx8~*}pll`9+82mS1;bvU^u6>Wc@LEf9Y$
zYR?$;?2q)CfHQMFwh8QApx{5FX4d!qg)SFkx>)CxR4{v7GM*c*bvZcn$8Ldpb63<q
z+A0~WUaDmG@z8nik425s(++-!%jFFakX`spaoNQcKR2$fi=DklW0A7x!XCHUC{SJm
zO|uDd)XK^xSKnl{JYS?-6BDp!QxcC5hoeIH;qP2ohiq<NEWe-0-+M)2QRzZn)7(E2
z#l@9HO7n#FE?Bml`;(B5MyRC3GKRVrk)kSXx0H=UW%&%dX34oR9yOcoC1=F&@W;{J
zWg*L!D}LuM(^uHl_Q$5C)$zsEj{SkXE~%luJhuWP|I~e)Hu2KJ4cC@wbiMF!WoOU(
z{Js4|iwt-_kmU;xK@QutK96|}wUztN)qU?(5Ga}O=;NBm%dQ)_-E<O;mTlHv=Eu~~
zxp+!+PwnEs!UbBfQQ}H6w{|mb3F|t0Dr#B6<@g1@UuGpO5qLJIe03gY-jVNf=Uo<N
z<mYg8`D3fG@$&Mg>mpU}G1;~7SuO|?an0*_E6O6Z1w6M79&Zd{ar(Ykc~Rru`D}uj
z4Jx*dwG}S5-D~XsEI+V(^ZlB+78}+_mbNf1JNNza>r3yoKTZ)i#5Px=H><HJpg@@Y
zP;*GmWhaRThnJ}ZUcK`Cbw&B+)t}SC)ZD}ho6KK4X*z#2_uk%8;b*I5ty&goELvPE
z0@-%~iXT^nH$tu~?5bb*%tYU(I_d5C(9ihk=;BwbF*0}L<BXaXy!u=eXj4)Va`j^l
zqp^dRu<XO<KQ}DBX(09Y;2S30yYkslB~~l19E@^Pl3z0Yqlnlo>xXYUr&o7gQtLC#
z|8{25daDu+*Fcx!v5aMm{V#5;g>NokN_@f1+>+?nc);HJlaBczf7dIQ`)Ys8s}s|k
z#UUXgEwJj{2aP8zT$31;x@>nzhD!84a!QI$`hPF&zls>wjGOX%`P~kACrCH{JUqov
zdF{=28+b$oZr^ia*E#g}gVy><U;q8j%yw=SkX@_w`S3E0E+z0#-N`+m-F~1UG>;M$
zfm>77FHX(~m{9xYvxt@4%+KHMMxQ@(W$To<_Q}idO)xAq`eo)SpLThwkitw0E>~A}
zx5cTc3X&T?Uyu&&DY|Q4Fw3y~krw|fsiRj-^<S30`CHy<t9h^WUYg#QgNMF6eN*ne
zCQ{_y;ze(x9|jeFyM0t^(mvru8eK0W*43oeM7X$vrf*O7z6nzm_+@8)?CU1((s@qD
zx$XaE95s5Yk$iRL(fCf=8OL|eEcM9oesTNtlthy*rt1&4r*+J&e0}|u%%Aigx8uEL
z=Uv)Y<$N^}yVu$l^p*FP@A=yQx;5^v_2YL1S2AxDXgE-9dR2pS(SeRvNyoB<LzgVv
zeo}X;L)W5?zKM27bKxoizwE4zwX9HD_?>In+*J<CAHI6Fkf*UvGueIR69>k$U7JI=
zx9O!7C3wD&dp&Q9=i`8V#tZrQXT9K97_)43$6H?Zr2c#QQ*3es78&)OnK#v_$|YRg
zDo7;t{-o)zvfgqB?lS@nSU{#DIa}sAyQ?@>8uQ9Ym~ph)X-{1^sm-Tj&CC2b{~tz|
z=-#uM^VR3p@6Gp&ds|yI*L$7H($W+w-Q)iKooLRThDHaQ>MwgOd0Bt{638^MdLKOb
ztWjM3TeqlJ!pmP@yLdQG=#@v{6wMuyi~mZy{(iUR^U`nMxo*9CpYMKKV-aNh&7IFm
zh$D6a@8UrHYjbB$<vOGC^=7o?{y#c=I^G?^hZ}!%J*aM2>Zdv7`X#r;r$e4E7wM|L
zzDT)o)~-Jt6`Ufvryo6jV8z^Hvtq{;ZP$_|D^BnKzv|yJxw`7K^0?`@IPVpQg694}
zgKVHeh9fqhV#4%r4t8da)R*U<1qq7moW6P4-aOmScgnq8^3|t#Hhj;@YUntWv8CX%
zo4TB(1oxSLKbU_UUlHgWFSv8!qJ+uS`}fJ!pZ(|yGG12VLg6dWB8!`lvHo|D-Ix+1
zCWMD`_}A|YsH`Z<$UG4II_pQ=>zON)-9wixT~+(`s@&|ZZa>{Q?BbGzMQ2Y6ch*){
zh8nS7oVX~){P9tl{MWr)e`MWPZm@no^Op3Ih6~*;;N4j#dtKZYJ^s(ltY#U0KIzbp
zxO=BtJUTZ-in=)Rzguh`#J^}`FoRs$e<L;j4RX~PubxzIHLaRHBQR%Q)zdeR)^Aw*
z>V=@qrE8a(jFKypn4a<UpPf7RhWQciNtPXbBAf#Aw!1&yQ~PrJR6Vr?3VWA5Tp9b}
z>i)xXa!$`N`})SbyEy!BVdBmH8UAH|bpr$sHr{h<02Nx$VEtz=a&}A3fraN6Kd#GX
zb-MCsovT|%hyB)u;;rfDWBU8{e7VgP;V2_x8M1#>#c{LGs#7I14fwan&9lplxq9(1
zzm)WW>a6}*DmvZWzOu%j>US0f{W`Mo-nWecvRgH{^a6gk%lvtI_J8(X?dK2DPn=!j
zGpG3ViNtp43A;KoE~rmy6}v30$$nYAxBTg@kP?px(+g#x+oqH+P7HF$h~L-WXQ&t#
zCFdh)DzkR>`6=&j-8v=wcyc>W!KYPA7;E3%-}m=Ogu4BI7vqJ$*y2B)zH@Z`bVXsM
z{I{!uxt}fdmq<PuSo1Y)qI73pPrXCx`jtQS?>qR^lT$Blqe{tl`+oW4B8$ow4j)4<
z_T_$m{c2vBQb@S``F;EJx&CszV&^V$2{e22#dYNk0r@rH<>a7{b5#)eR9e#WEo||{
zCkOw^-`%Tys&+$5pv7|+)!k(?>K1ZLw)pZZyQ<%=rRzJNpzO*ejepPS{QFep^JS;}
zzRmGBcT0Wze)f#>iU&I@zRnRn{gIjd)GW)hzkamNpSEga$_%#bFqhR?=T61HySJ<J
z_<Glt-9@o(H{SDb+)#Y-e*M$K7VagWIsMK)k;V&;?_>zeD(^Mz`tah-cDXCpxz|~L
zeCd9^R`FF`uWPG+F$cF6pNjaOt#bQQSG}6AE!-fobECKGQeT<dHE*^4J-c`2%mscW
z1rd+1skLiN^tOGLUAVYy?vFo{n|$l1zUz10$^YLh<r(k4`fukBdv_VVee~OX?WeN|
zVyw(*h6}na)5Bv!LSh097bTrr#Nm;a(BXW}QrTIqD5!}k=||m}tL3MwX3txsZg98u
zx6N_mJ)yC&cVp)T@85U6Sl=$FUaHsbUq-}{=2r)f@#^GB+MC(wEHuio+K{;Su$EN1
zNfnnsghOMuYIC2P`{Kpyvb}wJ%nwhx9Ism&s>t%>#e-k7i_ff!z5H&EZu0KT!j01|
zUVQO_=@Nt4(xWQZGucx=F4v8|z-%nl+qeH!(TDuU9S?=AVh`HCcI)-|yJbt_i3P8|
zJ%6Q{x%i@a-0%4|Hy&4pNtn(1`QY!z(;u~5`sM!qT&}wQo6e8e-TUmGvM5}5k&$O&
zB_(^dSC2XI^5W$C!BH!nPAu?yCD%9c&?;jsZ_!0PeQxgJ#|~9kFT8Rv>g1IQvCL;@
zG>`P!Jm)#GH*|iD$<JldhaWY)JO3x}|BTN^lDF3Gd(v;)Ep{o!tNQu*+uJiQKPycB
zXV+JedMcyjNT#Uvz1L???K9mPbuhBz*x&CCJs+ODWBuH`yzuUfS55aft&W%0Y+1Yb
zOfM*KE?#_*QNqIUdtO!6J}uXPoYs@Vf7boKd~NN)Kf)q+%rce2-mCVw=`CJ-abiGw
z{I~bd|NoNwes}H`A=kyhSv95YWyQPg{BEn4sN2mc`!2g*-uBcr(f9j4?_YkWP&@8O
zM){8YAC51YUe)3|c~{9jgA{|`#+f~v#HD*DnG5d<Wu3hL|1a$y?(I%*!oHqv{A;p8
z|NUPv<_T`Q4`n&b4)#}Ll#=c3b93jnl9G*OWmvds%8tT})YZFx%U2h+FU{X)_x|O&
zqNc*B&NHQZ`<9##km1TOG}l;van@_Ah5HrxPo-OMCU?ixJj_28w}0P5i{osauWh?B
zU$Xo^R3-3B!XWMSL0{>~uOHkuTzs)tqIaIKi1!MkFYDxOD<)jOWwI)(^8NO7+g}FG
z{l|75yS||78fyzE#CC#0tVEQr<!E<bvzFg1rx!(%vS)iA)~MYpko`Mz!S(O+>(1Dp
zoN?2va#Dg%*nE?kcXN!Z?;c?E`Tp?7q~M#EEgo&tthX~vU#w}ssl91x_@DcaPU|<-
zA5hm?6c(VY%Cqjz3ueD%A1x)<?PwFT7pS@bws8BZix(XtzPy;BUU}$gk)-VGX}>0E
zHf8^++xzM<zwo+w;+l{6>k~|K&;2}~T)No3Q|RUtYo`yZw`^J-<GAZ=W!TxTb001D
zc~`_du{kI9!=K`b7d0lg|L5Cgcxv%-&#x8vS%<EM`|SLxRverB>U90T&)q9}IzZmN
zc=1KVl~e^CqY{}5844vkW89A0uz0M=$XdPVkIG-q8ezt)1NrYarJh_~|No{s&nMYC
zTRIs!H_ULqxp>;1Z(I&PZtL$iNRhB-?K*tg#AD*BmD}&uY|zU!+4W|v`Bfb+;oW}L
zIZgJ@?QiG)|5bYAnt5MGjtLiIn(pGo7cbt)C;{ah-WK2fzOxf;9v1EF=~LO6Ki}-@
z^xEG6Ovxoj#6y(sO^M!}5%{o9C+WdV6RFrwzqE~{<`#KR2Rq?|_)#;qo+B&N>bN#N
z{I@l`g6o-y=i)#I6VpBq?^n|}A4fj9I@4xJxkyaR->c%*X+G(91n2yHdtzd2@$&@F
ztaaKue$A`$D*Iz>1&M|)3l?9z=x{^Fbdkd1!0D$`OJu4ek4N^~9SOPD!~U*!`@6_Z
zJM11OzFG14yl<{lZQ^fcY4cV2#yUx=tPY!2EasHRkh!YlTpP78Db-&o?u6){%Hw=u
zjoatwE-o@qyZk8MZLx561bfnC>wcTxC47gf{xB$9R9BT2i&^(CcNQN9C^LWp=EaLF
z8-Z`mhNokf^0XW_lIYzPqgSlFv;JiLx{CeZC)V1t3Ht?b+4;P4NRgj?;LykL_=#2`
z*Yq>8XI<d#{%<Vx_T&8x7H`+xo+|IboL=K~M(N$zOp{-KwZsCMUb^@So_G`<H|d4@
z`;2piN3uScb}gL${Y<dM#7kGW<b_HtULJd0ni8&@op5xedgCuhF|zaGix*l99Fs$n
z?pR!LTdX(zqT#yB|N8$g+P3!Jr_Xn}#ow%68*9Gc{}Mg(4DDmOryeC=zPHr7rM2{`
za^muWmZ$Ic9ai#M@XKkk>7y^Fd_$FQ?5cb-V}r%VW3MYk#b!$Xk^dB1y){Xt;_DBU
z)%}va|CYXCy=C+J%Y%Sjxvx?RL}dLZDJ!<0nsVQ+HtVY7)HN#A!C$8=@$Z=@`meyW
zk~h=WA)^EwbuV5xx`#VDMErSSvEq>VDZOyR(5o+}o-O|n*>AHW{i0Ki#lg**+wcCl
zd`<VH-O0n%-wc}BRgLVn*Ig)QGAPKtTh5#!w7JFZ%mt=fZ#~5}#y*^psbI6X=&HK>
zM$uY*oxZ(a9@+Q0xrevAetOYpD>n1aY0h;XWg68_xWcyQhwoR4d)vH{r~An*WrI8!
zL!PFknqMxQn`^an*179T`k2|1j5oh{DkpP%&b6k{Hx8i0KT8@E<;;m67cZWy9<wfK
z<*e-W^Xjg@J^M?jJMPs&u>dvZ?|P9n74PRweZSxO^TFQ@OXqLTO}@OYvUp|gWHq(W
z<Au}9S(KNa$ZTy=ueYz7;(U=widj)_?wfwqGb=uy=d4}w%1D(d?$?s6v)k{>7)#yV
zBf0pZ1c&2}WVglbe2F2#V$=6r6IOWAGSmBt;o;`bb1uB>ir}-2JSnrz?*E_X)3uBj
zf~ycnK2>Lx{VmNAdo)1od&ZIwpWi>U^(+^v_t|V-`%l4X@4>n0ck20lr+#UYTXXw}
z%Do@j`o3N5Nm?;+H*|ll34A_>(|ps*<+`&EKbpaPd-1u0EpsaGY_R&;7oBRtWzHry
z`J%?AxJfs~zSan?O7Z8(Nm7|zdM2ZUKYHVQ&Tb>Azi(dz{u7v`SN~jBKs>kjiDh~h
zL$v#f#oYT}2Rj^mlUibe$is~rIxlYAIaxhM@A?gIJ(pEcS04X7CX-Tle)<Ndh2h1w
z=5B92I^&DMF_ndhCs*4B9^2+W|5(S}O>yg!n<h=<R4?84?LgaC%a!?OTxCr*up1sz
zZ|Ks9nNv}_e1qQe8M?y9dh_n<eHA(Olke@Vlh<1Rzm*dUc3Zsar1^jEk6)g!>%ISL
z_K`nY-FHd9i14iBgv#f+8Z9}gww|+J@wFOky_9wO#f|m8ir@qQssNw4EneKXfpc|b
z<AtY1YyUkmJ}AUCgH=A|+~a<wxrG83v{xSLeRo06v+BY9i_Gl*JnW`y`fy7-GOm?@
z&C02gYg6<d(bfJb=G&5v&b-w!O{4$9PJcT=vFq2*i!~JsuYWz|R{hiV_pk5#C^)3l
zqwXJgWzYWFhWYis+`r8DA7kz-R}^+e@6%1TWslx35%ta1Tl~1eY<W|z`sSWKki#Ic
zFTj_5PQz*X>8%fT=1I(#$*!vT(b&Y#6wEnoo9|4YTfgVEax>VoIDh(b$j(K1#afZv
zf}_=Y1@B+0yDhFRA$Vm|Tz*QW;u6=iZwss+7;Me_7XNqV<##(wx32uPXLG8#myByf
z%%39ua}!(_Nlmiu-~A;iQN3UH@v*kAo}7y>UOAZg?~cu`s@E+aU$cElb`h9a@+5M(
ztpA6U$vtl6XXXT|c3->}_3YR|by<$Hy^!WaZ=YO=i2$GGm5eJ-i+cC&VE!?&UVcu(
zwjTNIi7y_^%3i1SK-J>kqj~yV^9w%ttV%I)bE<t9dZVZ5IJe;yaVwA2=k1@jPu2c%
zWLEaNoDWaK_Wb5!XZ)j9{&LPO7lA!YPsR6Lu$>pua_z>J!XFzpbX?><XY#32vBs(U
zMEUOL=amEIIdJFxnt!IE(!I3(5yz~}x@OgDfBw?m**|ZBR(46wPpPPzQ4JSfz{-Gi
z^<T0tyM^XCSZLgqSa|xW(%G7G!vBvsEL~S6G9`3=-M+F*yw_9hop{WmRK)T>?YCmC
z(@1#D&L8vP&*l?J^^x1=Y<#ttze1NMs?YJky4Z*%3fEYVi(h?ac-5<|gHd$L@669>
zU(;W0sO0+Z?_>SaXzt$^hc}*GnR4KkzI}hAz}+CTB`3cheez^}n91+&i*NniktMpt
z^S$=tCX<7k<fH;pcNzbkXPqg-nk4<xS25((1BsJcYE~qFGqNh$vfeLqs!Mu_iPf&?
zt1n(?`74}>P;Kiw?me$yXUqd(kIh@t4)JSGOOBEB-=tWUdj0Pao5lst%4%i4E#4md
zZJvGZT`9iqdY*aO!Fm6tGfaBtdyMsDUBfbm-E-WJiA+(yr0g|0Wl!iQSv`H>b-Qf3
zFKSpjFOTxvR&{BE7OOs+la=L7mmACl(%0PQR;%%u@91yae(ZJ&+w1-^K|jkLmsiG|
zTkfc|igoF(dg3ViKV|C0jR$`%yU_><c`4c0RE`$awm#-tKla^!YL)lp{=d@KE=H$J
z+8GvFsD1x%@<>JS?#_dsL@so!<^HCA(pBxR#j|}^?<?EL-P+i!=X*l<RdR%1l7ei%
z=dG3ted#7#&lLBy3hvt>!o9Knt(1+2v_#mO8s6H4n!CkCgYNxmWG<N_<F=Upj`w-3
z=!rhT8SS5Wo2PVF{V6}Tw>;BiW2ASy`^G6dH{M^lyr%S&X8hmJ^CeIDWR#eggUg9y
zN(_gT9=J*O?uzMI?O5`8-XH$G(}m6!^)WToJdm8gyrFmJhd)j6eR8L7WQZ*HeG|=K
zIb%YgRg~LdwG`)*C7$PJ-0ZhiT72>6c^g^N)_WV)mzmCfar;aqlg-k&xwn;OoC!WK
zTP8l``=nJ%^Y^rQd2Wo(5`NhDrS+4`ExXP2MtX~t-4-(>USr}0Ra%R|9WS@zNz8|o
z9F9Mnn!D<j+G>|~b7J&7L%&2P1@Bz+{r2otZUX7cH|)MJ$8)-}ZLhRD&+Mw#zJ=;b
zgdQqxFPvVg^TXtU;iY?pWr+@YI(jw#EX6D>W=#L|mSy{gg@GOM5h*f!izf3(9KJEH
z>i4v_!ONe7oRRQK(Vkcv=@VwgBX?w_)2f=hmA*ASzwW%y>D`@Z`L^fm{C#T8J((pk
z5sC^rOJHT#oflbN3UBT&^WF4os#mJ_JO-xC(=T2O^>JPN_}RwA!JF$1ZuGAXQ)>Nq
z|B03C?3K%#gM{|Y@YMbxb3om7DRX1u#E+J`dGoC-mx~=&3yj>b#nB^0Q2yc%+q_j$
zb#H3l-sL{>jBm2SuSehSA1~Xp;Na%gIrZz!rBXW#{q{FZ2(SI4nE6}s{_f)eij{0S
z*ZF_(ZI#RqU6QH#wVP+H6`!DhS+OLzBLr&uP37b;4tu%q@q@0OAJ<>)xcKzY%a$5@
zr*AK&Es@xg{DD7yvdBY)j|aV%2%f2W@sGiHliAFQTJ>eWFK`}hIeq_StEktcr%O(M
z6uP<BIeEVS9}i0o4N<X|f~j5;j`}LEE@}(aP?%R@x3(v%T+F%c;7MaX&X5=KCnhF2
zeQ<uCcY8_arY~pWy>>E$P2RP1^@bAyMHW+>X4XtNb};mLTj<pd+j19ddZbaj7}RYz
z1nPfJZ`dHYx~B2Mix*kH`m7yT9edPHD*vwYxtsO>+iCqj;`gUNnQ;4#`uu=JR>#zj
z`*QF3%_muU$z|1%)&oUR?hiZXvsN}mN4kkE+#&MYaKVoBi-#WjzAlW2JZ<noqQ<Dv
zR&3$!Ie%9#x%%2!VOi22(djMWjP_qnF7VCVc+k*^vy(TfWY>>bKTH$vHvHT8#Y<|5
zUFEu<sLGFD6-_3s?#K`jE9~a&bCfH2qZ~go38~Y;(Je2#KbyHz)K^kARz;G9DMdlR
zD21uu>+|_S>l_;9UCaJmBiUj%C#2w<h~`sE9kUr#dRu0ie7IwpZq}`$_rd>*)hv(f
z{lA*(i~Q@qJaCNLeo$D=dxG&4lPNLj6V3dNNfie@ZT$MWf=j`1UyX(HCH)GoJ7+uv
z|Ml7T-eY>UV)pSqMvJTOx%l;~KDIVZ7K&}E*NNy<jJ&;G|L}^_ReSsP_((0WD_Eu-
zEHC@!_^*r1>^l;IZmq9Na#;Uuxvs*S=q(N}@<KuB<?bpy=ETkgj~f;-IW1nyz0^B*
z&c_q?|K#~!nxh#Xu*=zbO4G9UuiQePo}YW)GJ9D@*Z!?1IOGk#I9B`EUU+?l^;W{#
zitn;fR)Ou48b4{<SM<k)%`z@tcH205MW^GIWg<7%{rx7rwrB4S=7vTl$y))EA>N$J
zK|Lw?c(dL!8x@S56~yIgW^>2CSZ8=8WEn?sv(VC+ay|Szo=lxyIx~^~w0-Q~+jDL`
zpA!5jG%$ERwAZ(br)90Y>~C>V0V&zog}sv__RM*q8Xr)gU6P~qCI9>**UHj8#$RJX
z=2rTb^13ZfSkB;Zv!Ouhlkzu%6D2vejEgV+J>KJ%{^xFni09|)&g~M-J@Yp`n{Bs8
zDZS6o)1dz#Q^@<g`?I2SQcA*3-+wo?Mu~T+0=t!#n?>ZAz}S+LpK^naPxe`UuWYly
z?*nbT8HbAJ{rG-oUH|9Lj5X)<Sqt3_qfEO0m<iVZ`*p8U?0U0LTg-h<4&&*N=8zSr
zIA%MvY`x&rWe3%sxmE8KIJ)oOZblU)lb;8jrPa%yd<-l4(Bku>vc*xq#7vC;?Jd#g
zyvuI=R50-@aGV}};jg4=ToYrjp_J>ECki~1RD0bH@<cfle=F9jTFL&qdEbeK&Ys`e
z<>%%tog6ZWCGw}msW~rxMtpH*d6vBV=j3bgwKLkw-X1AePY+Rc+sb6~t0>tx;^c;t
ze2MF7#LD$&oVTA?|J?qwh(xElz^a5x$!y=l%L;hcStKeTHIi4qY@D#oGqjTF;RQ8T
zr|B0bUh}>CDe1+fC+z&WbJ$;-9gY5&FCtL1US4ea{?F5Fq9*-(Uzq4{%J63H=NVaX
zswFFgLL_?JxV0pE*Lh0z8cnR&uud=i{c0(fn=LCiT8>n7Ueb6j5zff!w7NTjpW*lN
zwb5VA>ks6A6lXkPczC82-x|NLB~zRgjQ=nk+`7E)(fu8-7O}_w`j#1Nc=W0F7YRkv
zC7XPU1LuRsV?f=HSXPF_Z(6bnIa!MXr(c{XskQLjCG+_FPtB`)gEvf(IT`%1OXxyC
zzSBPz-nv;YFYT>67sSOXrhke}M4;>G31*($#?~o4ZqLtoo;Ca=w27@XzgSgc-sbX`
zLKmhe@FqKd%Wghsb0kzJ`o(P(3&ZE-2idh3E36ay_T1`V-&8igCt=raa$Q+kclSr-
z?=qLiH!|6zBYI~j#k7~s>T-0{3y|zuB;Qmoami=zSG6yPe@w~I{rq*M5T}0>q+|z`
zm{VmryeCVuo4%A-c=|=h(tRQlI+9y2ZTUBCVejOQjwvO_dUro#aBhk(TO4@dwZ6g}
zq4E`%R!4qdXJWf>Nb82jy2C0`z9CKvUb}Rk@723g`ggyo#gaI#cT=xC>ihG9nM>}$
z+#LrVeE2+l-#@LwZiVt1hg}6f9T}JK9F%^=o%*q2#d?*_oBg&zaZSOGmPRhowm6;o
z{@1b{ffqoXW{~@u``8XWazDPzcV2;{?9S)+tX8UdhJCCxcwA7iea*i|#+QCdESvSc
zB)qaZO>=9ZSEGx{oZs`0E7-<;{P6CsPSWK`n_eHt2w4&yZfkTtarvD~ta1XspS}uM
zn|&r-=uGCM;;AWG=PLgM-g8RKd2s06)9+P^?|%E+J-W`QS;R7-;r^%DuFISsObwf}
z+~j4u;6y#eeIFk@J#4aOUDuo{<tU}%d79bsyDFdBdAU4%!F{e<T_W<yBYxhi>*{j5
zq&|R#SV5)Xiwp&wx)PZHK8F`pZ~sS4l72ZW`3+aB-tup)Ov=XnQ~K>I^CJ1qX)L&9
zF;mn>wq>2YhW50=8Ml(O7q<R%KYgWh*R$7l$6p5QU1ONL#eg|qVC#jA?|nmiYA3xr
zQSKbA7A_(==~u{9Wu@)@a<AF>dvp^OiytXXs6SeLlKpr}c7~+wr^Ea@P46s^7ToaH
zpBU4w8yT|PFm7?9ho$YE_@AsTzJFE-e%pTW#r5TLCM`bG;^tny8dR9P3o{kiCSlcQ
zpg+}wF>HRZ8@G4gmM4Ytdn3f#*FJoxIgR=JjIT_5j2q@}&!3#Dw*BtSUbo5*E-bc7
zB;qDY>OQ@A+^8?_;KlmBbQ7<C)>X^;P8Lp@EoO7Qm!+n3g_+vvbrReUBFz`bcgmg>
zO}mj1D{^)Ee7OvvV>ea*eQiu|+jgwZsYI~&<_5VvDGpvI>QC?3I7#xN9P`P?e5aK5
z7am#fw|qt4hU8~GPpqUC%xY1MERHzl_+2Mz#SgB%E*S}BydnZ=ph0BNP$np^^0xTK
zANIbOamDo4pW>|jznTiw{(PDJK2$BP`01ta>P4qpMOWs2D)j8E>j~d@f?4_B6D!Sv
zI}<ne{q!<hd~xDUQ!(G^CqD^Jp7B`VjklHIvU4s|3)@%SVmiGlA;I<S!_G?~$6b_D
z4^7VB<2gg%@wLV5{6%fr_v_8?S-oEPTk>Lx_WgXLRe|vu(>27|qLM!Sebvsa_u#_+
z9#Mhr-&x_s=QJP7vpB?>bv)EODQ@-Dwf^2V-_I=%KOR0M+Tx>Dnsfa^*C9|J0Xnen
zc6=G*q4%fcINGNzy0{|yiR4t1i-r7N&8qe0o%bw0-ddfx=<&1akKVR!b8k))74Qq>
zJ^6R}$&4=%QHNhA7XDc({yzGzZFjVK&t<QymVV!iLSD6h7aP7m_lSFD=J$*z)3dkN
z?W)y^1x_>f9bs4b;i&oH#e^u$`Am&V`W8Jh3;N|;{`5JgX~d}??eiI?JiRcZDdefa
z6yxV}fBLLDAL9MItNeZ<YY6k#;77VlTkm9u?Z2a(8TLi}^xBAXM+Ni_U5&5nyRi4s
z-+M+<p#mO%6n*x+bn~0Ue6H@x!U}nD(>0r1L0*NApB=yBFk`Qm5J&qI4S`(-w=Y!O
zYth!%mC^BEe?k64)u#^^9zQtNd*@l#*)pH`-^y=(@LwD#qj31qncwfkKAo-lu<u8x
z!CQwj3lHYU?%&62wx-SOT+hZgTR1KSo%mPL;<3bO(ZSqF)0|TIwQ`$0{>}-THY4Iv
zaYWlS{l(T>n*UF%6g;)*jla8I0{?H$EllE!KY5<LEPf{R$auQEPXBxR-z`_#o6Z+p
zJIsF|Uz68B#QmO8U5o+OrSSfrYmfOp{<~A|i6++@)${Y?9qO!$TpC+sx}N#-iYduW
z3UgXvTd#fPUTDOpBj)O&f8gVq86{`<T2xQ>HhYP1#C8;Ii0pbD^6}A<*Vbou{O-H>
zeE#h0?WcSXx4(?5{Jv-B8Ahh|KL_{jP`W;IvzMQ4-_8en)(U6$H9p$1@*xNJyvkXk
zQRb^}&pq0C@!a-5Yt7C1q)&B3WvsruaL37W|M#Wcs}9e2e5So`;>8yW=UNBXnQc-z
z`0DWYr>sx@DJm+RHH>HXW8d;@lEW--saFQFtJZnnF})hqDYU!rhQM3?ndVAg{<qEF
zmgm{}Pd)u-N(FZxn*xhtWaFbC=OqRDcbD&4x9ysb$J3w>W;+9}&RfNPd1}{k`wfY;
zFZ#+v!~Xi&&IEVUL8XnJa?(SG2%{Gk8@}|o#R@WV-8l4U$+_!3J3blxlPEvgTB^Ld
z@86fp^O;VZk^B<6jL&ra>&Hb+k(ZyJ-eB?W5nt9uVGX|>k0w0{e!-to@3P<U?d{A|
zPCsLIJ`a^Y%2f}xAB?pY;w`@?ko<4ESdW`IkKB}}iyz#X!nFSQd-wi#(ZQz`9&L)t
zKeOYz-n*Bz?(^<`VLdEr)pGQzrF_J{p0^c_H{`!7h%pvTk_&E+vM*qmU8Wziz;Pc_
zm-wZR3xCbAezSUQ>g#747dKzj_}H-P*3KI*o{L=3tz4^a&%5A9uAFt7?~B_ii=S*+
z6#FU5U+?#YD4(QL@4xbIwc5?K`kyNkc$x<?Yp57H>&1zK?jiHCnzRxZU)(6ZjlceS
zOzF>mrdz+7m`<>Cu(JOdJ*$&N;6{#}m)|3c-OtWWJtVxJ>u$-VdWnf%`;_i30nJ8S
z?u}|Rp89#&^n`@`%N>c@_g<R*p2&VY`E0#XKJS#fq3?xG)*JtPJ*V94IrG^fzR6bc
z(L45L{S;+0Xb|Sz-gBvS<K6>xGgb<$?|1TettKS-XMN3yDg5g8yl3jSMf=TRJ}ki$
zbK&pIrt<<_!3>;M1zia<Z%+QP=fzR+N7n*kKkrie8s|2*Sj|hhUO3sqBJtY^-;`Vv
zx8m639=DfLz9AEZ=OUWjN89^UXW2Y-ntMASzhy`9wKGqYr23XU%V2q0CNn!gQ2BB#
z`?dAS!pcEgYTK5}+}gPK-ieLn0usr4V(z`}ee!G0{vJ2Ol8amyS*4z={`=|knOkY^
zq@;V?%=7bp`fvSmVd6yl46c_woCmI`&B|Q5{9vQvbwN{}>Zu_Qe!tSUOE!;co!spm
zR~c!qx@1q>gj>`0e-^9c$v7=?Y&PqBo1eVD6q%1pxjC1H6)jE;2v{lPGIdFm=gZ1z
z?<dBjaHt)u4e9Z^;ijc6bZ*H6!^w`HS9ITA?tfX(WcDkq9c<wo9H3r3cu);AAIo-V
zncMM1zj+$BlDq_d9okTMk^An%{Y^gVi!b(m6`N&Wx8G~o0xb=}K-O7@WD6gDKA#mV
zaXwf}VeRb1Z2_nFtDm)O&z-EkvGi{_^Q708^LEdae#fHWRQUYzPWATwjpC&pUwy1x
zcP@P1Yw}~7Wun@SCjm;O8yk$Qgbq21s9a~W-E#0x@#~h4C%<^?D*k?z+5VklWlm{>
z=eLK)S=SwSk}xl)_d?gl*>^3HBw`O5vHIFhcr)c&po4DBLhI$d&wR9v?k#-9^6b-u
zrMlBO#9Vf&d#`_gB(u3bvPf{D<G=kk>~gbWziI@r|IBPw&ejs;z83iQoY582Wo=>G
zem=Vr{5iCz2{OOe3>wExzRa{Rdq!<)*V=%SS^IzJSX8z|+DSRSoWQfYQ2CtF_fslv
zEv{0g^_Cmv|J~jrD=c66d&<d$3%|_RRQ^1-N_1iD8}q~Sq#k)a6*e+cd(XSpqw&fT
zrFBcT)J~crVRkWc*Q>+dzdB7woVL;7hI3RBV`|BgnUmd)r&w4ERvOsoP7z{u&YJ%v
z#lb_{vNs}CtGjV|*d$5*n7V^=!uXSHBwnh#ZGLuXCjXso4e^RK4H5ObLU-;F<P5L-
zVV9Nosr7*~%d2HVfre8b?tO8hYgPl#Y@LM{-4+MLKRykeeDCdBcc?+Yd#X<8EeDGu
z`-~)4eSN@gDD>r-rpX-Z3Lg855gFBovse%F+t?hQ_jz6o)5n&(1z)dp9s6k#?dl$1
zQ?TphlE<7kE_7TGS;f;Cva#Rg1oLa<#TRFB7Amn$o22u~QCYi+&-%ndmmr~aW;d>y
zycSQ)YgxMV%EEt%-HZG@9?E~@RAhJZ6xzhh`g4oW^{#vQ+IL$5j+Z!`_<Vj<v4rGI
zLq8GA59<%k@l=f~P?Is}KBt)-&=Bz7WtxhdfJn}*JN6Y*x1~?{yfapQ`Sxqh&A!op
zZ#5L_M!|>ROXeB~1gZA)HS@OAub=QFuJ)W{@%$g=IxY&)uPtrQxl6fvZCzX+^eHOA
zc#_Hm&l{4H&!@y|NX+Ew<KOz=X5Och0ue$?2e&Mopr9_`CHw2`hle4z5_4;d%op9C
z!S{C3Yl-ShRx7@2`|x1C&y=(EyH=;1e57mlf9Ci5hci-7|FLPjVD<jw|C;|7*|(H@
zI+*6@enjt){E{mZr5AecwAuP+Zk$GP&(vda3$pgGJpTIF$<I58jpOF77fa<T<CIv#
z&uF|_74bXw{u{T&vsbxEtnS+Wi<={QAEeO^Dv8&<afrBe$KrzS;;$^O@v6o-5@~9_
z!6~hWazZ0yO0Q+|Tv4pbC|I}Q(46L*_Pfj()k};c`VObL@EJ-lC-A=O5nGa|6{k9r
z$-g2h%kbvjlWJ97%kSNC&Dry1>%320Pg)*d^WEXJ{e8~g*%x1UAMbHX>|7b(zHZ)m
z*Z*(%E*L#BU3!{#k5^`ltI4UZlv$5|T=?{+T|VOPO?8LeyDBGt<Zmy3d&{)EugLC`
zc#`aW?wJ!JL)`1Q0)skw+=7?3UCN!TCg=Z7dFv!ufsZfvddn5Mlm0$v%s6_|)g^PD
zlh~fB0O>Wp%ByF*cpT2w%D$^>qeN={UhwqKENRf%mBba7+}u|;S<HR2cDmFzohS*h
z)#ojRpL%`vI5{`-;*`^=6ZUTsf576Sv{Lob#d`O5(bw1OH${tyOU_l_JC`xFcv=$M
z%y-GpbsryBP1##4dRyUC?@H%mlRWp&oWDIUwe_35(~Uztk9PElPjEW-+<AY-8uLXl
zFYjL57G)Pc@r{3HS&q{QpH~}&?i?`K7dfl(VVP9h%U4qttMSj+a4=iw%Jfo!>4xFT
zJSW3B+YEn7zSWt(@U4-Q@7$?U4TcNP3agw*-0AUTe^XDVTIXqvw+kZn=gc(lJLml3
z>dEB?N;l;wu4!^RtK+u#Pt-xrM^m#lX<d@K^6bjK<w34|Epp)b|GR5n83~A)TJ^2S
zNmh%w{XP3ePu|HT>p5+jC$;%8$u2z;#i0K5P3oFg#pkCaEYh(%F<HmXtNgj-<ZBC=
zwm9BROup&l{`$=CchB}mY%7SK@5JE~Kf!S4UN?0gtqCbjpZykg&tb0as*V5q@_5Oa
ztki?X{@HIf*sV|Ek{4Md@UBnCNnFY}+3@OquSK?Hi%ra@oxdV4FD1{qO!MY^p%+qL
z`(xar<hT1t94|d2eo7<lj_w)p_Jf>`eJr{jwNodYF8BJNyx#76=W(f;owwHS`*FGB
z#q;@BKcB2Glu7+$oT_g9^Vn-sms8Q)CK{d5%^fAm&mAN8{hGCU{ezaTMZeZ6+Avt|
zNndzGMS4Mkvi0NIQ{E{iQcvsM?r|7*sjXI8t2i}x0c3U)lvdo_ix)R;czN;SNnw%B
znmb`d=TG?-)cv0%`TdUMnWzIcDPk#H7QOF|+Z=y>PJ)Bw|BJ~}&Mo_$=CVIjevkSw
z=fKPlHi>KH!*u*Bzh7qTxOd3bR>JJno6G-?ugjN94u5xd=XpP=-lD^2bH87S-gV^o
zbd9bvtq!y1=sx+eA@$I#BJSAkoI`7;)GPHZO;~V;>(8;0mj0&o5%RIeoZcN))%cnF
zs`%dCggPzH`D)R6fwwe&I_>0`JbT8^DSk7SPM&$0`AM12?5=(6iB6Mdy%LdpBs1G)
z&6kuXN1h0BY)ldKzqMgeUe-Ddp@4=<A<_ojf4&|3+Ij2DdEo+u_pOzuf2ecT-F+~n
zV&|XFy&umkR1=Lo8gW?5zlW_Cyb26FFqc!MP$J1us@_$3Y-8b$<8qesUN~MY*~Jv`
zXkUyc|H<1wj_U855U=QB_*hJSqoJKq>`Dh&HbqJ4n82a}v8QQs`GTZaFLocwd~i-k
zx>w1e)s@A+kX3iV$AdG2g5#C4QYO9IQSPqQB6jV|&!WWd=?@}$BUh;l><)}~da=|i
za>k{l#mylyOSb*ZzP_qhC?)FBXH~YyixNMZo;;nb^7E&E>CyAS6BT!s+Se97pF6iu
zqcG@s_6J_3doRSFmUEd(e6DBwIl1xUkF-*?hq8tO8b@b12KZ#}l)KP7Sy3ZEzRmpQ
zbnD+GajOsZyS{8?SYo$`ja}CA*`M@z$CyO?Lym^*=vptu+k%+?1TA7}zP06Kd@56m
zbC)ECWLNg2#|z3&9;$npy<WvPW{0`!g@81x?YCAaC4Td7`+a9$zKog3V%NNP#`~r{
z5O^+n%Wh{gf9ztJIc^7gc5=^&77|>@8hPSM@1z~mZ)b#r%|FHLAky2<KY2sv@9M7$
zp6Qze&9%(QRCu!6+2ZNthB?M|u0hh_g8SVwR9Ea+vwV}xPqT|(9<kj$@H6KS8|V3X
zP3oDfi#%#}ohec4+2hptM`V%cx^MPHwqIWT@i<sIRjPya?WX#+KlcUC)XiSx6XP22
zH>&Lyq|N}X=+k20aGq*r#iu0~FPT@C*#F-CpMWK6x!9!F8DT0*W6w_O)m$R6HK}cP
zu4aOf@4|^eTI}2J_C#e)+_R4<uH$pNVr5m<ysrOBUpxi1)-<$-{E`<EsIAgbl2^U|
z@}RGDq)T!Sf0H)ngN3s{-FQ6Z*ohDRGLfqGMirj-lXu>{q$NBlfAY+r7NfNfJ{@8|
z^mXP_iwQg5v`*W9SNm+5__p+AQ+!{vGkyq2RaIXnf5G1F))VP<m*>ojs^r$F<5qYw
zxA}ppu$bVSRFhK?i^Dp0UvaH2c<fep=)ol?!)5VN*WE5oy|__SWHPrp`&)Qd^~EWk
zmed2iu7X_Wc~{HmKXy-cQaGf$<BGjSuy&Wyls4z|G^_OY+wY&qw+LK(F;srv`s%zE
zYo&i5ULBYq{BUBTy{=e|`T4)QcoYQ-CgrKVVopiWS-CQAogC}gRfhV>A32?wHkj)+
zRm{KOd}5EJm8QNIf8x&z2|J_~+U=?-{mJ<()9hLBB#+sG2d11l5R<WIs+ostgGRcO
z!@B(7=@~sMmCUc?+;aRJ_v-oKMQ465eEd=8%afJc?;TmH5iM1hGI9QdtZ&Nv|Kk3e
z?F`uJRIhn<<56j`q!JSWDOuYW86_n%rH!XHeo&d-Xdva#l(<8i_3(r}GqRQB`vuk1
z`WU386awFV>i2%g;T5i))?+jMpQp#m3b(~8>Q8E}5q-b!@D5qu+8$TaOBo_*kLN`j
zCwSHIAFaNqaP!W8n`;Y{Ieu@je`bDXmjCX@VJ_YlE^7a3M0`S3=lV@x%=C24%UaTK
z`1!H+`9Y?Y%D*DK*8gbw;(6?w(}oFqLU$VcSlY1DOU1fQ_Q0&x&Qm>Zi);F0_WnB6
zx1GOIC8)gFQ|F^f%%T@9D_^^_F4ayn@+>KIoKc`=xAAvY_D^1=3f96WzM+RLi&m-5
zp6E1}A%BmhOmk1)x`U!dQl+5LVMrU#q2kkp!iv}LE=2#kHoHF6n8&B9Xp&}t&5T=K
zCoR5wD!jff%+u}eq)SSN_{{e!q;^eIaFhI~E*<ca?Z}mhe<#<LtWec))B8X3&A*-5
z=U*1Cvfxsake*}TV!lMyb0HW1FVT(0orybEvON*#_L!{9RCrT*{lg&TIIWqFqMB}8
zuer;9>~VL)^bc=Sn)*)el34L$OKX;=_)UW!?OChl-TtH6D|p84-h&lVE-(A8nXZpl
zs^FTZcV<DBs^5tx%P0RaTOM=ICAg`HVflt>Vo7TzRmA^UpVDG%wXKGCwZ&A!LpoQl
zr<Rm});NNCX98kzuGuDC`=36H-R)=cuy>p7%*7g=v#T?nF}%Eya-pxf_U;bnhLtbv
z&KL)YX|nu1d6GF$Z`=0;SB)S4oWRf*QNE|#QA?po`unex3#p#l-PbEmYv{4~Fv-km
zUaKF+WD&7n&zlxZXnMMJal2J@<(oOCllje7&M?fL^-hUz-kig2e^O1VoST!Ryi7yR
zpDSs9_QqHAXS)o?U!jBiVlnELQ&VEHzV3DqTdwMp^uj;wQ-Gza`o@@N#~yy&XLR#4
z$OGW{AGs1xb;G+h!+2Bfim>#1D>T)%Xl`AXsu`lgB48rMRp8ae($rB=eeH3QY=-!?
z%>92ZXMFh@KDnst7enR;?rxKd7xRuQ>DEY|Z#Q-qe5CoK<AM9C-37gxmp*jHIN#dQ
z_O~f+iv1^PdGWSWT~{Wy)`hQ#J``RoE?o8Fz5>VO?;Q-?9kYUbEmdnxZ3?EeZmr;I
zGkkF=VgEB`*IP_ZDyFe2h2nb6m9w6><et9dwB|Lh*xAf#Z*Ifr&K*8{Vp$VUTi0><
zZO(agUHHrd9=~;qjHPma8d<?w85cjwH{afJGWIEZi!)2h&DE?sCu*ABHDCXCo4!@_
zv2@KQ|9#zF552|y$zS5MOpBOP@%E}vy~<_QISMcIpNcr8&wXR-k-*&@X(AaFRC@Z{
zg6oUq&MUw4U|sZds`yiW4wsWZRAaj1-zoljRGs-Q!GXd0seQ|5FRk|z1AVSNy*Kky
z`NK&Z3~u5pCiqvG@@}zgkNxRnEY)jtV%6o_n==ycyzZ{=Z}B=|P`T<?rBeDQmLmD<
zf3|s=URYDOV#lc$77Kh&FJ1szwCLy#niaUais{gs&`U2Yb|@(1NS0jj-Inw2xy`Qv
zzoVY@OIXCt@*Z1TEAlzN=)C%F{Y;at`o*6ZCa>3994NBqiQu)b|EImw_tV^bW@*Uw
z?N@?k)I7L-Qq9KRGBhMW^4^q!i=Vi9Kfm;J%l2`6c3e1w(M%-4P_%dJnG=kG1r~ZP
z42p+xwAMX7ac{3xh@V07ya`v>Pgb4kRXJ(<TtVq^<;`9<&YTOT2m1LA#6`s4d(A8M
z_(;7;;yv#jQnBkMIUaA+<p&Q}LC0^>*bf;!Jhtjh!}UimcC4zi@S4_Bkz=say+nEu
z@Au1JY9?(Hzkf>kxZ#ZDTMo>ba8mHfftfi9F~5D~pL+f|o3Z8l?GnyUmlg{9n;B&E
zE6&%g7QA#|iDYcYnW~G0UP?QI_9UOuz3Q|>ICyQ%`t4zxw%>J1z40gE@1cB_4|1+m
z?&tn_3iM5XuzF76`MI76-Opd22uk-qpr3lr`0cmoXQj0<K?YK$mzVrn=s4%3P1ZS)
z<7<VFd4D<msgJ=X#q-<sr5)L?uXUO}u`&ucWxvzu(UeNP8AtWMIt1!0?LLy4ClgXA
zw95_DngdOV#JU}?=UKOc;c8U$RC9r6>k7q7C-{iVZ8|AF>EnZSvVI;nTP~c}?B`v(
zq^r8Nv{&fLyo(tj9s(=cq|5LAVqW2(yv(%ZH6sr%+br*STDKSJ2Cv=eb?kgxP3lUY
z`a||#*kxLO25dU}<HEVQua4$!$e)~iYR=@1ZUK|c{1oF~DSA$jm)h|8;rxb-a~rs7
zdanGMeKaHFq5_Lhk?zB4k+|;HymyVZRVO~b<Xy5PCnvc?CMs}>3uqA(XmoYmB!)vh
zp=>WK_H6pfq-gqUj&Ztu#r<Q7%^B005B|`9#DBM;VAh?_l{(dbufE#s$L+t+H6V8G
z#xqWhTwQ%0&sH_FY~hnTpJ6ifiQnqyA2%GFI-ljm>L=aJSD85{ygML%Fede!3csMm
z;~J%cnlOP=5;L9uIwvOU7^vQyxTP-PFq@d*<xlf@COw{awENL}!CpRVrBAxy_1`$B
zbD23gURJJlPAZ+_bkZ}aVM&Vpws{je%s>CD{*l_~-*8_<C185Z!h@I8e1*5xoz;9^
z#JgT6wH3C*Ay$>KCAFdNFiVSTkg(osi<i6nOv7W0wmDn79pdPFE+%6%r|R?mLv|k&
zYs=T1uY2)tzwO^G{~z!F^um5i?e8zQ^M4k{x-Fh<e%eLFOsbV7Xy)BJCoU;<M6}#!
z)l`ja)tIb$_4IX{_pO1R5r3DjjTUL%_v!Dwrs7h+ORu>nERUO&KkY^dgFfHQ=qr!+
zAK&A!KVCH__yl{CZug58kNSXXhn~-m{qu-hMoiJr)VFJo&c=xc?WNog?*FsTjz{lb
z)e8atMoY!>3s^1%_G~$E`k~e1`D{kp{9k_;Ke~NN@lLmpSx-T2OYmNVkU-|dkHwD-
zex4FZU;FP%@=2r9)qCZ{UK)g~Q&0-Z`v1!KwpL}*@h_Ptzj|Je)4kkRdjA`5w`q9X
zs*Vr2!r5Ddw(p&qa?tN=y2+^sH35!ij?FdOw!Hjwa<Sy6?RyeWR_1Srp7bo*sxJJ$
z>P^98Gelk=`F4_Bq5Vep<Ow!TrlB2|d(2Yp>!Z5AMl)9_c#3||eO%8mRm5ICLu2B+
z^MBY2TYrchsi~J*_b>O>7w@SX&w>}y&ytQk+tc@7A}CNWJg-8VxkM)FjDv^y%3qv?
zsXX0V?k#l8R9gM*vwx$*+J39WMUNjit`X+m_h9DoNyjD26RUkY7}cXL{@X0KLwsi8
zoz~~#?<NL^w4PR#m$Kj$Hk*7=L*7o3^MXj#t+s>Blh*EGnC+9AZd+1+C(lb;t?AM=
z&c}Rtw<J9LJ!YQinv&Aq(k-teyQ-)B(*K?1H!p3lXB1M5cG5jKdzIT0o?R+OCP^Os
z>0j=vXY^yax1NnfN0P2%j7xHqgY+Mnn3@eWB?>05tmO7|959)vRkiWXsjspuGxmaF
z2UM7+s-20M*<j#2mC;JfSRm=^%GpIy-wr)GvU<Hh)P*LG>=%utuMGs(u9n*P{&(np
zSz9jq59Kv0e)|7QKN_8XZpZ7g(rH1z7B^_cl^kgjW$o$b$U1f3-Ru98p6d5WyC(HT
zPUzh6N9XwS4J}O_Cmpw52~%T!`Oo)heFvMQ>=eabxt{s55&QX81O%xX&6Tn!on(1_
z+PXl^c8=zQciHtNHS2Dx`KrvA*B9I?erX}sqKtZ-#9(%ncm1*%Caz6xpO3r^Gg_vd
zyicR|+VNZ2ixtF<xtwhH=pK^i`pJb+BcnuT56GL~M96eVY{kK&&3&OqJ)2Kdz5ZRl
zI@<Hg(hcX{+BxxdTc@9!QTROf_w_4kcQpeQA3670?OpWoc`(xpk2U+}M5WpP3eZZ|
z|HIoN{Bq*1sp&T+UHGr#wm9o7>){t~d&+MZys-W_Z-#HH*@-6$52+lmJX6=Sp#9j2
zGoA*E4~E~j%vQ5r|3A-Rll)YT$~v`#SViFj1(!Zgo_jog-I=QEoaS=HD;dscc20e7
z%lWOR;gjm8%}kMt7dbx9ni9>slHrD55vW-U8ht(unoAUxjn)-7lsS3*`z=qN%Kfo@
zwr8{Zc57`-=Dc-sk}a(7>?Zs3>}+BQ|8U;2-)_r}<Mq#NK0Rph*3bJBIn}@_X{!<|
z|6A^3arOlaVRKHbHS&7sH@D5RBXDu~ol}>4J?&KfS?$=bSMzVDPMqnCeGQBZiu>kT
zCO=IzZ~7x4Cdd={&?H0O$2b4d+mmWnoD7uHI-l52-}mj*`>zj<M|<qmXkRKUx>|z4
zwatX1P5WMLdue9dI=1~`e*zEM=hRJE=UJ@Zd$4B4tnDgw#x)DyI6N<S8y>ImH}zJo
z`R0goPo<(b+eCdq-UYSdPdh}+dU0dcWc6ibI~(5_DX=_Im@FX9#lhn05#jXj$hw`y
z%kEZ9F7uP>y;O6;?u>BOQPFTO<|Vqq8curM)jw1Ab%}Fi_WluG*&DO(Lrj9g?=y;p
ze0x|PNh{ZU47;T-`k5oDWrbC5c@bZs%%A?%VH;mQ&%NCg&2x738_o$A8ctcr*BO6Z
zTpK(kmh+|T`y&M_6EiO8c1ONR|2gHwhPhXM-r8_3eVsR}WqAGP#?Sv(?z8rN{;5>u
zxpDoyeRtg!Yo!Z4(iRTizeulmF{JG@y>Y{i3mZ+<{RQ+F>e(?p3Yv0A_gUBWYE@y5
z$!?49^eg!qNUjjQzT&d>Pkk-z345L_mHV;jle^J-!AR4ZZ7a;roDlqI{@%Xdch57g
zyW1~{tlAd6F(&co7g@K(6KsA(`zcKM|K!y7s`f_P$_eZKew%&e+-kdD4v#xTIE5Qu
z*WKIK`&A%V@{jjSi4^v5WoP#vZy9{&^-qz{*s>_QIh!qXLtcvLG{20~iNf;?YaYKj
zFDfeCo8_|k%xO~wrZX{a?$Fg*=29H9<z(B#wv}lIirD{gy3YS%`?J&M3lGit{l2|Z
z>C9)5fae$1&ApSiso2t4VV_0tzpIrmwe`=}uUZ`>!y0~2uK0P+%Y)9Pk3y##9}f*T
zmHD=e)7Vbx+L|ujCGp!I<b}pLy~?|@YbB%c1IB61(#}PHk0m;rK5$>1m>@LA^`>xn
zq@U<X!xYy(tIfL3*=Lj{=`>aKsGR7ybt$}hlFSUtZ+Bapu1nS(=9$(o;l#(SMUOWq
z)+o>TrLy0`RQmJNJh|Apx9Z<+uf18aA#d`Y`jpR$Wju~V*WX(Ao@=?|;>Dm238-ha
zQ9(h5i%IpA&y8P`)kS0{?oE)^aoc(KNa?aUCI`ACIHvCI*nDor=kuvN{u|m4Kfiah
zJ7W4*z6BEVn5-8vUXrqUdrfcUV#bFN+fMBhEf$aRxyZlJWy`)d>XvV(>1|@`jdfeu
zdUt-Ju#o(rgbfm`@9Y1s?w-26*=Wtj&9>a)4sBa@c4>R8o4#wQTkzxfwxmVxW9(K$
zNT^(x??3f4L;1A`#h9P}cITvanCK+!J^X!<$OHw=_QOrng?<{caJ_!gWbnfK)QK6~
z=RS)EJ~LghsI}q3ix)=VZkF3|6@j$%n;ec$Ts~Dq>S5r@+rc6mf{xlNR2DtYR?v8+
zwY^8y_rF|yvHrYUy)$j|j?~BOWO8havlGxOnV__I<@%zFpU<o9&RzQ8Z2hOsAFks2
zFU00dn`3;0tu4nP&00N1Z^N1JAHV(t%;)M@)Ba(0&-WRX=jV2K<RpF2S!%^JKZP@k
zFW}vjJ##n;o-u!a)cNY>{vOtU7w>si8+_8#IeSDcoR7Kj)~u2;*M`=2)4tRgvN^G&
zo4!{1!kTw{M!SC7x{Grb_BrfRV@oVu`{DcgQx+3BB9A?ly0gduvTqdB;0<SVh+umW
zQMJe9>oRG>B^MvWc#2(<U81w>nbyfE;-6ZRVg&jgotrK6qgCquN2W;!E5nRtOjL2Z
zyL<8}iTx|ee*9a^pK;=d5le4hp;27Olx_RBnVp^~EX{GT@DoqvqkvrxUal*aub)!s
zx<})yUea`hm-7=8r)}OWUzhM_srcWW6>gt?>z<ss_Yikc_g9A{vFln24xXr-%HA;d
z*5`y+S+2Nq8-AQLk5Qi}_IzH!r>*fd$1Y}Eo#r${>&N83fvnC8PV7<tznJgIPJa&f
z)7xX5yTv$q`}7ur%8(2N9oamYz%DkeqtOw2E<{=W?ThZ;ez@%*v+5>8;T^v&_bb}w
z9p?-RpMC$%aXHRvqs_|;z22R8{CLf;2ewat^yc38)1JI;@2qn{s{T)YR;)g67hC^0
zsQFMcpXNG++lvo6)cZ+X6l%T@`hLH*r-97^mlf+Xgk`zc&swb)Z@xg@N$*i~qPv6s
z({6?D{IkX8#7gXm`4#2ACwkKF4|87?-?LdJ^*{6*`!SQ#%WLY@3=W@*O6LeRO4#J_
z_{RP+-RQ}`6zi3>n7X`Xc!*A(BW2B#++zH0A9HmC@2_VnPd;g0-*D<ui$nS9U7!)V
z>L(H$-JG)STlnH7#lOF}ou#&58|T{%6)Sgs+H}QkMM~Cemr(C@{yRVZlD)iaQ|E&p
z4yg@G9VR+IHF+c0=DTZM@P^W>jt?5&EbqOp{jt`jd)rmE@?%fjSd3op+ub>RNuh|y
z!a~8v!T0`kp6i~*W~H=srJ|UN{)3ki+doJ<2K}0x<{jbfkvFI2@z<^g&lk&G|Jd~8
zvSH^$K@Hx+npI1_TA594m6o(k&Azll^t612Kw#m)&37LexBR*>|1+m>Ge>8U_R}iw
zcP}5F|Ku}I;)2?gneZIQc4(UW@oB#E3VL^Mu(i4|%Pu}oGT8Td`iBz630LY)#+GKV
zr<!<w{H68m%eVEh%EJHWOw;}9*KdERMKbN1iJxa*{ht3ny!AvZ6;#;TV!ppM*Qm%S
zpOaq4eR;`?<<Fd-F>IZ5pINLb^5;A2CF0Z0l;5go4Tu*$b+7YOs>|NRAGM;I<q~+p
z#rOYU@=~6=*QADxVe+aotZpI6uQ=W)n>kxP@%B`b>0J!kP?YDk^r*>Go|cO%X7!3n
zPSTR9O%*r!IBWHmpu6vMSleZ+&pq+nW3r<{XUC$dC5$U=CaZ6n3K~lW6*YI)-b!(J
z;l-F}+$Xr}!*dn0<lj?HK2p8w)6TxQe1XDicC$6@%;~lT`L-tW_-CxtpJM%c%Chn&
z$K_w_IIU^$=ppC1hbF>e8|N_oEXYc%(XQk2GoB^E6T4uGl#<^gbLSM-taK@_i{A^x
zj+z(!$~C{N(6z=rd|^hwymjjiT__B`T43kg!51{E?)uv!MGG#jeerjjP1Glmo6@`d
zHe{Y`p4d~nNqX&UOa4PSiqS70Kb?J*%g=a?%)Q<0!n1D7bkp}LFN~0>k323Prept2
z$oZ1~!nMDaG8_3csZM|T@b2#a9yZ&0<jt2kTQdjkyt;s?;lhiE3`yBoP$TW)NBP4K
z<WKoXoN~CaW6k~>Wvv=!EYn1eevJ5bOS|Qzwq2vo(d4yNUvuk@ST2~6cwI8bDRnWE
z^Cr>ke+GNDzxeq);$bAu`-$uwmrkh2y^?>N?)Bk1vuNP2=ovSa)%fOgpP&CP$d`vL
z=E=0!nMEh3h44zAtNfxUIaw{<yJ6R+@3&9#ADO!M#q8FNfgG94&t`koZD=ol>tu80
zes-63j!CEZ#~Vw<->>Rl5Ry_8W7558>cV|9zuy;L#8Gcs(lMXy!5ImT?^ljbyP&L9
zA1>K@sOZm^12L=DxCAflbS!!m9G!0eNnw$az4Mu>4|eA^+Z^YJZJsU1)C*b^0oj6l
zhN0!=YMzD-n@(+irv4(L`KaplPl>iVd27C(_lU}Cs+>_!u%4g&lIivx$3HjD-NET*
zcJZ#gR`0dR(+rpl&i>F;pK$Jg#K|uQ?AvY^wjB{GsTN9?vTbE^Qae&Ht>i?=+W&bC
zdz=-{Tu9wj`p4oaSI&H!PUcI^r%s<-BJ$5A+ezvX@4I>S{pUj47(TMf)~<^?H+B7w
z37i#k3ZLhmblrF71FzR>=asjO@^r2<+p8MPpZUBY=o`m`6)#I%|4j?ow`PKx{Phr1
z>G$`~tBSAakC$ZFV_{wQ##Q#k+bcKKbW_6W|7nUFOO^U94*YtgY5Jyhp3_d7E_rlC
z%*hVanS%BlxtR|YIUHZ)_ayr7N%uR#!U-3QycEhm?74HXnf>Mbo<@Ot!m~Y#h1pJQ
z7TnufcTwWx5@Emnf2Unh`y^VoYIXAEL(g|*ras(!m+$>e;Sc@0Ytjx2$a%IeKW$={
zd$MYQZ22ptT_KIdpZGlO<}OZjoy;S>WWByk?HktTnQJai{U6R8x#835M!QRMH>Z8_
z<a&1U_Kc##rH-|(^7qU(wrO{*<(^k*^>{VI!vpsIH+NSA{<Hmg%0OGl>e(LI<({F_
zjD0HFT#pH+h8X{!xqL>*6{S<g_Us2%_lPg+ar?Q|DPQ2Cemcj#jmM`R&)9O*;T+V<
zv2MrTI7GzViMYb`aNqmzLTNAIG~q|`ywhIfe2LDJuwc-x|6|<zP~FVH#B<rQ-%f(!
z3ujt22{5}AvD}S5zw7_JEB{p3wIrKf9<)e|Kg73up{N_XXJa}mTV98!)}aK&yH!OS
zddi&_O}T#J$+_!l*CjPuax$MR);2ZSv}@D#J?e6kzjdE#SJ8O(eAdPCg$ff6v~;x|
zIidb<)~94SwzaPW@(R*#8KtV8`Z^&v^NQ>0wY%KYr@cS$tJEr*qu}W7_Xp<3XqjwU
zq>;B)-N#LSt1+w3rAfOU&5irCws7aB>m6b&PN3+8G@`f}4jDNdSL#=q;&<q5VX&+K
zcfc=||L-3DxAyC4+;k!(ePZOn9obW?tDkJ0a;5nv*RBAb7ACW$yA(GZdG!3*tH7K?
z{UO>fD(=kEj%Mn=Ai-oQzb5-a?v_a=Qg=;qG9rBPT7wj_K3o-<zBi#%DpmaNcI*2(
z@)c`ToNxWfI<THW;?IYlmsz>Qy!cg2g2Y9y=T<1$oB!F6lNoU)!h*kXuEzOYe4np8
zd2Q{PyX<lJzm1*K_lY<w$A&B{j%bZto6~-%xkm8b`dRIXQFZzmHat6GVgm1rT3-Zp
zx<JL(>KP3iHW_746}IAAzeXc2TAX!FvHe`zABz4OHrtQhNh#LupZ$MV{_jTzPD;pa
z|N5n@ZJ(EAYg6ka-r!qO_c}EN^Z!l$pV-B}>Pi2Vf5O(W2Md#?`!Ozj!07&OgT?QK
zzgbtL99(#}*Yf|Ilts*C%PuXLG;fjhGQUJtxr{$c=67qiShO!OS6e%;rdh>SrQG?i
z^XaG6hb*Th?zy6Ryi|3^CG$mxvq~mAr`pdvs$X(lUpz*X_uZNd$JCh)o1;>eO%w|d
zn;F(yzjlFIY_VvcX~~wNv-<U)OV6ae=+66;!Z$rTL3)Nk_DoJ_iM4SD$iH(g6jrzj
zp3gS4)#$EyGJVbwj|}VPvKKk_>!LWt7k<6?R&saVs_nt%XE_vPEG=bbOlc^1kRo3q
z`ekp#vdL@27yVDM)oM|wFbETwsgZp7oaE(Xg)1&f#mye(D-YVs8R@u6J>B14_T~cD
zz5W?TSjt5EKGjL8oe}!|?oqIipSOVD(*OT=B>jB<mH*jCgS!tGKV!aL&Z3`bp1CvY
zdn@Pjf4>uT)xJ91WZkG4leXIaH_KKrFO}sg)r&Y^t$Xru$L8tx)gA=Z6>=!Al(_v$
ziBb8YF7vfV#oCU)Q>I?LXlh|C02)OFMeW6lcW!tn$jp=de2Po9Ta07ru?)BFpSFzA
z4dyS?CcO#bcUu^=i_3rc*?!;q^?wrog&%q9x=l|;kuBuio8U0{J8QH9=E?29A(ish
zy!M96;>>fME_+R<$n2f#Fk_FVYhyb*TmOwZqbU*}Oapqg_lFCl&8u0SAUa`xy|1qA
z;YZqU1un>5jQF>Di&tCem2Gc>)wR?6btY`!t3A0gHK$!>fAEVchdW|5r}(GsOPaT6
z-kF}GHJZl*;|<@4@5@_~eC%g{W~F}AMWrJ7NeldZt{eESx|~{5Wpw&Z#^Q@kE6=~k
zC^4~`C4IJc9aDor^;BVVF;%k_!u`7|5B=J)+tuIu?rUQy_0MiCjz$*_XjR?2R(F?O
zw$1g~;z_whU!u9r2sC}#ulG42!^Ojyh56VoA>|q-zf}8<UsHJaERVQHe+uG{JeLqY
z`PPvI3--7bRkdugmuUWa`j7hj1dlTf*B5+NUvY-j;hp@+YES7Krt!5C&waSDPxi0w
zSJO=4sBEsyKbNyPZdBm<vHjKGdnX!V>h>hn*xgpUnz12RyfescLr$U~`{Fn6xo`VN
zp4M0}X=hlK_0NqC_PGnBjbBJ~-{`SON?OwPJS@n~UAouI`YY%J6-b1JG6+l)v=ZyT
zsPRbRazM$ci%X8*d2nf-exdXFb*C*(`ES2FLse<(Ql)<Z$tM1yZ9A?6v~yi~V0odo
zeM{3Bq3ljC?mw3|e_SSgbg7hdv*OFM-7EQL2D&Z2v+VdUMJ0a&snWR_7bSSMB=;?H
z^Gy;x>i27r=fmk2SL=i-R9=$$xniN_*2j;YNb(*1H|t~YD>uKTdGT*wJ&@(PKJhKz
ztMipl4$e8|`bv13e9siOn}QebS1+>f{vc8}??S$ORRL>J!QPVB`imE5SKJmmWC_|b
z1D>|#WNlGj8&$kLD>PN`&c?*Mibs9;^LG5y?-T!Y@5%mKx-BLd9o>wFD)x94H<ZLG
zN&icIWIs!E$vmBOCfyU84b3Wex_CD>CQf8DW|(wytwp{-p2*jQnn#n)eYu@?O|nZj
zwleFMZmfjH)Gz9x0!$*y4X?2GuHIO7{Y|9LoL9FL@|(>9lYYJ6;61+ZrqGU{43`(0
zSGUMrkT_#GlR?D^G)D6F;Hx)JfAij5;!)6`s^7RpV*aXS&L_WLfBmXKqk7j0t_$`%
zZ4T@g&Hw($>#<Ci-(O>^T~X5D@)a_u<uO&<sxKqj@RP}k#b3`=O?>zF_xk-^H!su(
zuxZMK?YNsB$oTr>68RI$_4eJE;C!(_g+0aOWB=mY6}vKgm#T#xJ8W_OMn;Hml8N>)
zx5XA07(~A)iTyUX=cyxA`}2(ImRB`jOh3+j#Nw=HW3MW}FOeh>k@8%*`a4tmfrwLI
zSXB))&m8Jya#G_txGnzM+wSE-^*8s||DJM^@kgr3DXX<7KHl6kTS#GN0#k9(L5|>!
zTb3TK{M%5+p!+{GI`g&8^otk4OYJ~q3V5gF;s%4{tv2SDY&7HR?#QZ_?^D~Ed8u^n
zlII1*`ild7yC+I0+Sjf<qMClL*O{%?^8cMBo%YSGyodO&EZn$J_VO~npW)97ru)A-
z+$VWCu=hsG-4)lCigQXoag_`WtUB;uq0{C^lcra1xuJdO|4A9Oo+WALQX2pMa+}m8
z(<CRu_e5E3`7?vemq+B>;)7+3R}^?h^&K`{W^w!jgL0#rp4`5GeKBc2gTg%wq+Bb{
zRoZ%oq%4@2ZEB!+MT_~;2ZsY!OctNM6Y<GyG4to?Ga)lGpfZH*P@1cI*$Ka9-TpqF
zJkJZKS8iV*{K`yf|B(fJ8&^0Uv`BOkeRn;P^QBWz;{nUOgUKPy^%4ENa)t_tao&5^
z7;vg7B?#3k3$)H<lwcFTdF18Pw$JMCn*_a7^-S7}br#q1bSSYt?v>mZyvL-{wdmf-
z<K1s-CNSRg@=J)A^ZSPKj^7zB20CoVE=MTLJ@#?o3E4pJ^bdK8iB9)T_q(q+zxm)T
zixPw8#ZLr|{qRyW%SsaX=W~nW;zORr*Ft%pKUU>!I&I{z>~!cUx5ZNx;=h5qW1w*n
zP!q=C22bf5z5ga!%#XKPSY3L&ywh=O#xXtp4-uy_N*uSVn`*UjrvDL1k+iJ87TU|v
z?bY+(;98sQ&y>vH_VBsoznayO&pUxZSjn5su$|4mire%|o8Qv?-kVrj6!hNDI#X-+
zU(HhO_(S1ie@!(fe%yFjca3a7?NiBa3F-3}6S<enyp*EW($_XW{ms!uM?8u&A7?j5
zy6iQLJn<n-Q2Oe5O+y2{FSf@VCrf_OzW>@c-q2;%<qQ#-sSamdR$CrVEs?2O1WJA8
zpw#E)9-io6v1pT#_f$;*r{>7jtrsUwJ6+B9-cIf7nH|5sNyuLGFW^ed7P^tZCL$*`
z^Ta93BTM@n54|X5d1-8<7J5gf;ovpd;N==0`S<Y5Q##q>c%%QAecrFBxdC>jA6K0=
z^%Xz%O)A);=F&9I!omadx92_OcHMK=w4Bc=yW@KTQ*b=XrFfshNna;a9)8qv+FI$t
z#*PPKpQUZ|TaBN)C>b~AJY5qsORk|Sj7KTRGnL<8VOx^%<T**HO%q+!Jc?H>2+sdE
z{ogi*7e-cm*>(z`eO{1ATFs!a<dlHyYQNPdPBiMC?^S4b`!|E7dwbaY;$PDWlW&}w
zlNhl?u;lWGg+fy<Y?@^5&?Dv4ne*%I3BefKpuH<ym<r_e9fSB;&n}<hCVojw^LdTM
z#{Sh_&t^vKyzsZfZF}N{@;|*i62Srt%ifD0HI*pM65{{0s6E(P`QXQ?7dd%m9(U;A
zT<b9}o%QB~6hQ^y4J{18{s-BnZDE_|^m|3vr1h)c{8+kvkBr#Hk1cYglVqlq`*Nt*
zOB(oSEVM8^$l;@8KdF=H$J6Z(3wQSPDMzt@PZ3$X7&Hccim&DAiQdp$ZiYi*PVQE&
z-`7X4=G<8EdPkpZ+1Z&#ugQn$c&}4dZz}7Wov!xw{9OI4{oCGO*ZCA-UvOZB@uhF8
z7O)m)cLbg(pXkTflqAhOdBe%6S~_t{HXYltcwKDUyP&)|4f4D*Zz;AoJlcF}+2P&g
z?K1o4wEpFfSG}(}-O=x?Z-e>gdDj2aO@19se{+6wL9y>!e|0T2hd2Doj;+~U{EWx!
zq3!IdE;ip_{+!+nht_az)1=a!XL?=xpv(V3E93>l?5#e%Qi#-EJL|OdqLUiYN^b7I
z%x->Je(?qC+e20xwm-PJe5&y|X3N(Hj`2FV%u(OoBi~(jb%vw+^<RvCe;OP-R54k~
zqA>Jl;>}B6|L%V}U+8s&%CzRPQybJ1|LT0&n<HVf;b8cY{q1u%R!roX5mYW}Hp9fu
z)!QY6<wnBJ9r{zeooeT8T;HQ6wB3K+lBrMLXz;Gi-v6>$hL`11`Kf%~MQ4vq0Ufp#
za`9708n{&y>*mg!Xc&H(Iq~+XFz%Mc=k0PI8v9>0uat}Xd$Rqc?_>Qe|7?w*evkZT
zvD<sC{{Ek2ZE$ycrH`qG#1|QX)Tg`i!{^sVovwZ&lD}})r1cEfbEOP<JSWt7%rX%F
z{$u^6pF!5i-@8=T*w}PNaQu?v-6eJ6&({x$Keq;OY?yIGi^ER2>C<k99Jy}xHEL|v
z>+Y&&nsnuy*y`Avaphdq&2^TWZ_c04DZ%k^bLg&w(=~hare}M&&UVZ#nhGtGLHV8S
z&@@N)Z!GhpidS~`A3t`Gd3o7On`d{7m*1^<yli3f>*F`7<Rbnrx0>>K=j8RftKKc<
zzgTr@GuQl5o$!(riT-=uPxdifJ(0(A;-dfQ`#fKLcYJyD<lk)f@a|<U%_p0Ffes%E
z^RW=!d9FqM?4mUcb9m>S{1mtTbg5d{pNPi4N{cV*DXfUoGm}~?9lBJW<I#8PzkSh}
zy31Z~P2JNJqjx=kF%hkxof699VDaw}-|gi-e0LXKT5zO&@p;>3MyG#nzp`IC9yfA0
zeszA$lKxqJzMJGb*pCD~J<!HGMWgWB{a&}u;PaDLF4*QT^ylK2DWBE{I$LgfqCY1#
zA#j#o__sRit({XZNdGZkd{OjtsnN!Z8p=&MN{mk0dedL4T-)H)v91y{ivcQ7&i1+;
zuMY_gd$#@)o0F^Hwr5UPE&11r_tt&1*pT=3RC!hA<s+;0<!}Fs`4@0H<C~UqiObhn
zpI<old{gX8d@-p$-AGhrQ|{`S6S`zVPOJ8(uHQeaXK{ej;jZ#~rz%0G-H30~T+nY9
zRJ$-Tjl<Gn-Mm-9qW-Hg;!*<&{x;O*IH|k*<*w}Hnq#x0FxhAMkF$MNi$ggY^rmP3
z=ww(3U4*l%r|&Fl%gxgcH$JIe68`PG`(@k4=kxFWNS?-Tm9)MojO|cwX8pTIa(A1r
z^J&E!<=E;uDPQ@2@<MFZ<sR$&$^G0pD@C7vdLO@gn(Ho~V!48k-TE@hTXy-Lnw~ym
zLI78oM^(bP4;7X_7*i#=L)>ig8+!y~+&!l{=&2b_V(7GA5@GkJLB#th<GP=(xO0*x
zvb_ECvS@2s|IB5_5p7awZuUc)T#jo=_U`HulYKd1&YhpL=FDbLPrPyH-QB)FADFu&
z7fNlG+cW*Zv1IEx|LTuht4*`95p+NMgRM`{Q6};RS5NEFlh@0GrazmuF}aA%;6xYO
z9Op;EZxWr97YAOk2@6^%;vN5XXR6QF8K2MjMa`IG{$qDl+tt%n*=h!zl4sf)nP07P
zOR$-(;yL|vsL0hlXF&NHv@1(*@#2OJSHoU29O4oV-zfT#^ZG@%-PQkW1h{K?PKyZ%
zKC}7c(DhpEdxc#7`T5&&(*6k9&zPmHe{zxbq>n2$I9ho>Ui&3lul_Y}XLaI42M)gm
z*EsF;?OL2)bB;!utYn{bUtx>&j!flU_nXq^9ooqDa3Z6<s^_GD`8MaCoV&j6*Mq&g
zCWbcXUDGexTDUXDHMUuM*7PGieV~Q)pfo5VAXY2M(Y<li`87urg$r)kmir0Im3?FW
z&N1`LkJS5iJmDe?J07hypH$t{Vf5KW?#Nuz*{?i29vroP!f0HZ#iwAixyW(*x>Kbt
zb9i2tWWK7Iw(pnG?<MnE-8E)^U{^Zz=sn+}{6AGM0xI-R&X^!sem{_J?L58dy>9H=
zJ*R=n4)BhM-acQxmfYKES{GL6T-><Ivezy4$oEF`_Of>_bF(KEo_e|czR#0p788k_
zJFd_BGt1Sy9_)J`p7|>Or}X-^<p!mmvo&5<i|e2I=d`5cN+|F8`p#W*j&$@bFP`!D
z!{3wpf`6X6aP{QRp4}_<ik+-;$ro9lq$eex`|7OuBVq5y8tOZfZ;31u=&W78^V6lG
z7k^52#vEp8fvkK4H)Nh2d&cCnD&}J0l9Ow1cJ;X2;QTFo>GN!rHTAcbNc~J-CbHl2
zdJN<KjhXRpv&t?%YVp>aFl|Tr#U|mZg{kZJ7kycte1g6HShP8>w32N8&)Mr)Bc5tC
zeRqhz*1F(;LG2PBgH@4J+%C_lSZNlrW8)Mj*;u`B(3uG9ex3sNnL%Z%+wuCIoZDvQ
zN0)@JyJG<gA=@|Q73bwPUjA}BFY05N{+^(QU6J4K#~!%YaZ5brYTZB2J*EF9_iq;c
z;c}3>d$xP1;@Q7DvYv8EZt>gqO)Ii9Ptv?i<HY{S&!;LfwVY_bBAkA=T%2Q-*tHK1
zd*^(9(d=20Q!`UKcHN~Fg1NIhejyGP(qiCvtmR)Kb939v;~cS9(?ibf`o8Y&=jZ>*
zo)p+9Z{PB~n{`XixjoPMEQ|eK*7%;QEtnpt@OuZ}+bx@ZJ?1~K+1YxV|GPUcTjKI+
z|L?O3z2&Z6x=ZQB1dRy{iuwoDtZa%)=FBS>d-e2{zg<hz^gUmgBz*X_Ub9ZQc=4%L
z`;*RtqM|=n7aTB#%$2$?Uc9<MK}WkpM}(udW}$KMx90EX>OXaMhQ~>5TXZ5<);`SV
z=$||J?tO0}4ff|9F$nsaZeJ0f*x2=Xx81QR3dgPG?rNIW9lvtYbb9O>(MRlxK|Bc+
z7lo^I6$)-2;k5cYe|zp>el`)8oFf~iTz;_O)8@=y{MTN*D4H7CSmPT8>MmZq2wI@S
zc4%@;=vr=B-j<m>v0v_g6yG}k^MzWeb&Ka31x&6|zFzY&a)ZR&%I|MEN(vNaPvDZS
zmzpp`D&V>8KaX>=X1wyN8tl%bHC@!W!FHmtK>b&dX?TeWi_@yba$hE%tNs&cCTP=9
z&8ztJmk*cT;>D+*N(D`v%h}tf8xI*|NLA3`FERNfyIw7(O7Mp8Kg)MbW%lc07^U9M
zGS2>Dx%_na=NAW?7bpnUELvt-yHBF_o#aE!`}IHMifebQ^{~(Jx!A1rT%vDg@Wzmo
zKj&r|A9{2}Z*FPQg3N{U540Y5@<@Ew<8I?^e=XOTB+dlw;JUuSYsQAAQ>TjDj$exe
z6(tuhrYh)Um6-f^8p6tGU?|rVaVc5&VD9@xtv3!YxUO5fv;A7O-g}R-rf>dLT}JNT
zmtTCbx7_U06oZnRrqyD{pYQ(|Hc9uy%J2ny!X~*bE?vCp&s-_l=)|2dhd~t&C>MY;
zBB+rxd2zC(y1&kwZz^J%KkEDJw0VzZRAtQwnZG3KYW3ckr>r-X^EXysNH{eoxUyku
ze2tVCXnd~dVPwpezcbzDX}!~NIj@~RL74A#R*LIPk-lXoghf(1Ca(B?ZRLB=u#KK{
z@1csbA&{sA+x#zC<Wu;rGc7BbTD<CeCNO-T^V;XTra8azv>%%GI`PM@P2GE+tGjzw
zx$uLxa|~_mZnZTsr@R*0<+l9(tyY1bzwFL`m;SH!;X}wPW(zLHMUr9j0~=qyxMdf=
zX~lvLksoV+f0MrEIWORR)@rTk7cV|tm8Bv8&hqY{CV41>K-&5u#zWggRW1Lue}2Ae
zUwrbWrh@jJr&sacOI@b7_4X`%`}XPIu3z)}d;ROjka;%A69f(`wJn;&`*7nASMl!^
zaqh`q{IrGF?|Rd|)H~ux(iYEq;xXH+@5MZncT)Yk;@9j7&RMRNJFonEY+c47XMACC
z;p(kZFJ63_rFX^{x;%RE;?)caI&LK<0*5SD?tf^Q_UB)RoX<_i&XdpeDtEHKw$H!s
zwxWus<wW+T37p-*c{{#6IM%DP?)7bTJK;O-U$rjh?Q+!iXgxLm#^wyiw#nyHJ~Xp&
z+<6zdqrrr`ucqR=UXtRpeV>Ai&K_cU@oB;0)e%`4uH6O;AxGhu@6upS%w7@3*)sL$
z)jyu{YB%3y@Bi1efR*jriN=PBPDU(E5(_K8I#${*5-?)4_}y52jsHb?#rM3GStn;Y
zF#Qr)dE6i|g6E>(>A3pVwH4KDo21GgR_=a&K3VX=naVt`Me#q*1lz=RZ=GM;vyz9;
zq%eF{*3sMfa(A`}S_dq8Zk(2&@ui8Q;$QZILP^<J*F2M3Qk~~O2?KPBGut7fN5=w}
zi}qgBIHqg8%-8c}9m{&*Zt-u5JOR6IHZ9-1?8)xM?0g$K<<7N~J{P^9AmW}<qqCk<
ze4}V;l>VB0DXSTxpVY5(&D2T_1noA>Xij_+@Na(iyn3^p=^HjKRGqqZ4zp)-n$Yx%
z7w<&mneI8!c;W6Uc$Q-<(cx2=^Zm$v*OK<Kocm@Qmwo%}Z*V*2?@9OB?)^y>`aL%o
zE8c8QyimUJ(Q?WC_v?P9zFW-STFMh1q2izP<>vCG?BCYyixF<#Q*tRo#9#c&u?nS$
zkB;1!@8RI%xYcN9vHB+YB_?@4*4fXVk(qMNfMcq6eC^JEzHes~9@kal1uZy=$TM9u
zY2C#x9n&MAGfBZI_xPd43!zWk76<3;@%uLKL-ZwvwuT=m`cJn+|2t~8CF9(V&)4Q0
zx7<{&Z@uRIeRH2X56`SD*uP_`aQ`&s*Vi_dKHZ(K-s@IxTf*Vk@6q|=$BeTYvT?`5
zb*s0kFITZOt~j7m^DQ&i^`6bQePKH0Hakvj?&&j=V*NI2TiXtJMWvx2b9Y<rCbyk^
z!Hc8K1(e>cT>t5Xzx~tsvu6Lkad^MXjq~$f6j_!Z$O}0s!1zBvD$;U8p00A`%DL%x
z>$mT+%@pSC_EBkCW-`g>_>9vTTdaS-kKfHU`|^g4Zypvbeap_67#UhTzsSBdbe-`9
zP5;QhFOR!1O+O7fQ)o>p^l*`kyb@8+Wb2=X4O@Sox)8`|I&qDISp2-Z27*WTwb~~C
z^mF~g9POFM;jrVw&b&1WzmDGgIHS_*!fn&^vP&5v{1Rf4VLko+dN#99$fevdd>kD-
z$JWpC&s)&B(NDu_BG0l^L&|^9u&gLw%hUG0wNe~2dHz(s7F*F-(E6u(lJJku*VcMX
zKA(B9^V;#SIZlU_7B>_%-88I~3Q94W$fPP@9>^GXDWl~5rK5{Z%`p@*onHQ=|BdVW
z7fpGwsZNiJcAnZ0ebsc$&qB~N;+F-BcV0|YuvwX^kP~xu&+l)|rLz+@Jlz|2e!u$M
znTt#p{d}}`#*qha7D?{kz|oo6#lKndh?SIM_@1xFwt1SS>}&2gqvWOHBH{Dv)RkVD
zjX(CEKdHIJP?e<=bP9Ko+wq4}*LtXcdPSgNmg$Wfd@gP@z2A~3s$497?Cq!bol{TG
zT5lKrhGp-9#Mp1f-kl5A*Do;(WSA$Uwxv15Ws9BByMs=f^f*><SnrO}n|={84hlY|
z(@0?66D@g#H9J2Enb<1ueqH}??)n!UJC2{*aoRx4V%y)H2W6-1=tyRd+>>!gRorFm
zys0UH39*}tpOri)xS4J1+n_i7^otuwCxuITpRG(%w*r;Spg^B%qhRxP3!8UAYKhF<
zZC~#hD8AFJ|7;q$Ut^zsXv@DuZ7C^>!YLQeDDv-e=wx&;c#<!2Kt4>T`)#yH<ih{k
zYIerxO}8ytun&BkFF5PC7bgodC2A~AKKdf8#+YU8NnN(D`E}QiPhdQ}?4zvp1+T8p
z&$qC=oEX|6&y!|w$m!_K&9`@SpUY>>KmHVyE?Suvg13f(rdncs`CFd3F(!VKy86gf
zYeCY}rN7t8U&w#_ps`v^PeCg{`%|swwI$i>jvN*~xS{k*{Vq_bZF~wkr!~*S>X!2H
z7cZ<B6-=!9tkxP?^Ul-Bn^SmP*N5TX#EKRDC6_-Wo{<#GyuJMN(;`XP_V6&C)oXl0
zPd6bBFyn1;JN{-#`KJqoIlqfD*j0_{?ry*T;eMt6pV?Cm{ZD_-S8%y4iGinhwN~N1
zh2|VhYj)ob30-Y+aqBs`xtukZ>N)C9ZQlIS(|gi|LV10KGwppZG)ngDlV)vsQPJZi
z@XR{T(lf}O<6_{8h}Ui<A_Di+W&1CGxL?}dH)+ZB{epedYfrcJIk}g(xR<aT`gbeh
zfLX~DmAy?Hl=EEN^IY7!`|ecSe0Qee^(sb1bFWFCzBz-Hy119bFdnK|?%7!LLc>$_
z?eT|Qube^ZOTI*fu6FF`bLi-s#M1JjqYs2C%-6CjS_w&6c?G$)zhG4~UzA+`;zaKY
zj+Q$S1sNePG(6ist~`|qQmRpMhP~w|<H8Gpm-havOtSCGuRX5<a*9re^k&AyLWdQ)
zI|C=(bC|&|dvT)lMM2q%8|7O*J?C7wc!{(I>!BKu86ABuUTl4pH*=X!`rmgVrV1if
zUY8ce*S^RADW52P(UAYpcc<eFq6-%<S>?Pqa`QrEt3}FIT(ZJ{xj8O=lweURnZnX?
zr=u@*p|bg+WL1uff?8feR$jBh8wFsNe*C5I<k+I!MndLZv)1o&>*#X=dp?HWsf5Le
zQ+Da4-9{%b2+D#i6qFTK$ay<?*~^K{AQ@@qhZC+mSbRZHcBi21#XwtyKNoKu*A-v*
zSd72d>xBlRqE!*tIa#J0n{8)Ed#A;FzR);Zs4B2X*=o^ZY0En+_yoi*2y&<vE;jLh
ztoUfD)=QB47yI|U;AnYKF^g^S=9a!7$B!i)5#r{HK=$mnP|(Rc$=)*QLSS^>yfz!w
ziyyavoqLy;<Ko9R7gng0gm`{5aj&_x(7r^(e37!1SlMF*m*d5o-8495LodrDA8T1D
zcf0pRM_=6PMat&y=0#WAtNq!)3Ub4$D1N7sCvGJ!?(=1)vL|Ylm}Gl7xnC7IY}(Kc
zj{A<jR}6|)yR?-#WkW-3IbPp|hO4r`B4q(DAuA?DP~b08wz4zg*jbp#*Xt!@b<M<`
z0~*rWjvam8+{trP7AE@&)@O(5<+-?*Y<bbq7pvfMJeA4G^U<+Yk0kaQLV|6vf8Xx;
zYh%ByiCL!S>2!S2F_S;=SO{-2kQeZpbYbHHiC;6@`@}$zvr|xZw?jwY@@E%TsJ!eq
zV{rmygC}kalf^kMel)Q((egB1n5_AH$HnZ>5*PQYyEn?U+}XjfaEbog@apn8m$z+W
zDX`dG<@Kg`PTnt0>utg>UI$MvJ^ggmqc*m-1S`{;Oa6Zjvz=RBk+!5;>d(jZX6Lj@
zM8MvC{7J#ZeY(1eXXIan3uhnC`0%wv1RU{?l?7f&32ci~nY3iith;-em17qyzHo5?
zI7#F^i;_2=TgvFSDI;Xkl)KsvklfYLcSnLL(WYb%KZmMk=H}Mh=862^#5GY`l>On?
z+7k0`YflSLQc-YmFFDf*$}^K4JNleAf(!}#yjaZ`6r^7!D}$m!E=pmFit3m9zxTgA
z{j`%06h;>V9cJ7qxwgCE!c$JqpfKM9Ee|gQzL@bGRG6%r+PC<$@T4WBO#)!0g0dG2
zi`RTz7<s*JZB_7_sS{O}Zs`{4lLlqgi+wVAHF7N<pVg~(yA@ATF}?kIYg^wPupg@A
zS`J>=xIM!}-80CH1CncY3UXZh81QDQr}rcsDN(C5uv&+XzV@v3K4FuVgh6xq3{I!K
zIa~s2s-9U=i(rM5!kHzHLspA>22ENLdw<)+ym{av#N<Us-|Wjw%beU5&iGGiFc7j@
zqzp>#iym8YJeJj8Qs=syL)8-+swaA1NU$a<l*mL)R}Y$`lDqzy3^?W%UnrCmSoHYC
zCzqf}OB7D-2z;TD=W_fzlcH6hp8pb6&#Xs}oZJgRdDZdwQ^ym%!MbrOnx2z>r8};W
z29+nuR{z)p7A+R<RMF&aalUOAtY6~8A$wiWYSH5)1()Odwt}LC>CjtCresjQ21UGi
zUf%9^Nn8KDSu$O!%XRUjB~#*<p_#5EM5JY-+>wsHcG1QFNP&B&qwmfN4G!jok0W%X
zrm8$O+2XtG7bq8iic5}*g=|iqK|!@j96JSNTl=awI4-}O!Q%u<ik@GW%6e5sG2OTT
zlHp=$k)P0aJgT~1$TP^TcDMDEPg@ivK&7OUJ8P6U$Hj}F<Y32fc%d>l;VN6@z1#Kf
zXP&5B$rg|of;k%sCWgIrD*;y{v5bc*IxMbk)4v^m<=^u{b8mIeOQKuAHO9}Af!<95
zvd_I0c(!wydrfKpC#BZD=ZuP0a@n1?^CPXiCe2amVSdxR8{{y}g~|ep9&da-tzF*A
zYZBAf)VH97?c%=h@h`^{y_!#)-90Y_%-T3*z9Fb&0mUy<B9m;p=tunvRb@{+CT-&v
z>1pp{1EtrUg0klEyWa(sSJ}!QzqE#_^o0gE`cL$}(6G0>*K8nV#WpMJbmP9TsY|9T
z`(^cD;o|k77eS6F6lilgo~&Ea-ZyE=rG;Cbn|bqq47?cV@PqSZ#Vf7N3l}e06Ejc3
zJ2D=WPEYhQ9pZOB{yoA(s~J=;-pK$(NZ@M*MRUGX_sAC-o}3CgyH`#L1S#(5V>;ww
zCD#z}LPK-$zPo-)k0gW2r92n++<(_gpYQbzeqnK~ts~_^V2~Wg<AusrQlL_c<<Q@M
z(``eQtk`DjN{L!|d1Yz66}<<~5Iik?8~q$KN~TP?@<U7jlJ2=U?r&W8Tcu=AaitTR
ztg33MhOgG=3xcw|poGq(X!Y(pa}I~BYHCSFdA->49fF`DnYHEpb@|tB)77U;S|6(V
z^=;m&uk*bGtrkH7M%baFPg%h0g+}U?>2G6Rcl*}EDuEX}er~&Ouce@!$8(`@)mriW
zEqy^wsnu_G?Y!pkq61tEoalY7(9_;`zJ$r?<buUhuEb<}-8s?wV#hv5_mV533Oy}-
z+r>atq^jxEvUR4qAWyrv=dn1I{JB*+@9w1ap-ZRmnM#A(951p%OIVyrN-CY4+*6;5
zJUk@}4scNM^jG1@v5jVNC->WP$}Zja=2=uLw3>35;pyJ(rYczya%<7WD1B3VuYF;z
z?s+DlLgWAY@81m{UMjI+TBuSIBE<3hv_g+LH@J{3eCp~b!7uyxZrRb`P$4U=r8}o-
zvw#b=7ae``*J(RQ@W{UZCf4g^^kT)FW0&Nz&+<S5SPJCAEg2yoJsZ=S!KwbDplqXn
zEPv|ry+3|WZt1g{a`%+u2~fp*r=#yRyQ0-D8%0kx*<dL<8IFt4N?{#;%N+~mg(?e^
zgO*2~x3cquhUSi+|MD(49iQyFc+!*Xt4sQ}&Rh5PM<%49=W@JSfUR0r_TtBNtLG(6
zYU$JT-Ri>nqw{44G+z{c{(E}*a@T^6K1Q)J=bLu%|M@&8T`1J@y;C}W3OKSfN^IB@
z_cTaf{22Y+h~x3shbo?Ivd38+L2a+>&=L`WIB~1K((Ma4cLq+nU|3hFG_wqpw!w|Q
z7Z%scG+!QdcK38TzA)#1#yL=Nscgl?asP(aoeD1|MJq2Mt9#deT>$w7q-zF~Q^}s!
yUR)0^1Wqb>wd=OW*19NA8of2Kx$ngf@qWg@+MekuR~Z->7(8A5T-G@yGywn$L<led

diff --git a/frontend/editor/public/og_images/auto-split-pages.png b/frontend/editor/public/og_images/auto-split-pages.png
deleted file mode 100644
index 6929078e7c4dd78b6ca91360bcb815c5a81e76b3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 59845
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H;Q6PZ!6K3dT3r8Pn&K
z%N+Q)cea<x)zc4E8kgu!*v93;%)+9eu%Tkx6}_C=4c`*pI`3?9dl;aSVX=b4>-ILL
z$k};w)pjbChn{~r>34oZ<KBk9cJlYlKmL99n_FDP^H=%J9~IiCceS^3GW>`)Zke>?
z|D8jN7qc)(IC%ygxTZCA`PZuTmpvI86sM@L=Hw<NX`kOeca93f0Rc9jNhQ0Z?w<O*
z>9((f14w>l+-lowlT&f}jEszJ0h5;edXlnR!|${al>7DN%d$Y8oJ1dx*^}yK&aAwb
z!}sei3j>Rcljo#&G5hxH-dI>yHjSa7!CAvIsP1dl9bFa%XARFwcX#d-UwiGt9~(vn
z#`b_oORBH0-+%9p3|~7Z1BXS+Bo))Vdw<fog&72jIaED&+1u~mzIQG|!witt=GNA~
zbLX-!90A!Or>FPt<EK<6hC_S{RZfc4Ree@tWM~VRB(mY^#EI_S-t~K{r!#<T<ht?d
z#f!&JpDzCU7aS5?vvuFp{Fnfdi!d|$mXiAP^g%}^2A+i~N6(0D+w|ti=jULRK?gQ{
z{1`T^w7*Y?A%R2HlkxY*OG}r3t$P2%0&3M(uT*##dQD;~gM}d^h~F%adK<Yo@LLrp
zgF(xrB@I{A)o;5NMooiq*ZTWz?M_PIW;`I^H7V)a=QC$Mrxjm#ug(DCGnJ*6m6azy
z{_{o$YS*7rqR|{+A8wC-{w!`w)HVT-lQlES*T+`x-DxSqCk%1r?()ZNkihP`o&WiB
z_3hgb3uoNjUz%N?t`0G8Gdnl;{`c?H7&=Z0cuo3JQ26nD_<A9RmQ)T^&ut$r-`>v2
zz+}`iNo8$ck4;q6uRYtRgWV;v;p)YU$4{R={{Fr?$X6<@cMqKdg&ruH4{X}FQC(X*
z-mcCE>=dpDGrN1IHobe8$OMXspaXR~DmG3{-TU}43&<l&8rFtt`M>_Uey$%>{+gQF
zwoiNBlnH~A6(~Hnwt|_D!q#7%XDapd`g%@~r#%^?=g-O#Kbje-26hB%PHok$SP|xE
z4p7?FOe;@IpKm_9xz66PqJDF^oS*N~YWe@}dG`-3xj5Bv`;KX;WpAf$JS{dewwjsS
zWhJxJL^WXt$5#PIy8J|rUVUwKVyiOWw|5(uluDCseg4<7`}tW_ML8AAIg@MbKUbbk
zmFJLt$~V7q-se9@PVQc}PF?(*d06PR)MfD=ej*N4idB|XfmNB$zA>;Uwg@<Jl=sTV
z$H(QF&6HqpkeT6o>^8eLpI+>YS6|oP{r~HAhlhUb)*Qj3inYc(5DhQxWvThOh%qU!
z$z7RqYQ9O|Bp;P$^}o+H&$<j#@oky!ygLgnN9u^FSuikkpLA(ATY1nW<Lot$&4SUb
z2bh}#oH!I)UIs7cn$ya_usAM$XNBF;=^0D&`OO0v{W(FB0$I<`X0KYC%EZ91A;ND>
zq~}G|qW<+9%k!r)K2UVzP;3!6^yb0^_UU?t;Y<uW*4*{psml3!^JWPKIZ=?O6wgF%
zc#s$?%gnH&VcoN5CP$wKaUL@HnLhXIdI<&&Cx2ll4#hLv+|_lT)rz$k8iFTEw`T4v
zSt>sFr_8_WmU~SndCvd#jn6mg-KGz{tIdyIxe}LhD9L0Nmp6aw`g`9#uhRYLI+d-t
zkr5n(D?4;*Du0_5voSFIy}iBK?*DQI(;2chtA1Ydouz%^fAF`OZ|4uXiM+D5o;l^^
zi#N06eidIZH@5sPI>k7B!D>tYrRE1#Uzh&(y)*E1+uF`+>-QBsF57(b3<EfrrnCea
zMJ87KSZ!S{!H`gK$1+CMfp^-uc^CiwGTkflUqOd^u5a^8_TS5WkM|j9POe^XX4ml(
z4?b?rI6r|``qr1n`_$6Y$`*c|m2IAPd)-Rg{^eT*TP6uPaVYjoI(_=uy4=by9kn_P
z4X>_h$HX?5)N7jSHTerHtNHakdB4v7$grXx$CozOo!z>6#*{$yHyeF7NpFA0A>87=
zIy>k36VXtE28Agr1e`b~wyyP`XTWgag66DWb6*D;Jl$M>C3~m0V<oGiZF+@X9{be=
zj}>(0+1>2)zZ|=(CUp1uis&_IN2|Urnt$zVlz^Rm&R2hJrQ}JMPOV-Qzb7ZnX2Gdb
zXEdKIv2|eY=Js06_T`57<Y#4NWt_q-yuIbQ*JIY~KE%)zun3e?vX*W#Qd;!(WiT6q
z1lKKvdhx3XZC>9NJTp<QU|(1^B|r9;oYz5qw#2dm1!*(2$t#!q$vAN)b&7MJjD5G$
z$9v7k&nQlrcx}FE;wdNg?&|8V#p3HX#Ko6=uux{<baIlNpR`v&$?D{znapy6prrM%
zY^F}&${TOj-g*6e@`3;lTkif9S7pzh<zYC$f9puGEAKn`@2;=^R`)!RZDDs(i#dDS
zUG{`J$IIJkhYu$htm*7nDE8>(4bNgN{`n;W6<2!yG*5W(?&ZQ<Pp`9Ut;;TosVcMZ
zIBh-}R2s6q&il`;6Fa&NtJ^$slLRL<iKkCRm8Yv~i)Py0i>jZ$hvELE1r4VbIGnS!
z(<;BA8?sV^+xjINH-jBZfh+H&T7$j0YeDY#qG|5krNLCmrg*Z=y{KziJ#SHT>v6w%
zi86eAiA9bY7JbbZnjOHo()!6Jm8nJBw`*NKUmd?7{$xhIm)-HSpOw4M@87pRztqVo
zJX>2>fI*<eG+Ozro3io`R>iZ^F671>cU@rM_~XgV?gyNke=b*eeq?3$t@~v+Y8wO`
zI}||S=I*oAM{Iq_n;^~1*ZQ~bZ&$dme$MS*(p|rq|K52sxAWs?>!laJl$97T#PBpt
zxb!Z{QSR{r!IqNNGx?o`SL&G96U*W>Q!gF&O#VBAS99iXTV0NqC$xLlTYP`N>(^@Y
z`THwUw?$Me`|(uU{9o<Le`(IbOHIKU=+BAd`CGnDf3^6P{kN03e|hguy2zOKbJ<Zg
zmH@F`d6P^TI1cUow`%$Hx^$NJ3TGsZe-(wPwa)+GD6#LDpXtQeizdChSD#`av7%tx
zn;V(szCUhhTx&m=v8Vd|#gmu!r)F?3JM;JAx0%jW78h>4?Ob`se1oy+?B5pYck9;~
zYZrYw&8A~f{7&h+e{|ISDPeNIQ)5kHyNok$J-RFT`v<$CEl=j}SIl`^SFYS^k-%7M
zzo!4XZtj=&PS+Pj?LYFw(*B+Png!eQHmr_$`A_a$>?1e*OXbyn!<2O^zC4-vcKet4
z+1mv`VSB%O?f$#>ysW;>6n+qGa%z9m?O(->qK=Ihjb`rNH}j*TW4f`?m)KYyh6h&^
z&dj!WclIzlC|Q`iYuYBf@|T+mhjW_F*0sw%P8R?6>g%0Z<?ng!pXJ&dD`r%j`Jd_T
z%lmCxw*Dyf(D;6IdAr{BScmO<EbhJT?(=@R|A5=%Y1R);Xg}5duh8S`wLR83*jy%W
zQP8Kq4)V(r$_n(guNv*m-)6caG5b)$e515SGF|?+J^!l69{IWklqx#b?yqRw^Z$l=
z?%${EzorH*;mn)k^zPpKVyA)+Kkvjaf6ta@;5hWKQX_|R``>fg9QHq>uWoWR_wLsG
z>88SQR;>FjJICTjWyRStEyA_yZsy2MREYWU_}032^W^J#pV%p-2uwPAcK!19e{X)o
z2k+ira^SXy@_X6(Q#;;2yL^F<p9@re7<j3@w*Tg7zAxqH-|silS-;NUSfcc`#lGo?
zVX_8y?+GUZ8-bSRN!z2_j5a<v_i$D4MCqMRq$esY`T4$Vvr24rL-b+UTU&Mqt-s#y
zAyD`6?VcyLH@D5#h!D7S|HbB;j!P4^-OHG3k!v{rJG<kHe@+~Vc{L|LEKQ!j&3s?S
z>5{xpE$lmr@9gkqWj$8@UV?$+km9UYUpaHXZ&dtr{4JZ--if?Ux1Md9EnkvVc;M8h
zRaxwg6~E8jU2->SQX1#2bqn3!ypWIdes0q)+;Zndw;+$xy9w&G|KnR*__jUxcUb+-
z^_8pl=ausw)wNai=(oFM-UABu7uTBqxfQ=v=Y2UT$p3fnZPU7%+RB|bQ<4}IIDW3=
z<*F$CD<y4}FJ~+BQDMnx-M7!&gSyHNoO--#GhfpL=kjMwZ>5fJ@A<^<#C|E(Xtmk9
z1#7xG{1!=mKg6PVclYI6*Y55AI(^pE{PNzfTaGcSvcFxoP}(cEz05-&RB<Q0)(=$N
zF7@U3-5*Mc+-^UspUq#Ec8DcK(LvzT#sV*o=cmPcCZq{S^{VauxzVI%aY)mIyxj|r
zZVRv4WyO)M$FaQp{I9uNst@wSnx9&`ur}~EYj=H|{e#>8j8f!4Iey_0w!c#Y?RG9s
zb!43PhkdS9<)^L6?h{%W94%%X4{wvMu9j51si5*EPTnhS@4bY*Zw?+-Hz~ak#<ft8
z$7$EKRyO;B(=9xQHpDCa;Q8Qj`I&XyTHa`3aM`bF_F{cg(#hmI=X~dV2)Vq>C-cHf
zoomI@7##%aK5ged+1c}Z=Y%2wH#ha0xoh*6>u2WdI{w30$g!ezb(kQ_!&xUHZl{)f
z=H1?)CU#3N;P`R{P<V8eT#(=X_4!FPEs-zh4)nadtjR6N!{F$#OndLU`H$*kRODMk
z+x;ze7`FOZ+SUFGn&W6u{*kNusM0)z7;(vVaD3)9|4Zn)>bf{UTIyCv^l2N322fG9
zYv)5T-LlyVZ(hEf`=mnb(2vOd>$>fV-zm-I6Acx}>wUP17g9LCxFA~;Ims)t_A&Q)
znWpN$HEerk8l)d=YA-E4^O=F;(54GF_vWtMa%pbU1P$woIp;O@XcpI>(YL#C^Q!J7
z1)saK+Z9|uwa1?i3-)hHyz`CoJ1dV>B~#>&75nB@@-R47XcbL9nULV;^#7Uf<%@@v
zIGvQtESvp>zu8B77<2lnUG894Tq@fn0BYE+6K(#NF!At7VFP`gH%He-^Dvb2JH;Mh
zduDTMzD?c=jm2jkXJ;0E-10tFswHjn%(jc{{xi-RbJxcR-n@6OQQ--=8WSnGAfNj;
za0Q3K3;s(}R|VSqE1A%$FD)&}@J_mA|NEO~=djo|dGsE?pUqln^7g{VcdErgyuIb&
zYr;S09NO@~mu>MxMGkP3->tqN-!rwo;uA~Hq?25S56_-G>xKeDgMx{4um8W=IuFx`
z^=D5>N<Z1b=J_mS-Q693_vIct|0_ZG(&6@baxEN(H1ze^^O^;mPCUN;;-6#vmao&F
zsvmQ#H;7#N<mYnE#ZNwM+L|3LXYUrp!19oR$JX|HiF$iTv-l(-;}D~&QpM&8k8ges
z-);P@R#fPf0!QWtW@iB<j-TBnEdoxOe7~Ak+TD}?nBJ?CQ~PVmS4M`W4a=XFK7P1L
z@#=$<U$ei}eDj~TSa9a)jDL$$PxsB`n>9g9fkUuGUhFQ1;*nncpOf~!70&u=SotV9
zM0@H~LBZVf^9;|kDRA7DyOXaWe@fIy)iw0A*v0No(|698yYgl;>%*m|!v$M7oc?*~
z%PO`AH2+J8TOj|ht$s_^)K?u*cYhw2Kf}z(;ncnK=dsc(n}2a<Z%_aK*8EG?A(q6%
zn~J+<hL``G_0_2PqJ&ZL%DYo{&HBvY#IkV9T{guQi7)K3UWaWyT(6sv_x;;4oi|yT
ziE_*i0<(DAjz2%oyOQm-(d8|U|GpF@aXTpmPEIXPJ^D}>q<c0fERNe{zSh6${`6$?
zzXefk^6csokDrInop9mqty2sI-xaQum))~1tno07kY4N;T;sQ1HAP_B6#1u;E$m)=
zw_-iz-331JICW*&IsQ1hox^E~GRSKSPAsua{L^4@TB81cuoUm#U1t~yE-U2hEr0**
zVAsMp#mS#u-hbK3!gr|Iy`;?e{hy<!nZx9)%1*sIb?H<xhtoXA8N1BSmpO*q$xCxh
zPZzHZ@N$&Uo%}akUq5@X!Y)Cli}`<#YCo}I|LeHoW7xyx$95iLV^QF4jAm238hdt|
z?w{ZfZh?+B=Sbe+=9Fpq!m{A*p9SlrH*DH)<=?|gk9Tbb*|1~%f;(jgXLU%VxnADe
zK8e@qpOWmvJ^`=X3-T?J`)1fY6cTP~I+vF6V)t%IhD-cTlMfbX6)Ef5?KPd0&Kq}g
z`egHm*}tYt<T^B)*SGBR;ssl}q8}%eckd~DeU81^pyE)@=9@hVHlJ_5FU#KfH<x|8
z+INSU>?{j6yzD3eh0v+OH^O|kW$NSq6zn{A#4!2X^Jh|Ds@NJ*nm2s+jXwIPa?7N8
zfq(NB-F*Gt_qDqL$IFJK4?iNe{S=g(Ym)HvRPXKF>AiDJmhWDEyz1so?$WaAXYc;H
zb2!cVn*aSQXZ+^3ufDdi_s^Ra9(tL%h2v1a(A|!b7Kty{>mPI9;@@?wDe&Kq&f=||
z$;X4lq$ajHG&%m*_0sQM_`xkb^#a#&x_!R>Y7y(t5fJj8mcJpo%75P82iHu@?k<nD
zyPdj!UANqatLyG(ZMkh+a!@T-sH#Fh==0&Q%j~ieM#(RKoa7d4@o-<F3`&+qRo@zO
zf4<*daNYd=mFd%G`>L@uxHNr8e0!58Uvlk3>6WEOkJm-+`#pL8MK41Z#kXEJbtkX<
zT&K0xqUzZl*SG&Bbq0&yj18{-cj*9k>8)FD^DHMBi?`(8nYKeytJ6$+<uV&%j@<l@
z8)YAVyt~HWc7OQmb5#Wb;D~JgSMWx->%iM0%Q`dGVB<ulO#&VY9J<r0a>dH6HRdbq
ziK|#pa?K=fsYKI;?cw&eU()q#e*8YYD`WG~Lpc%qs$R3(e}6q8;5?7hEw$K<ake*Z
zZ%WK=I+?Oaq2$gz4yT7loBNu|l#eX1FU<SvI78*f6V4gG{(isSCnK0H#>Ap1o4+hl
z@D7umW5oQqQ-7xl=n8}i2wl&+^Gq)G@yj)>`?qY_W>|e^*WHxreIkx05)GtYKAZ7A
z{lEX$voqxVzV8U)y~MQJF{1wIGLPl}-O0QLQcALS4P_PC{yNThWNb89J>k}qle|`Q
zTg{YWco?efeyg8Xc$1Z<H`B1y?wmb`zKVL0y7ye|+S@rd0`gnV#GKm9cHQOJrHcW_
zFYD}^VKP0sUtx>)?b&6!Jld9+PyW4r$HAr#M^~qvWKpbNtmwD8%Eu}RR0}-yuDKxJ
zVzN1frG7!euPvGD&N(q`YIgs~c_{q)x~yiV7tMc~KYW?iVLQKg>&uklV{C@$7j9nl
zy{uLjw>9<55z7#TGIo^<B42;4-m`60+`cTolXvX%Po84j-5TH8q8GQ%F7bLC%fo~V
z(IyYNFZ^43GiO>IIQD}4+&diW1>W&X{5&ZfV4WWqoU2>R%V2Ti%j2dEFMnJ#`I-Jj
zaGzsDRLzg)2EP`(UeYc!Gx+7pmrGwZJ=c%3EBoYgbfK_G)Q3+~rTgdGY_Cn4z%SPQ
z)c5!8_Wt=7w=P{DeM^ULKS##D#Yf-8aJhNdb6o88aOYgEe56-jKrH!FOU4;K-r9ih
z<8yc!cJXG*ur54Wq^aBbn`6Gho-&2?1w|aSN0z=aTbC@vZgH>ojP@!Afi4T#j|)J_
z;k<xT)jiXwHVNU0mfT`CyJ}`y@-w`fw?a;5S6z3%<)%OGzv_RmC&s2#l@%;lojqaC
za_f^z_!scrIDFjy;^yhwj1@C)3pjR^OsTVSdddH*S>TwaL8Vj4v({GI{V(U7{?1Tw
z{jTYa4HbFYSk5ch%omxza1v)gbLJ+0Ufa7qRt#3H-j82~=XWhk{5$JQ%&tNc-`VoA
z)18W?H2>%HdY?;RX%cw(!to_XtL-<>==z)g_Vm>{ag?u`vgoZ+%EQyQx8K~rxS*`P
z>c_;e4|i4c6k^}*+#%}|#IS2;`~Qmmm7nXf^4|-T3gk^cX>m2+LCKNkzJME!^#X@X
z<ns;P1@pFR@$lDQy>g_DkzsG{+B*dtAH8Q!uwARmvm;YL?^ovC%g^;C6{jjZSueF~
zjr7F633W$=rgVwqKaI10AH(yj`NB$2jq3Eq?c~$c?CaZXs*W)Hh*&2sH^EEbo`zn^
z0omq)M^{`ef2OiEH(uNAFJNUWt9VK9rNmwH7ygTbmhHFy_Oh6v`JY0`MiW2bqpAya
za%w-dFn$QUlG80x&-+Tr%pj8~D(b$8$vxZRcS%Pd3jaMXp!W9KB$J&RSG+Oc{aNw-
z-FXogfucpy6Z<MI7`o|shiL}y360u6(efLoq7FCLlmHROtwE8Jf)~Gi(UewVn8DMQ
zykAGWnD^3l_xmc$42~ToE>^qZt%{D@nbtP{dvPOOF|VdEz$9<_X@RIorw=J-mAV%j
zOA9eX=zP7U^Da+9@aM_<dMfHsXVTahKrzGivg7iqFaF6-Kh5=Wy}$ANKF9jSM{m~&
z9CBIe)D_5bRZBEA@%iiPIT{Qf{uIT&T$A}|<-togFUMa={-fp~pd_n$ySJb{X5NyJ
zHy=Nq`}FyqfAha4Can+BW-XI~9_v0lDO}JF8;M|UuopYsJnQn+)!`|>PPngPHm(&_
zzqY2PVp-chNi{8orh;}Kx4d=__a%$>ep@`3Me5VMcdsWuejjadYQM~WA7_nP<62ew
zN~U8!e$T&@QDxm`c8i-~^TiuApV^K+>|MlU<*U{3#pz4Y+3k6kyp1O^3A7YhditKY
z{8r%Zi@uj0_kHF#ISQ}7T=ToHcGvrB@+}6(?_alF#BmHXxbVu_`ep$m0|Sd<{lvaQ
z%au#cUW@PQ*IJ!_VZM9rUq=pZ_nlXta7xIFl$a?y-@kg4fq{WTu;q`dIoJHY3-_+Y
zADVyM?mqu7>8I}>Hvdy-dFt30XcS}eDo>4teg65grZ2ww=rAxaGzEMpY4JF2(K@HE
zw#a<nluJw69|ZpRD(+-)Kw{?|-NhVgeX`z>87^W>3=IbyJ4!_2mMH(Vn|@{c*X`HO
zr^o-_=wAmi-Qeb0b^il%A0La=(lFRpeVl=TVMnyUBS-gsANOBukACOXcz*wS?&J59
z{9m*WFR<r$XyEfTaA&Q^!Pv*guR|(D1_lQwP}(s+7Qy>#@!I{5F79|M?DQgKYn`2(
zkZXW(;iAPlETG`{`{``(lEs&I3Eq<Vedfd0lcHG{<XZ%uu~uAr!Z`!dThmE1W@cdc
za1msl6`y-mx{yd$tXAr({_WS^|J`{0l3>*nekYF13oF>&1byaPZFO9}IYQ^mQc!pZ
zyzD6Hd3*bp_t(J8-+i@Wotdxsoj6`9RBc)AH?KkR^73FYqvfEmb}CW6G%;@awtpsC
zsms>$-~AEf(EQJ3|5tX!mXBQh^K2NmE?nrlb!(0X)Ku%D7vU@H`)jM7dzOJ5{4PjS
z&=uNC;$dJAXpz&n^s)KaSJ~e_KZ`HO%l<x+J72(QyW!#M(v~bcb!tN5&oeMEIC9vU
z$-ay?c3gR7&;GZUt<4X7cesD;{=o$f|H7O&7A`q+%ysdH`m@~J)fX=uU|=|KxoLvl
z{~rqsFYLW!xGw)h^{oEw*Y2m+FNpWNKjC|`QzWNii_!$SioQ>uq!bo$1c~j-$w^^g
zXi(T9`cmU)-jlXH>Ax;*^xyw4c|N;pl4^^<E}vchy0|9npEtSBz)MY=hd)0rD~W;O
zL!ivsb)3J_()Qo_t12hZqU7nmWU<r5`Ztre{oC}nmj6%X<L;18{trO?j;e@R^^8?f
zR);ip?#X$3YufStnH`LC=f<X=i#>Bjujl^Em7eEyHP&Y3?CKAk-1qYB)$8#)GheSg
zwyc_8Zu|bX1s`^*P0l=!{`dK<wY$H|nVRo6li=xL-~Rs2Q@iVp{qt;+n;q64)qR|q
z9c?Wv#<Ec0F2`fhu9T@pXSe^qp}zeq`_E;{EdpwqqJMVt-F<N~^2V<(n!=I}>+7d4
zJ1hVFZq2*vdFLXz53MduKbvN}nSICq51f0w`FLjT)KSyy{Wam{g{yasZ>0CmHF>^#
zYIG6*l)ahtuOD0$*N^w_w$F$uVv}x}^l9-Oqj|5+#W)CfnQ~Z8?CbP;`unzBZSAl8
znuU}74!=?AC}|OR_c81fznQ<E`-(6vZDpl<HudL@Fur*6Do$+Q#X{zm^*68GyLXV`
zzQUHmKRUiq>ux4Jlx&$3-`Wx+7BoQ_)C<$RWatPQNcMWa`=jdq|J(e<Wq!B3aN|gv
zHlP1LkF%B2R<BZ*weS8s=4W%8b>fA}>-g`P^9$;3ysGpLtNZxY=5@ckb!D3+i=#!_
zqdA?I#lC0%eOGv?@Xo;|gNi>ozt$AqKfnEU!fNxQd#ckN1e7=?_Q@Npdw)ZnxAOk&
z^2gpA8;;v4UJ`Wjc>cD1R)mN9j=Q&KZ`!bWX=|fk)4Y=3|J7z1?0$5Cv-#qQUoWn{
zE?r(fd-IR*<E{rA6?o$J_C{X3c(e3vTJjRBo4X`Hqp#*1%iHzRYcKr%|K;cDX7>`%
zF#0(ItMXSC9PjVdyZATWn)*-Urb0kEUxZJ4$j<dY-+ocu7T^0@I!T^IkypMvL8m0h
z>ex5g-%Hl+_i1nbry!yutJrdM@!!RJ_x$Q@a`tpb^ywNNq&%Nmv_ETk%De5-JgrOH
zU(|ozIk_$RnDFMKmlQ)1E@WRUfAJvk#JhQNT<Yp<itSc*t<jU?Lta{NtX)56VeqnR
zz7-qabu}y0{9HBDl6mpPBeiEINP1V=x2;-k{^7Bo&gFRNbXLW`f|qw&U2<Fz5b%Td
zenduUlheXL&ENgC&k8}#3$}9Ncp1<ZrPlp#LW~KYhkHj}&&TifOE12#ww4qS*cCA4
zcj)e@@AYryww6m@zjk#0{^e=A&zw1Pr|mTFZk}bSTsK+UZy6XHn`@srIq7gr+OvOe
zPHr!rpSH$F<mBQb&)5BpyKViwZ^_If^X8wk{H^2ph(|ko{p+xps-wQ@Mk?=XRtP7|
zywNeK$mP|ec`vTaov~zlx5`z)$IJda`*34=eC_93)~53og#GvQ(t5pT@q=mB{MRy-
z#b%wU`Sx>qe)yN=68+-4o^5mA|L<A-J!!vHa~}S(mV2(T>)|=|dn;e`>!x!x7F?bt
z8}+%$Ggm_4N&$1v+_)Ok%MAth8xM<amA_LJZ=G+exqi>XtJ&si_gYKeE=rwWqO13G
z*^9^DSIQSn>7O7Xu<rJbt-n{N-iZ;7+ZPk#l%@SgUQnQI`ohKjHH%)o(Ya)2pW*fU
zjC^9|{AHWjWqs9z`_3}$f0FVd<3&W-Mc3}vucLXna~blhuGB5w;(sFckz_!??bz7z
z-^nT7Z1#7~$K428dgpF`38TTD)b@Uv>ow1($9<mPKK(=Ap+)a(=E`lk`1+ATjN_G;
zj>>r)e7mPROg=yJv)FPjj)yX9D;FNWy_~hhy}!1s^D|%LZ5~Fah}G*7XWW~;|HZ@`
z`45ii@B6ds@aLntm8<!rZ9UC3R0Pa;B$v*XSnhs%zfAU>**6^|qMoanr=^CbrC0aq
zH*<Y%fBdb|%zEDppJTmh!M=WFUI7;_T)eRH&!X;W{BnQTKPpLQ%5jUWFOgrsxjWEF
zY*X;j$#biBRBsG?*ckWUbH}lM4HciP#`x`b@6Y=X%hg!$>da4vWxs{=zu25iW-u_$
zYm{GJRO|S1=X4>3JEFH&n@0R-VR7QM+c)iO{2nFeh6xK+Put3p?2`SstgyaQQT<-T
zeFGaCflHQ`?|Lu!{*B#Api(R`@BYmhKOJs_U6{D#{HwI%)7zLX+0B-TKeus<|KyVw
zE~czHeV+BaQPi>CbWy9Yn5vbDiM!apR)4p>mm;kkTYA~~$;3kjo#xkgB$nvP&evD_
zIH^HehjHVI`HDB2--#J<-u3XCzAk@49@nuWW$#zNxqV>s?_+0gM^1B62vO3w+4)%g
z{49ggZ;w(}?@isX=yvwR?{2En8#V78j{Wbib7NOPWyLcGkGeJYGfZp*E-8I_^373s
z5vx;c<<@7Pq~#>OeB813H^1PSBVE(>bz8Z7%Dr<;yn5f_#oujiwZ2#8n4i>s`TgF7
zEYhuyw8Pi)bG9tG*!A4gS+q>ZOr@~o%n?b+`9@Xm7A2<^FSgfzyIJ!~y8j=wU}*>U
z$(ad>ai;{&fg<bGtJUHB^8c16Cf;JRX`8vkKH&1ZoA*LQ*{t@-{C`vY!#9TA=}4*3
z1!JqDEvF2Y1O%wpuig_cldUOf6zZ^|jPKtqj~o3KlRVz+eqUeEFC=lLtn2b5HmA9~
z$F510uHffyS+Hi>)a(213kmFtytRFke{+08QdZ-Ke*1qr9v|$BGR}Wk^!-I+v-_7`
z266d-D+_sNZ{Pj**Gbt@^FA5#P<Q#)7ep=inOm;kD|^)MxLa?p$x5S;xknld_P&U?
z_~u8@{OPBQ8?Hauo7?u!N6p!Na_4=f%tOY`?#{<&Wv`1gulsYqo>6Y4yxEJ^hNIpx
z0$Nqu3Qn%t@zuGlpI=4h<}Qs}ix=>!w&rDJY?z-e)iA+hV*UF~Q?s`ueEL%PkJaS1
zKwS&_q4s%o6VJcy6mnr|o^olY<3+jkp&7{)3M?60*Zg?<>hfD>k8>$mjT1i16${{f
z5&z-fgTSZ@|C{@nH~Sp-o%K@RtHe6@&5f%PY#jN!o@*}Ecx~O9ar}Rvzx;|z#ZFIe
z-Zb55$^7ZFoyG}yuf_Yhy9;U-zT%I3JO5<LiwvXQ-5WR@jFzsyaB;`RZ@XUea9_SY
zwegRwy_i<;#DwnI%a_kN<Dl$*^uB|8{<FW1%EBU@nM-U^O*U{khVE~Sa$dB!o-xhx
zR246O%kniV7uy+gD$Fs<Zk(3bA!R9W?Hcbjrag(w$>;P`vhST$Q$6wKzK7jfv4+cu
z4HMRcY|mDjXY!=mjlbpL)RQkxSZ8|uUUIV9vG~?=*4BBCy|qBjleC(3F7l$*v}eMJ
zUzTY`mYDGF_<HT^<z-7bxpOZlGjdJRbx-hU7npDES@a+{w(8f?GNvnSmC+eY2kW(R
zX5=Y|G_%h8^Yq^PRWZ6B{%W^>+nJX?&r+bs@O1XQ|BmZsFXwD=m_9AB`<9S^)60lw
zKV13Jvl=%X&wd)!u-rSr*x`ECiQifer^nY7|E*@)?>@sOd0uqA1RICv_r2dYrawN@
z*l}cC<o2IBY==B9Y+PjdrCsvCfkibk@yB9r+<9Wl`sVt!3l~$2B+X}OZQk6l_sT2Z
z$*HT^R=)dod;9s>)0aspN=MWt=rZf?d?;=zaNNCRrh!uRh1;KMzHh&CXirAtgsROG
z-p_wm_ONk6xl`L(^*AXf<pt(xhrXQO|HJFGGjn2rK+cgFniFTAdZ4(3Ro7I!@U+_A
zwy#f$cUd0R{kr9fR84~)Ys)IpKfA6=PmOv|_Cw*%?4J%2jOIqox;v(SyLsh>f9Cvj
z9cTB+prmjpkf$ZvRMK3^>e~Iv^j{k;uuWU2CoE+1<=NAFolDsl?q``4yF@xH$tX(U
z2*>fYr@TM>Q}>%&{7i3g&yvOoA#vM_k6nAa@kHZ<6^q3h3TBntR)0C(mKD_07^iW*
zbQ5pQ%bTC4XYq>L^9W?++}!qhYkBt5QkB<I4qMhTE8f5I?eytdef#`^g|olS6q7Wc
z1<GrefB)RMw!f*ZudR=l-%cWW(~%##vdkweU#jm+m}&m=!DM}n)GzA`cJ6-S^UCIj
zXB&&t&$-LQI275}T9!PCnDJd+RA61y=7YI!J6>jAaahr@RHw4({oJNTrRYoUrthtG
zXVsV#HHm#uy=h@0u<N4JtJu`yF0WOuZfgkeX?7{Ry$p^!t63*(JGnmd$gaImctN@U
zP4wnt0`E$W|MI>4hxdr7#-hucO`pxVmy#K}SMB8k@n@kg0-kSP=40ZqxkUQf&xNh+
z|CTgPsPZu9G)``uz?w2Y%lH3x`y`_xg_4gw&;E7B7G$(7tSqwlTR%;rQ@n-UsrT63
z-|P2%JtE&9{XYA;TjPX;1%h)IE<TxJRFYHMyJvwxREu$mNr}vt7mI&iUuSxT+tMum
zw&xu-?Gq0AUW?MT*pxW~&P~v^vy6PrI(fx5gTxolq_=+(a1XA(-gtjboXGya->h%8
z8Ko8q|L-uJ+Tk&o$w^Daa`}w*4MA*7isJu2_TAmWz;MmALyTkR)UL0E{`_)wQq%Qc
zmGwvLO6uhk^t)oy+EKXA=yutWDH&CN=lUl&3EyCkuXQQmWwzg;bbCT#HgjTSSlFCX
zi!MA^#Prw%oVxDZ__avy?^~V&#?J1i!~X7w-M#qsHp%y@atiEWhL85nTOWR*NI;%X
zZj+@+>9ar9@~@V#7se!RnYhSzjm2H(4U4L$XgL<SJkGM#&ay8!tFG=l+r7K^eZZPR
z{mO+p1=qC=MIUmX@@{Bim{H}V!r8J<L0x}~@wVf(r|KWEA1=)>RZ!VFsk@=z&P=1^
zf2-ezJf604@u};*VjQMfY&@5ws?08>ADaFD)$9CtJ-v$y-K|TWPTRTWMcJ16)qCd8
z3D@*jowD57+1=;Dx*hroURtjoZK~HynQM@0mLEMihRc;>{<}-YRSG=oH(lwB6LgE8
zcmkAgN=&BCEtm6|;gG*H{#b8Y-=Rav)@2euezwm#%FQ9%o&K(too{zFzns;nC9l8s
zf90NgJTp>Jc*>5xZ}<OyP(C@oaJedn+8Y+H>$x|iZcO##Q;quhAXtA6r$CcZ-1o}P
zawe92aY5Y2PAF|PZ7^`T&b7vCt9F#a73=cD4ITIR`?pk|Y>kNOH+gqce!JkEr;m3S
zoWHuyyPjdz)qgva_GxnLI`Jy^htS8vJ3=l=zpH7oub!Y4xke;<S7_f%{+3L~<8?bN
zkA*;dB54)&JjJ>8Vd{&F7c;_2o(T26y7Y8&#F-EJ1rCC%guZx(Mx;#p^?g#RSB!Sb
zdA6e}t%-Gsf}THTid{~ev;2>P!z_bRGsa_28UmUpJWiJTy;b4W_YG${#W*^T<lWda
z_vlRK7O&l{4AE7$e_U7>DSwA^!g|gt%PviQ<;`q;diTxE8OPVTsjV~)+5Fq#Vqepd
zD;^C7RiUZr{$@d4PRDxHCZD{pQBPmp=98qAl-0Jrd#6rGUElh8`tR@3jBI^drMFGc
zUsdGzedE4;i54AKFCEL@_m|JygEeJ|y7l)3@4QV!-5q~4b$k&?c=I=HDU(;;t7S@o
zNj40g-)5g=T*wyMefYRfTg6|E6MOcQMG15Kw0IIKq`Ep=qV0aaSh|!z)!t|AJo4)m
zHs7-soj1Sso9hFy*6AlZd$R=#Z~v9$Xwfoz(VrIo{?ANBvkIk4zaRTQnXYw0=k7lT
z_BG8e&AEacg8L^W9-3ejXC!Gg%crexWsq}Xoky2(o=Hg$3-^AjiVGYDc`J@|FOUxu
zKU7lDm~d6%Q>9c(g0h{V@pIi}RRWhM2IoCIvpcC;TsQXUG}CPJj}iADovQz*C}Wa-
z(CD0hXRMW-#n!&v-{l@CH%r#k>{4sFpWPh2(|B9;y+xuWf-MP&Z$8-UNxS<j^0V0I
z;|=ebgi3@(e+T-UkoTJ<zv@Ro^8bT}PlvC4s*(P?fA8*uJY~-x2LI~jZf#3nQt9lz
z^6~B~M&dHg2S4t-v1ZcT6N<+Zg{G>o^G}~SbEe@If$Hqjir-Ie?s<3PQc3@pKd&R7
z@xBbdRAN5m-^b0}vb=|aj!kAy-2B4h!o-e($L9`oe_5J&LD1^ktY`Dyz1tpN>AK~k
zL~=vH^7n2n-KHQ_99CgY@%8T=-Cx|uj%2T{>XWxpkx2HHQ8=?KNZx$Omb3E~A85QV
zae=a6Nz9aYuV;y`TcE6&^zg|<<tD>xUl^T!wnbg2Iv%#j8e~{Uk=v^8bBgyx^iOki
ze_`>U^1qzaEUPjfgJU8*0^8d9Do=+bnceZ&F|or<ck}kuue)nk3Yjic&THvo-dFEy
z_y6C=$4!Q2{~4VQPgrv`@66Jm>W~B;E1?pVMZD`|IRmuTzTl8u_&7npB*MbhQd1&X
zS5~2?v2UwELk-A<fq!zp&OK4Ou|;}eGWRLnsFK4sZhW~iC85XgtHK<8+3rmJIt#%#
zr57F{9@U=~U7ps*B3s-oet%c#>ys}t4@x9|Qn<4GZDZ4Hbq<h~t6CfPTwbvFnd9+?
zs@_sMHmZl6j!7t-k#t+UMlQEV_5!Ocr@4@3<^d1a9a)nrE(lsZ+yD3NZm!l~bw7?{
z60?O{KBY$AjB+*i7syk2;j!hC$**0z?AC49ZR*=mSn~5zb@o={<^J5qB%&2Kk{3MI
z0x2v3DZIAL?%INy3x<MuEq$x^|Gv8;@`MC)%jX5j=S+51HZ4$gbPu|uc72+Ag3wD)
zVEmf@=gC24_Ox?z1bYnC*qvBIjqR2wf+FKlzWakym-Tj*wDesl%sJY1eBG|Bv^2L2
zi(?WBcg~&_W|8Hzn$+bb887(1K)EF3!jGNL%_1~Pq?36B^1kk@Y${NG=oWOrMdHiy
zpjRdAvX;v3j?wx%pRAP56X-E?SmFP8U9UDcq*PORowwdu05ap7_PUCP>vppw^9a1U
zAa&b`+vUQ<1&b$rns!m2SG}oENVTU`|8DjAgdRqxt-UkU*c6)jSY)SeIk-_uVaodT
zZ=3oq6n;Nn|L@o0ey(E@3Lz1;JQaohAcr2iFLr+7^@Q7(1kIg}ceLi)d~5+3q8hrR
zvI*pfkU+(Pr@hzjfjqnMqrc|=cjfK#s=N%2F(jUO%L7tmE|eD%VESchvw*pi``U9S
zUivP5RsZMlM)7!&9zzF-=xCev@Ec&~Hi<1|znaW%<>dbM#SQU|AKr$?34)Y3C-=>2
zcIyOLCu7K~n$z6(i(U4&Zgzb6ckA{0v?Q{ZGagDjJY#drp59vx6FL?wp0(hy)agG`
zMuH_rdYQNVJwI>W$;0ig&wC6VG~(Au@)mz)5p;BSeR#}wo$ZCIrs;p@%I3B7InOH(
zHM1`LvLc~}@le=>jmORkyR=Aqx>_@pD@^^Rz$sZ~BD+wzMCQ}q?9V^H->(ffnD&6t
z>GBlKG(EA)TzpchN=<zsr+!RiOKtAEAZV4=yx`!WmnS_BMp*L;xE*ynF57rI`|J;8
zr57Gw4LW+Ruex=$_ky4mpMF%y;~Nq>DLevZ?R~Rj^X4fiz3|97HS^e?4eVh1;`aR5
zmV4XJ50qvVVmw~U&c5F2;&LI-v+{Nn$CCxhB}aOdy{DT+RB(x@CGiOK&3Ja*WQ_*M
zoI|~<qTb*5r5x~|UA9np?Z0o^-)o8Z&9_keBA?t4u<yo;9qr9-ogE7ncWtXUm!S3a
z>D;9U7brU(H$6T5e*F6RmbFm^)BZ3Xig+2p+5)oCb@!#X6#JD67W?cFv|9J~U3sEn
za>Iu=x8{DUyeeAn;&Nf5(63LgCW9jI#g2!^?dyIVXq1dNA)zoObNBmq(Nm^n<_jw;
zDZP+jbJpD~p9jhwHAlOSuixc$<_yO%357qi%qsg@K;idEP|)$X;N=|6w+oa@TKZ<6
zvlSOJV&mAqZtFHtO}%#ulm!LzVqQlWZs4^la^uUpQ+86-|9-{d1fPct54|q`x#SkI
z{ZtUM(+dw57TM#m)@G9&-CuCXmdDin<SxIfDiLh&pb@WAvZmef&w=JX7ndz}%iDui
zo;SU5YJu|nu%&auV?JK8{m$|CxP(GaZ{O4&dHdT1%7TJZFU7SutXu#pHhtIp=#Jm>
z@5N%L|AuU!a^&2B-%=J6C-H~*w)8edNrWuc+WfQk)W!3w154jcP+8Ox&dpr;5A2HQ
zgNMxJ>SGL+)infU-kw!_LF4TF`mg+N%)9q4nDUW(bLFI|Mw{zJEmRh@Of&8|k<-=G
zcVQyCZ1Bog@9WB6tX$5Lye8Sv;vLhWA4e=cPW*dHa=*+kSI*y_VP}3^HJI_>tE!;t
zs=(7BeGYd(#Z*J$o1d5G_wD`Al+aVEz!6>cndRH>2W##3-`WuWB`nVH@!Z_j&Fkkp
zyu8F^%8YB)Wi=DPsn=`6hqcq=#eC(H8w#do)~%arwY9wQ-@&@xLkp~CxBQK|{5(?P
z*RTE29xhvM7H|0^UDDEL^THw{l6}|i`*mMKFE$ynai|749-sB)tne1~s)Y654F4<r
zei`xPQq+srHG8xKFRnXqc3DuM)J-0%M{X}HQf~i$^>U_7iN_I}V+;$0tfoENRmt>w
z>f-)dG2sZyFW*lz%3B?i7YsG3TjKZ=oF+bAG|ayJ|J}=(Rz)sH%)px7aopkif9CnT
z7nS>~eBS@otXN&3^d!h#R(VmU!Gv;!k|Vudk1nsWyuV*-cJ2Ech6iu_Vdv1zJ}2_4
zp!<2*g|h;QA69Drt5H4wThsF(d-KA@E-qUxnQU$|EMF-CD&7JU55N5Kb@AfM$NRg(
zdJP>UmbUas%j{mezVd_pj@x_ZOne}()?@y{!zEibnyuy2!(-Q2Wfwj!P%}P#Xr<;s
ziD0%vViyXxrf$33T)&n7$8?s3iB5MsTpqvs<H!NZ=pmO@se0$#+u%5_wP)l1)6v(C
zuf4R%Ht|tnz~t(0{jaQM3RnqUG`l}lU8ba^Z%M!OXYc9v_T}DQ393RTvoDO{dJ*BP
zBcyhy#FWSDlE{*vWA_)I6_+njS>$xA|H9N0pqkR@_{G%Iv(7mkV_3*!C3Y$9Q{0Yr
z$J98!C7aB|dmY@BR<+fgGf+95C0TN$_d?;@PfyFmyO;aV5$M^N))2rbyPchrIWaep
zy=9W!droI}B`LF1M-JK2GUbvbrT727`}_6R%*)GJlYR6BytbSy7Anp;v#7)}hlw@Q
ziC<W#MCDZUv@KssmV+|1$+x}lZ3EVypJS;kk<7{TaK>aFforqB?@%y};XP2GJdv+=
z=QfpllODOf@VHQTxl6QP#%6{Ds047=_5Lq@@T!4B;T#LE3lndxKRZvE-}uFe<~~j?
zt312!chuKGN)s!Ymc<iye5zXhgt;YS!sS#BE1|bMdpd&NN|v<r?I=85`TXpr384BQ
z&Q(-Y!KK;8)8oR#6;nPcD}XAEw?4<`PLKb0rq`V77y~G1cX(fKcFSISMIn?y(a}BV
zu8TxT$7^sp+`Vqkr=`2!i}f%b`f>XF)v)_lKi>O!ZN8H8j@ANY&HN)iYYrADmn^B=
z_~B{wd(j?7r?t19SV`^kdBeh6w1r2oWXaZTS2I<>nQmJB&(r2|)jkGn9HyCblV5*(
zv|gyJh3)4R4Z)Hnh1XyD<T<*ZJF)PTetqSOPIZ>#hJeb|xqBTVy1ko29<2#%>RYla
z*G{3O?^Sc(DWjfS@9XP-yj;$j+z^m!I`^KY*3!qqf^QkwTrLD=wr;up&`s$@hxF!U
zJKvwLuY0|8I!p3f_Cr^vsoq?1=}YDE6{l`D&;25yD44e-tK@=)U`b1#<!!qgcmICV
zUe9sNO1LHK<qqQuPZwNFnXfw8;cOVAqF_nL-3^H~nU+d-R?O?;iuf`A-o2B~?JUU+
z27Xp~Ut`uSjPGFf?!LsCny4D`=b3?^<MF`LJuDi5>7XVgztuCD<p&R~JlxKj++Z;8
z*w-DEi{?1+PWx9cwvkuho&Ede?0Od8FYh-NoVv4j0*BSAyfYi0zP)Z)qVj@6*1hKc
ztekIq7rV12bFwY`Yya)tA?q%k{Kr3j^DkZ7)7QIu_wL_3@817XTIeiteaY;17P~Ai
zIv&^M5^nOIu|)FGoV~W+a~NAg^+NxyepUJIXP@_bqZ`jlz83E_Kc}d0=5y7m=2O0_
zH*GfZEqiagC|>;8_dma~%d=niuMR)<ZkMj4+La|oyfcK>Eq6chwz039Y2VGv%<E_J
z<eU1=@s}LAys9{*GF{`!{maZzOI|Q?d|mM};^5WvK&A8DyFOoTUh0_oeolS-zxchY
z*M*tSZvFF^DMeD|#D4+j#T<&?FBP`RTwv9ZyEEfbW8Z@0zC|h#H*Rw$EP2Doaq{H}
zn`64upWLxkU+npi=k4~szHV`Mw>GxOH|00#f9Ss7dv<P`<^PI{)|;=}{XO#Q`TU(<
zrkij&FV^E#+_5oa>JeEEt3~#~3zGAys%irR>uvbb9_(Oi`Mmeu>}jVLFH7z`<meIH
zsy2O9qx91&&s`5Ys@6R@vGo5las5s4Z%@xOwpw_1MtymT;lJF<?`wZ)3V&}es_R^5
zx$U?2w~DNCZ{y!{-%r!g+WosP`lr29HMgo0M~Tkml+SaRWd#rI$;wN6HgBmn`|sb4
zymLet75nG(oqo!o$Z^_&Lsu(P;mLlxk5?HF*Z+vW){@^^pED=zv~~V9-+3GCO}<ah
zc=BSp@AF$x=jHA1UB7E9(a+D%^Fsd!r<8rwlCnb)55IFRmXLDg2y`}7*Ujyl$GPfY
z?*e5e+2`r0ZzH$maOfQIloXhBxp3nXb(X}CsXLxdnxoonBrARG^?Tk=#XHKD|6|-g
z`@{QhXT1N+HgEU*<Pn@){<`$XaYhTHqQZ(9$Lr?XFFECRc+1I$C7}st)Yb?!3n;eS
z*fw*W<LAackVV|@c4fzVcK-XUDkIYnFsHAz&P%}Uh@;2*WADZEP5!jM&&%yhSswql
zeBDmn#m`P2H{1W$?e3C~;UC`LF#P;ycg#GQMQ`*s-k)b*SabRH`i?h`G>(AMLWs<V
z!UvozR)=~yN_6%-pO=5?w0m3oL4KKrfIT+rw|DWiER|`|)3I^On`3$QgZ#e#G36Gq
zscKLDte$HzuXfdk=N>O79%D;$J-5H{-o1za{$2cZzTijv)%z-c(i|sVIL2ehA?TE`
z^2vVJ_YiM%zuP-~<AlFFTpR}(Iasx?r>t5SD1O6#a>Vr?ld}>oYwN#Kx$OVEFV|h_
zmF|=Kz7ZOAk6H8PE#Oz&;>8(}WVu7I#HHZzB6s<}b#J3K2(T-NXgaYR^71WP#&9?}
zW$$aPK;9{LOQmO*8vfZXFDWJTY(4|W&;4Dw=RcemC=z(|jI(7zbl0j$ts%^^j_xgD
z_WvqAPt*OQ?qOju1(YS%&;IPN!)s!OgG7kTx&5Y{?e_Aq-_HpDx}Wny_V5J_@mUuC
zT^ucb{QkMhUG9m(k+Z@aisGSyAv)<2FFJZ<TBg~3WU=KgWN>O+@nXl6jEpTxD=hlz
z{cSe=JbV2{EZ^^Ee||5Y6dL=r^!csZ=SsJjyI&8n|25&EtW((WU!~U_qJ;YY6<OQ;
z^{C%<^^cDqi@AS5y8u_^rDum)7AU{y$jP|ct-tN<t*14X4;Wg$l*EX5xC&%l^8GPg
zbWP=-hu(jp_ikEUcKv32U7~;Ex4E{zkEj3trT4$TD&zCAj54<0?E3%1Yqw`GPGsv{
zzr#Mg@4)n+kg4mwfAnh+@bYW5(`R1z^O?ehLX(5N8DCH9%ir33{Ab+(Mh?xF5f8o#
z*0x>H6NqcBpP4N5r~2{LTOZ@!%>BE5e%RWCa<;f*`{mB<&#wEHpOP`*@55H(<u~nT
z|CnBU{L{jVlEJ+HML0Qr&i&C=uJ5~)C9hQS#Wg36g|3YID|wsxet<l7M62@Y)N_A-
zFBFk!_^>PRu1(@)=Y?;si+;cVcmDPG#P|Q+&i%^%zs&I8-#HKN&orJ>|7>~uk9gTv
zuYd1S@Ml*nzkY0bd_sMvSc{IGi57#?wATMG9o<_dIGj%9bGi+R=nI0b_v?P&;I}`Z
zWx?>!R7+V(iZ{B7UvaxY`K|TQ+rN~_n(g_mzUR-$^$q!}*QNOP8Wp@+FS^^<y6y>w
zEyvFbE7Uj}HZ=X;uE15|!ZCGK(4?R2=3uu+R6Ke<Ur|h^;X~IUt+N+0T3#Q$RMz`9
zC#B$nmq~1Qz0T$K<_|BX`-b-0B<z^;;RxfV<NQ3%i*vrYF|_;<^IGNL-V)$5d9ttd
z1;G*)*}$l%pYHN=GxFM^3*Im#?z>)n_S2kOUaf2`fmf3RHqE@iz1*+x(9GxaJq0$M
zm&vR67%3ZjY+>N5e!+Kt-XzDade%L$Ng&UKBa}^4Y8xoK%?opt^Z$BdV>-WVQ(Qp~
z>p};Xk|nz;m6my4v(vw|Z(W<cVAk6Q>i-uc>{*?C`}g~p`izi20ern#LTj&qoHp;e
z^HW2x(=O)pFHd`O<J~zw3AT2*mX?wj4-=E9btlEnb%oh~O89d^@L$i0t<xPo)GJCa
z$(&(z)5656wkx>JZLwfu?92|S24+Y1TLN0&eivQ3ly@tJ#VSdey=2Q;OS}8OG=tBT
zmO2_)d{IzYnB3UU)*?Esso=c*|6`>`{-){fT4!zY>(b{xjX}Q_Ui@XnDDbJjUx>|0
zsbw0A1&407UX%34Y057&uEgxG{~Z5M$i7l&-a$nM#mcGg_E$FD)z81r`Z1>V&BQA&
za>IFh%StViGPdmP{m(DFv$9E##Y$;Q5Ff`1{t^~hNB0XC<HR;aa>>XP3jC@uKQU8b
z$uFJAm8H9lcrUBn<~@{L{e1&_aIf>?-`_16Tb%d*kNbP$Fq6WXD-DLH9=NqA&6@J~
z<BP&o7un34`W7h93!A%K<96CvtNLd=InBy^P9HU1M6BBJ;~D2U<FdaC4th*${*d!o
zUpl_(+y?E-`|{SVZg<PfpXabZ+3D%5Gcp=NFF354`pnp^+CsLPiM)FMva!IeoZ%4D
z{PPnkS%NMWw#pQ|KPx=P;mx%lpO5!RIcEI7@M1f6_go_rEB}-X6E|CvE(iA(CnhNt
z*~y|WILw>+6n(un7|693AK`b%u+uW%_3IhuW7Cgi4HNi#=h@yiIBQ|D%6^sCzbhHV
zCA|mM`An$_XKU=^5dE<yEtB0!h}Ej8Z$WZgTAFj9U_{1mMvj#)BHnxtU%tBPi@85X
z<AmOQH&~qPOswwQ|L&XkFVuPQdCQcHFCNZ&Pn;FL@?Jpcg5W~eN%ixN7w;|V0acuL
zIIJe^G_=>wKEEl|`R`u?{+Em#xeJtk-(J<kb$!80odwBDmql<K$`=>8X>YR2tgQN(
zsPp3Tl&@v7WuGr-IC#js=(td1dEkM%0N8UXjeV>)Zzd>yW#q_R;UvuTaP7s7r!LJ_
zms)m-r&sR&_UnSqi^cV>*ytIVa816@_P{M<5l4eS35#qev#jIsN4wwK1q2z{7%==_
za)Oa#@vJjXr#(5;x!i5(X<>P(+LxA#7G9KE&eL1>uakj8+oRo0kV!VsXY$!7zC2LE
z*>N#ZchC2G`KLiO=R$?+@(l%Bl_oYAOuEoraBShl9~YIk@%Pq!SjXq|c=4($3N`|>
zv=3z7nyoItBpdkjg(E1U7bq8ralhZ)zj4C<5<&Lo|G8@I_A-6n60?jk@yZ9jg%SUM
zPydkpC|6c0caGgr3lpoWhR%x(CoT;91Tkga^wXz~KFkcgAehG@JKgTzkN(%!8e2P=
z1-L>S?j~tEFddq)R3Rrm`~QWEz{bRklEdBS`*?VFmS>oF{pC}1TA&>D;``FJ?+)(Z
zyguFbqs!-Mx{Lqq)ZlaQ@H?)wzn`V$DQBc-*w@^RZ=Dy*zP^4m?|jjV3mNXep9Yym
z&Zx=|QQRS@%lpGwu76?WI^L2NX-D@9g+GJ+RU<l>1%%Wbj-OgEsYW1-C6wE7M$5v$
zZJJSkUmX6E>-l%C=W?FjZ(pz4eC#-IRycHty`>vRW8dm04DJgeJ_~>|LEoAuPp99`
z%4Sq)xWHN{FfEfsAtlnu@!V!!eY@kCDfcgAlzV?ZHho_DdI`D3FV^4NcTLlI@$P*;
zLK4E+6qfKRUNBtb^+<t5cJ5oZ3xbWU55wc%-q|hg!^9CA;4(Gq(pBk@T>r$?4lBH}
zZ(MjGIJ@1gU*_hwgVk&TR+$+l?9PihcIsW&=o9>=MBxr7s=hS#Z7jcM`Ry?O0U?JM
zFTylsTEtu|OsZ<)h1%Sft2z8Qet2C>8=sVvZuiT01qMZ@JkF9ee&NM?<9;t?w`%IU
zaiUTBWn{&p<MP3GoEZ`)o<FWtl6ZOv!}FL=n;2ViO|P2q_kODn4mshtV*k4~@f#Oj
zEHG|!ljez6Nb3r^Z__BiB+Fg9Pvr-1$r65WK=&{I^tj*O%zXKdE(WL1qE^dX8SUMp
zCTU-vvO(+amY`z8wKwfdb|u!n>C5?dLZe*#w(MKmJ1<!T{$0CxaH*A-z^SzR7kRZf
z6s?=2#aTHVJVe2vzTk1p`tr9s3e)-JSmrZ0v0t3H*Ts~TL%T_)<=Pd4)JyX#Gp5{~
z67l&-@?zG+8O;F(7X%ek98as(uRDI2TM?X&=FXDUdGqcK%OVD+<rgO2)cL8f#w&d7
z#RY1c&GvoJsopf1`Q*G<NjsBYO^M-c_N!j?EWCK$Cpdt8VaQQY_n-hrj)g+5mmD+p
zP58|$`_S!zV9A+}zs>#TR=xX>7{H~lWO=gBWKKIbi4Yy;g<7tgFFlTpE#vRa`~RW#
z@r8_y$!%`M&pB&2HXEI&bQ8YQA<(r-Nr44yj<lubgmZ^<>;Go|dE(i?rLaWjOuO6U
zxFc2qZ9gy1-p1EkR&IWF#<4gJp^%^2ZpSo!EnfA+zjxb|<1A&VT1{Mv-#}GkYJlK(
zIY>w)uM**6k>EZ*--<PCr({dr|I%U`j_{L=LIQ54H=P8w-L^M5b&vmv!j<^)!=KOh
z@mM8iYza)s*y1xeQ<U9GspZq2xY*Pupi=P#hq;hhd|=s`S*8EJWIj0cRY9bmt%b$h
z|3lK9BC)T&fsR6LZl~X!cqZ~>zh1KQ;<@J}q--k;jD9V=IK%A^pW=%Sa22~ZF1XTW
zf%1zPpBnoXJgx~{d;09#_b(YY#;_eq+J8TVZ^>gP`?F_-Q?K#$`ppB?9Q$Uu%RiIa
z^JT@Wd$#8!q~3~4Nc9Hocjf?9vmT7^Y(IiZhNXAh_+HFdp2;cp?c1^ia~Pb`FKyI%
z@o2XCm*wXAeK%}OZr$4Sa;f-_<?LU>^UKd%$as6>ynFTHWEKS$*_F;2OO-kg^OyL%
z1Q}JLbK*>nmY!V4@!<Kv42qVrr%k(NtFMuhdi&ODPRqhTW{&;3S|uDD`)A2Z{S}{E
z(#v>5rR{-R%b`^!_g|Ze-r=x1)GKnZ_eqJ)nNzoR=iE%Fx4*zDaLePk#?iCFI^2#Y
z=HJ^=n^E$t<ne_UPdd*@N}1L)&RFU7N6c#jZ;8u^rc)+2Z8-jKfmHi~B|4|hrRm5p
zaWgv2)>^o$(rL3$OYYTBGrnFve)Tpt@fcH+Uw4cTGc)@!JiNHfjZq-1s~J>x2yRj<
z{L$D~usHVb^u5&u`6<~CEdI%hPF@ljz5e>K*V(tXt$OPl{C(xlZMm~w-dZ&|YnR1s
z>*%v3%buH@H$VTqD7JpynLm6bEqz_PE}Cauxi?4V_x>MG7&(mZuG?4rsU@R6Y0u@|
zM$f0|8S?as@yV9h3j{E>d_O<`biVS{yf7UH4b2xEvYpS|-A|e>tTA_Tf8lZAqR&6W
zWIi!*b2F0z1`Zj~D-#Pp9a;AMUZGUW^|JR-ANU_%crjJ>_EZU}wd><e3im_`h*hbA
zXHXWU=-$#f4<33t;?`IHCSq=D|1!Ob6YLB1t#+NBB;t4Nr0~&ie7%0NFG)Ku-kjbQ
zD_OX5m6r43{Jn|aT-EdBr;3&w>2-Oj*R9afcjtx2j)}`<F8}}7zqng$<yj|(jD0GS
zo|cu1w(Os~+laOKm;H`_hhHwdxHUaaK*3~Qr@nN{??-jUzZabrc3wOQG>N2nTe;1R
z)5^*HMTY8&8HRO#PEOT6dcEb9J;TDT5}ipUpIjt(db_+sm&Th`t=e(o&pIB3mc9!U
zRl*;X9(Q#si_>v*2Mtswho}0@5;4<ZX%TucLtISVe~zAhX<5dWeg78dpR_QsD&1t~
zu<FQ#7u(ie^Pi{if<x9bNHwlMupz9u?+$2kQn}>JT-)Dg+ITs51!npEova=rDHXeI
zNyd>2>1}T3R~wmF9mxLog!2iTET@&1-aS4pC(w+*LghS>r)TFzZ!A{#V{TD9Rgjrj
z@af31^83?_O?K7J)^c7vS#1VuqTqRfM{b9DH+^<>zx~ek&WWq5E`X-PnsyfJzq{9a
zjUjQn*VRR;b8Qk|UwColq}A;dp5AF%o3uB7d~1Go-;1sk{$8PymcA*kinv-X2!evj
z<LLkY|F<f;8%Qg>+4bq4+*kj36YNc@etvqq@ZvwiW8R@x<)uPDJ>hKXW8pBqJL_^(
zbKixDt3wwm>+Gp}BT>ZMGB;F<xn=3LrT`h?_jfL2+>PDZ?&jUat1s}?(c{9z1<8HK
zpIRISClVG}W#!ZHbw7`F3jg30*cQHHj!ogNGd~wzd~%=Hd2#o0zo3+iko~hSez~Bb
zpmMWB<weAc(&O%K+oEM0-OY+}c&(g{$1h$aw*T+9xeg3R8J&`M8cy<?x1l`4MDg6u
zg%_6|TX<3N6i+YPxo8O~-SqIbCA%grNWOV^VW2U1wqv1k$(F{}a&4^*G72?O+m4H}
zIWLyJUwQiD!i%=M#ryuxp5?r__uzv?Cxv~Q1?C8psNBq(BcFPx4ivy3`#H`3Ez8ul
z`}5)6(e4gDfo;>?y}PX-5}t3?=G6D@)E(Q>RdW|!G)irAyI*<wO*fx_P>IUR5}&?4
zp@i3G3qV877X+=2?TT5w|IemR$9Q9|GYe!z?f$AOuq>mfPf2If*C(BS8vn|LSlFBV
z`qX`F;l&n<)Hb)|-!dGX3zSQI%CpV7`9KkN;_9lDd99)5`HQTz6@0F3Df_&2@}-g~
zOwCEZ=P8PW=UdsD?0UP|zsGs;`+aLUIQpMIm5Nhn01Z^em-SfNX{|b3b+q(?AZV_G
zL-z6Bd!_g5<7;1w9W&;4`mE`3TqxgSj!ogJEk`acym&0(L%^o<7A97yNzSor|J>$a
z<*3e1ozk)3anr%S;(XFq4$oh5K-(ch>4nEe7TJZ1nN=(H&Q4B#Eob9U^~~`_P2aA-
zQxi*4`6E-4e?O9ym$Kbo6Z!E(;<1GnKR-{gGrzIKUds9ERqK5}y%Mf|E9U6rFxQi^
zt9biH^7g%|+V|%1a(|vKKm2jy@jv?>ulzSTQu6n{zgZVM6tC6YN?Nb3sI@Bh<2E)~
z&1nl3pInff^#9*loi%HYR0}z1boW`xO`o#9w`h-En_G3A<?6U(jR>o}EkAU>3beSe
z$cppHuK1jPU0r_O37`GDQa}IQoZd8*f0kU_qzfWkt*cglJ;J_d)#>SB{_~T5)*W(L
z=s5YI+lvnAofieItimr%P`o{9(yP_00_ImKlr;3sl(RHDvAH~><dn-@*FOH<b2C-j
z+>S0?6{K*(>)^3t?)8_1S%3ain_sA##SgMP+~>#ae=HBa##&1^AAI)CR!f^n`rr5b
z)B6|scW+~JdeI@h5R_Q_o=Y30ghxfKSf^)W%g*8YGVl5!M#H!2AD?i3c3%9Qx$&O7
zl<4$TR_E;Z9$Vg-zo+zx$Itu!lD-KXnq)uE%irZf;nyuEj|cxP_m|-ho3*=o$+KTy
z-@f0IDcQ18@2u4~aE3g`E?c-b|HcM`bVY?PyG;(-zmBx1RMG)EfA0bNj~P6zUkqo@
znr(hwH+IqdgBtU;ys1n58y(N;;=;}T_45CH5AT1@lf9AuHtpH3>hItF|CpO9khYVR
z<7%%oXd3B>oBN9yMrmjE&6(5ot4ijFNK4(^pxoD|)vi=tsQq!%^|(;Jyo}UWb$e?Q
zsa0!B=hc_~S}(L_)vBF^kH39<+!(6OzkF$4&F`~|9y;IJ$Fiew0>@olDYFx6*sh<Q
zD_UbBm+;m3#mYH3rxnh07Je0FhZdtHIf?IW{w&(D{d@iYCDNJpCL6!Y_0Gx=x?KJK
zSjglXL3y(}_bzgD4Pcp~#<6I@jg5*P!rI^D7XQ0<^2zS<_vhyDA2xdPZi4ap=SM^5
zoZoWS``cN|=atX+B{t-LeP#V4+aiyvWm1y7?8nOH%St+v)WaCU-E{N2Inv)}#LrB&
zys7B6c;(&Qu{LFE7JqpE=H}=2|3~((a^==qRu}r^SoY1w$Jf5Q>|Me1e+#42RIiWv
zm6sRyht&Q0c+hhHwRLefXH2fuv3+}B&HN32?|k~it;av<>h|>0_iV47SO3hvK|0-U
z{_XwmOI&}x{FE!sC%dQc8_)fnG4bp^^X_dkt#+9IVOMDQzf_Y|L3tr1A$eEwLgg1e
zZgOls;B@<W1glfz#{RyQ7a5%FG#YB|X#}|~R^J}JM%K{eNXC}R>`0EUtp6Hrwbi@x
znLl~{x3m88KCP<HTi<Z<TR)m#T6W7NP{Luxy7@~&wd}Rak6f4=Y?poNZpGJ%;1B18
z|JXCz*XPCVV%f>q6~-G7vVF;<=kquIzwu=Ki(e}zpLLzRs_xgqFH4`B^GN<Mclh>l
zW8sepdjbz%|Nib=yg83-#K(WTQ`hg^v+p`{;_*vKCR!D}t3+f)!7w@8+pW)L#>|&o
z+@c)G^0L7~j}^C^;9eZ)pK-zJ+^=@IJ)f(OOZCoMZ#U`liyvXVZjBBML5KF+=lyG~
z*R6jT?^t*BQS1Ms`}ZmRi=1TW|JyZm)w%U|>~$T|gBI+*c&X_4A^YEAUwrFS9{t$#
z{k3G9-KAGcy>FbYV-b7z<ICbRa(9&q;`cMOyc5ZOvEs#wJ1btS2r7xO$_gpXTlf8|
z1nVJ=#gCItXP7+l`YOT^yjv}H)%w=~@iSMe`(4<cX(p8#?*4~aO`40FPbYFq?XN43
z%;V3`{NNF_|DJ3|ebcoS`&W29^%w1vug<%FZ=2P=2<fLTtB<5#KY2;$_%W`o34*&#
z_nf_RDZyvaVi5GY7<kdJ^v{o5kCIrO<g*iFN*W55E_dj#I*~DDapco|(bM%s_x{sT
zSNeY5>V3YS+u}F=Y{%k%Y_Is;lX*0MuVbv?q#x=X+<o0={dZ|i{Z%uIb>2j_#Ae$@
z=8135KRKN*V|SzO$z#^aZ_Jk-Z}>iYreHM__v5|nPOk1>Pjv19#mH4<^{*R`OPx9`
z%JFyA){6{>uAbz)$COxlD~rD&VBX)|l^-9?`d9mA?W*nT<M}P!Za(q+_PU4TU*?|$
zUQd}tZH&r(KjG&)JG(gN?5i{HV$WJ{e!lhDvu%G1ijxk_x+1FRp7vqAUGdt-j2n7y
zemd3NDlE6m|EiSu6YcuDf8GRJ+>E%taN(6-&emH^6wlf2)HK(!0>NWDL}bJ5{#88w
z_Vz!A!kp_%y&a1GuK)5x<HxBb(GD->zBtD7?!%M%Lr3gqFXlNrf5yHyf6i~e!sgsi
zpz5}G>sCeYvj1P0k2?Rm`s<ciX-K7k-Qvgg&sK%3;%#PUh*G>0`tP6hgZm%<-08l0
zwfvv?k<81<k9pk>e`zhWtG><@zm~`06SJYXtwpui<%a25**`eb-X=ajJp1|i;LJbw
zxnKK9)PDG<SikR9&7Yd9b(dZliacHaN99P&m!RCYM_(x$Xx(2QKYe5MuPaT3{9B)Q
zuJ!0?-)c2kM0RU*=*7UDffozU7N4JcYyW?FmX@@iOtRrW?`K@my7q8wx?;@k59eq7
z-Cg$e*v?|{KDk`2TO}Elr>1$n_nvz4*(O~@_LV0+p8pmMC|S-PswHYRJ36kmb3^;G
zJuyL&4NE_VhVs5PUS0RkF#iij_WVDFi+`*v^1o5=atfc{H0Bqghce5XcR8#yVJlk}
zH~sE<^Cy*`|5&~>Pm<A9*^zYnc78|g@^$7Kh4<_CvFabLZd*MmNst4SW2Z`s%7)HM
zc=(c;U4&yI{{=%+!+Y2F88z<Q_cnO{qo*4u==1#99T9ywB&I|o^=02oV~@J~KYp})
zY5W_rZ53O6hIQmV-IVz+vO*_aTA+1}^-Ms<DS7LxyUZsW16pqExpJWOqJ8D26l1-)
zeNRmdR#v@Cnx&<<)cCgcJ5K4He3v>;^m53UJ>kE?yp!j6wsu|CqQ;L3ZWaa=oT(1x
zi#xw9Ze8$rqAT~IVpU&%zd5D%Yv)e>4ocS`my62&|NDOH`h8WuJ|wapif})k%31jO
zkExr+V@b=pYu!(n{%7^)>)B1&wC2-mN!9oJ_7*-`{F3>%wcO25{S#m0na}+3fA_=k
zU8|1&HDqcDD3?C9O>m;uRO1c$FUwSvCamBKo@*aa`uB=v(^n2p^{~eG7ZN<TtEd`D
z@-6mhzN+c%crfha%QJm%MJL}|ecEHcdQPciwv7K2^D33zS!GgBv~%Zt*!)mQdeimd
z+`jOuF%b>BeK^YQ?W$O4%X}m3;v}}-+WYn5_k!ov-ml&K@9+DtB|a-aCDw}-FJ46d
zEx2EM^ZlOUee3)h4azPS22PozZe+u9XhGxNP5tW4DGZ7a+~53un|=M?vHg?In$(BY
z8GqLQQ>~MHfr0bC&d!AaeqOqUCPg2<-`{-9PDI(^g!8)zeeu_WRzBEuNqqio<6^5H
z><R}hpD~HdHqCHnf3{A4dBisDjml|EGv{vhecc&5{ec*V`rBj76PK~Sosjmo^11kY
z>2<w)SC7rfS?T%p)5a*T4#m|Cmjred?=jt%%=Vz$ov;17$Mf=ujRDgZEiPItzccV+
z;L?bSg$o@U4aBxC@D{gw^m~1FNSaet?a%Wzp+DbVuYYvE`h7)n{h^nej`bYMFj1Lg
z_r3G@;=ZOQJ}w9KJT3}q{@eTE&AgeHv%;5N(#rhoGLg~whuR62Cl&V=W|jK2Eu3|K
z+Ue{1_fE$qrqAOSc`hQk|Hi6MH_tca_ip9y{Cq*S#$)HCiHBDE`mVK$tI6<~!*3ZL
zwm<H7{U5pOlG{}s8$}QP=;FV}`*@<BUq>;2byr_kUsMsO8ve4iuBZF9MdhcX$J|&C
z&A5C^<04a<x**Gv9}Ron2HWobUeB~x-`r%4wBeOoid`l<)Ha!{c(H<MqsEKMIZRoW
zDf6;5>pp$lpwBZerEJ}+=kf_5tI}KEn?6f%jEUI);jfu&*Wa@y8Cnut+h1gu+=|(9
z@}ti7^>L~h`*yClaA^OwJcHX0UAblQb02?DEO}*?cVg$Q8z=H?K5O^#&S4E;@!fe&
zI{kdyy7iBlmK=22Clfo7DQ??WRxeK;VGdAc7M0!lWW^_aF)^Q+MNhwE$}>Owv%|tf
z-=&W2kf|r<MQx!n4#B{Ehck~E{C=(|EVk#votJZ`mgoIHH~aCakB^V$?@5b2V87OE
z#hn$BucPnRyp@Y)H+Z;nZ*|xFc`uB9FzyzAm8SB3?%l1EXGMJYxZ)wZwBY}`pGLiX
z2|TM~OuEbLx96|#a2DGTyT9z=gT`fdcvE<cgkGxo-rKmUY||DOJMSO2=ic7_(DShE
zr3JIivn*Usui0nIEho46=S=m?INlWgJQ=eUZ@z~6O`YncyYf%)yAz4Iwa+hT3E8dH
z1lJx~R;y~d`|OV%Z*C1gKkuu)z^>{17Yb9qG#KcfWKyr!UhBU;cYf`r&%5(8#aLYy
z-_n$tKTl@v^q`A@uGbFrPMh}a!Tg7_ecsKC4mDh5X;EHwdfnWFxY_4e)i$QQmR>*W
zeV>-<RwL%+j)kp{kF&)KEfmq+T|Tq0?^5cC&LVdn+vuH-<BsR}q(%9zO61m2i9P)B
z!I$qvA9HOL_D?*LVG?oC-P+aN)%~fPtGnxQkC)GvEO{hpyl(53l01bkj8;OtGDrR2
z#`y}Z(%7En!hb+SHZ-!fDnLFv+%+KWkT&nv)b)GcToAO%`?7J%Re>v8C#%0G&Eani
zTC@0^=FIL#_aq}89audxTeetSV}0V>ECweV59h`Y2NRb_-TRzz_~6$P*UGo2uGktc
zGrH&ba{b?9Ykyp@uygBLl*l6VDfqRx!iBvevet89C1|>;YVOZ}zh_U^(-hb>{rH_7
zSB#{3C%wpj!(#BQygKX4gR<11KesX_PhGUQPtfSkvt_@^*Y5mz<(g5I>G#_2ylhJx
z1V3lKN&c{XiSNXl_SN&Vo-UVfXKXz2FZ@R4=ga;c+ueSip74{8$Ge}E$C$xDBm2GY
z)>mDLIXkXAczSq?%09c2>ZJLX1?^V<SZ1})O{Jry{LIe6*aRm>Cay9oSc}-z{pqpz
zU1fiTx%K126ndDfqD~42URm|6aEjJ8os^LO2?{Ai{=Y8%Jl-q)b>?d>Imy!wQ5;ty
zE5EdhpUIwD_NFD+;^9MwDXzbJ<6d2}GGAsi{m1XA+UMMN)y~#7pFPX$=~FN9Lq~6~
z&hq(n@x(2y@XcaAs^^(ksNGiHT|eJI&Hks?%?rL~C(M1xWw*=b>AK*{I`^NL9j<=<
z;l4s68*6D?NeCRyxx2Ue=bM|`*Tsb@^sEp&a(w;kX(DI+&!6Ocxa0JSNsq#VCH@@0
zuwaq0Sl<`nu8EwRf;rwPT-mo~-myO6nC;(huXk10Q@Q!oa``CE(ukk4QzMjeRnObX
zzEUzSdC=<2ew20E#nTU+)y>44wP#$u^Vj}D(UMu(U%!4^V%M^?*Tj}XBd@Ba>F2((
znm>xu6&J3o{W;N<d&#%!(c*eCk(*Y$=sdpW!M|^-6Ye;lVKF)t@$J{@N`Bjn+R59!
zII8m{j0&Dl@n6aC`Hsqa`96VrraImq*f>OGAw|kmY3tr+-(CdnEO_{Kwz(*W^71bk
z^*U)iOML%MTXpr8@-0u%A8&oi=F6#`x7%9%YWkGBGn|v%&V72Tpy=?(@U`}qfS*6r
zRkY`5Xr_JX3(fKQ{*>p<?Tc=U6%N`~F8;upHpA9Q|Ei3sOyc(~>)%YM*_2YuaQ=bq
zt2Eu}vdd<j*EPN#J}{5vdtzmfMdF=_N4Z_I_SXG<@hSD2<e~p+N3C<E+xgAxC1tED
z6<roz^nBm?hQI1>-P29Qt{>k>uCY7p9e?Nh{QS4~EKPQ^?TOI8dhNlIQ?uVzINIsi
zeXyK7dC${~k5jXz{!uh=m|?u5zT*9yD@Q86>pV9GB|%7`vyGj*`Wp-P{|+88ErE5@
zdfk%Mrv+@a;e0-$B3Iz;7p?l|XS=Un?Xzz<_il}jgt1pt#K(KL`&R2Hv_vZ<nrQuY
zPiD-zx`2mC>itRS$V$cEmm8$s6fzx{P{$ZCi+k<W)6+bb?}#Zs6X&H{|30_#!i_bH
z7CBB3l9aeqBqZqkZTX_=pAl=f*ju)=72nL9wmHB0_t|HMn9hV~UW(dp!6Bwoe*L88
z@!H$EkEj2UQp(vqE7X&7V!JJ<9D<ZY`!gOkFzyZx`nRK0yRD(XF=meUPY#Z?PdZm<
zpY7z_sxQLPa$_p9_2f-e<@yrlv)1?h-<AAnNwm1W#c?*7wR&}r3}0@Dj;orN!IH_a
z{>8?RvbHZc<~`I=N|(E`<&<B$_&IULC+FtQx<Bo<tsmc?PsaPLRf=Ml_|EpYJvoi(
z=9|Qi42nxFHSesy+EBen$}dlI>-wo|;xC(zI=W{CrAke9;QrpxSLy%YZHbQU*?ZZy
zCQN-fkL~T^<{dM3`E*X1GVe{b0yvZ9g_L~RU(?X~`|_oCe?GRKZ@A$8Vn>YMya2VH
zf)bXxg@5+VdG25n?pD<Ft@T&<%<t;|d+Yb^%CD<>v`&Bdg}#baIj6Tid;CXZA?uck
zM~nNoXHH3$S9E>w<l6Q4spmYrmrP;d@D1JbKd<8Qp<ELw-6?fdan^-RpXOHH`S@T?
z{L-gAS3{TUYz;rqrRJw#*tBc@@7G6eAIoYkxua$OTP3AFDp9k^)8WLEB|l4!Y<2cs
zbn(SGuiwc}dal`98!7tEGm!Aza7pr|He2w*Q@j6X`#D#y-TU;%gEx_h=}``|&ulH4
zP?l9TJz#O*)S|_)pw`H(wX0t2$he@eVS>NuK4vHR1&=SWFmf!O8aDrne}X;B@1yJe
z{1klcoVgq31|AhwPe^(6WAPKOWapQk&s(fpr1|C0Lg#a0n%CF8o%gHtVb2`DUz(K(
z*Zd>*%DuSoyER4QQK8;R0ah)u@8(7a(pI<|25MHn>Nq8D-DPQe%eVje^Gn^*AF?OP
zO_8;pso0XXl>4yl)fz^TrwWzdrXFLGef;~yhP|&vjuw9Z|EeWM{p`}p#qLIXB_%|b
zSc_Z_mQ&txY;K#5`ojrNjs={b-EX(WHtVvRsFb|aJoTym>$6V(xt{y2_Is<x%z%r5
z5V-SV;A!y4foAf;|BVJ(FLr3ywKWJhy3gJ8W&5x7oDMQ2SERnkD`ho=OH0evPq|}L
zU-x^-_a$wYCaWI3bbi6&)6*n&^nKgE+sWKj_H9#bby-f}m&PZx_s^L~^d8cB-SedE
z^B+s+wAvNwT?^(o{#~&tXh(8^AB&}=b>{mmrg42oa$TcbHeRf;jVMV9SKcUgf60l=
z_|{4u@%I@WT}{iKKQ=Tn{1kOw{r$Mzw>7TE{?GWs5?R^UbT{(nTjvkAR-Zkt`Co31
z^=!6Ve+(DzF<l!wDS_Q-GN`JB6rrNB!EU{)&Yga|zmuzF-onSXo*a=#K6E6c{#RdA
zsr{=t8{(@z*-N#DNVoG$x#MzR8?*g?4PBdAn?gQav5K3pz3_!Y=EH?MH^1kym-L@D
z?a7z-%DOT47ta=t-Sj{I_3QO_CU1XSxzqA*mG#=CyRN<tiPZe<vANjfX43VWT2T#6
zUuR}}?rKl35Ls9^LvPz^U*B(@u4}S+csP|My{4ZrkJ{OEi8bf{huY(<7pBWBd;hJ>
zsciAyYjHDL-$}f`V^=BU_`fCP&8%NX@8zex`&*{Q`2CM)n}}7Bt#C4TV!?t%i}|2!
zGc7AUdE;Y;oLHUsr^rn<UA<+=kEfo7Z-4$Qzx!VQ&*=>h=X+h9u+vZL=EFDhjStMc
z@U71F@ptd(GT{$z1^xIS@v_9){=dtwnI65`8*aBX))p>!sB`>MnBieIrp5*H?&#O)
zPWsOkefnMOPk!4M8STX%KPYyx=^lCNIg4F(W8hRPzoV-bZ*Xkj3lx~H?;UWQ`N=Wa
zz~u#hB4ldMEMGi3+{ndtTiRBZEq|`s@?Hur-j`)x+5E(3$4u6z*(y_KO%X7A3>%}+
zGS{+NSM_FN^3kJQEpJ8L)C_0e;Vn7J^ILUG=iiW3&HK;os{Oj^vA-}++9x@gXFIr<
zCETkePPOsAHva5pwccr|zKynI?;+zBt2rw*)K{MG<Gu23k5PbaysA{MQ|->f?3<$>
zDkqow{A;i@;hHx+JNu)Z;bn!D{Ik`1jOR>OlD@lh!*=PQq*;RNrpbv&Pt*POg5%xk
zf`T2lv=Z3VehHk@6XPvPyyWycoLNZop-ggb>aLZ=UT06nNNadxYnW}2F=m^3El(k&
z<Vs#Bs0x@mO(xub&W(^jK~9Aj3GwTz#C`;<6caeM>c!rer+aVqoT!_V{WU&!{>!(Y
ze}=5oxY;NlwAR0A&Zg<{38FvTJ=f|f*V<2fw0^J59nG%z6<2;%evav0nIFKXbwv4y
zaQ@Y2zO8LfzOOz$+rT<Ad;Q~o@An(e5viW1{k8O4=%1TbFOMp>Z@jbS*F*b?Em1CA
zJe-m<?%zn4T|HgTFkXG>Md8`q-_Ok0RsAbu5#RZo^$f>!R+-+o@nQWJ(b<)pmjnMK
z7>JkJtUvO93d_!Ci#q#@T5e2NuUH1@EC-c@l(2C3hljbzbLjr$mJNRLq;tk9u|t_F
z;}R1C?w(Jwe^qzy(R?q~6M@QEt1oJ7Gn8igI=N4hspSo4%awILOMkVScFYvxnJJ(m
zQ^nL`svVS4z?Ht(#jSt!!zCqMxBL@Bxiz=E`<KOaxc6J(@!;swON@mC9$mQp>rwHM
zYtiYPkFTvWxpLZVar)gW@3!sv!xZ7&S5t6w#>*oU%tamQ9$b%9sS!An@pa!Xr{diX
zzFMF<Ie!UgSn|b;k9UffuUfT;zvZ8kyLROv{ZkuGOb82lGVAY}OY+5?g30z%yDTa+
zoL)U$d~u_%`(ZVaHkGRdwcpnr{JQbm|BS^7k^jEUo+r`!$o<m4*NhuiEN?7sSa(xq
z>!ZEfH7%{Kv1Kah)_p2G9vWb>u;$XqjoS;ClxVdJG0vJP@Pzr+Qj;31w6~c*CY_je
z<JYy<DXtHGIGxvB>hU4}x%m9)`@Y!Ju6^?$Shw%>B8?ZiR;xh87--Dp;2~pn{$HXT
z%Kd#hUmh=iyY;}sc*%DOaveK_SVjN-uzMpuTd-csREo8tK-f@(Ve{`V2aJo)Z&{xe
z6du5GIPG$jhg0mk4~hrv^u$;9Z~5#l?OessrtY>_#MSm^X7$Q#Y;Q8Z_LOFadE12T
zO_{i5Rl=PNXEWQ{wU?aQ<ZeHCne_Hpx5sL&a+STp+xGr-JK?`A%(c%x-nw_1YDK=u
zs-TjPei={*e?9Rq``POC^K6Tbv^z*tmh|j>!a4O+ZK&2X{eBS^FNa)Hsk=XKs<-r8
zuWK^kKGydue`9vR|I4?xZTsvlJ-5B*MrF}{i>DoKi<wMYuW0$_YCiqu{2@YXrkVH?
z>qnBT5zPM6Y(6jfxoA^W>GW$wm5O`P%M71}ZYwf9_x7&xg&(5DYa_y*GaeH4lx1zv
z0(S-7UEN)e&)-#Yvhw>~?yq0DTGn<{MWtPLVb?4=GAU$(0OQjcTi?vIoBDvo>Z63v
z?XO3lSEu_u&%UXx|Eyn5Fj&0i!SwmAi!ZKC%{7%u-5pYFQgN?8#a>DB)~VPl$1SWs
z*X>?j$0!^5=keT&FX}!TJz3^eWx;=bzV~yj^C}mFv&E(cb#CeiTmR>aa%N)kx2ocW
z{U2;Ib*Dz3wm8l!_J~Wm;{G;{tx0h&a`X4fHP&@STwC=`8Z@X69o2lw#I0{;rX|o7
zrOL2yfk(k&uhy@s(`NtPH<$CXK$Jsz@`683v8>uhAADf=H#L9W+B<^LZj0x)CYwZk
zdJ}woR=@SSU3ITSJY;wh&P?+BA^z!Xa^~tx=hV)Ut#MMlr(BIWB;zk1o0Bsu?ezUx
z?VPsw`=9I9lq{KlJz|5wkM#JX`MhiH)H9#>7|pg){hHPLgEu!by>~m_AmCAYeaiW!
z`iYD!*86<+*gnbejGW6YyKzz<!?6{xBpbT<(c{l*{`;<65wR1{>+0tZjfrvC$9Cw-
zhsF!lB_S(U92VH_FlX1@HTQY!ugrRJxJPqwpuoDdZi`uV#9NdEtg3xG?^mk9B7xa*
zPRc^B8m`^DJ1fUzmyN4j*q)*X&*g1xVlTJJ{EA(A`RxoF%_T3V7=1eX`FT|D^5<ev
zTPvQLGI5`Of4}@^#M`&o*O~I|52=5v{at!-aX-uM+0XjrG9`?j+<kXiGtb}Dz1K}t
zHguws`%|~6iyrH9a?alO<I$^`#&V1cb?O%;dpXq{X$ZI&nEH;{#wMRnY+~3~{hnUA
z6AEk}f<oq)^~!gbulTLn(0DLoN=?~Am%IKV;*v#zHxzFuJ^j#BS#mzA!c+1BSL}xT
zB~nJ^*Dos1-SWvRyiZwU`m2X8SJnNIlbF0};s!(I`YlI|{3{B+>HnFTo@Xc#?v%DT
z$7I*hzosI6)ful}umA92?HUhv!KEkGo5|b_(42OPJGIm*FGfIqdBBpOk}Hnjbl#Da
zn4}a@v39Adk;4n-k{BU*@zOuRB_W2pT^o<Sdcj@2nCr<y7n!@W1CDnt0*%lGu*B&z
z+&g(mXa$duf!=nXc(yrrBQ>RZ|9#qgWZjZ3?|nvRTUkvmd(G3H&>y1M(qXl$#w&8o
zo2%1#*7Lc|wft+lo6V}L^T*}~r#AjL=3J(uDg4X-@T!uDUtU-J@G<!JP+Uf6>!pvU
z?N%+7=q-EsDD0H0R{w>-rQj;W!rF3Y%CVl;&(9r|5ZLwH&HrLyY)Gfy#X#34raF~G
zmznKvYEmvXl_~iy$elXR;q~G@Cg<2^7v6lv{K!~SsyA)jR1V(RbMEWM7R6i@GLR|_
zdb(WRyZ_yxh0b9qtt#hx+|JLLCKq*j-d)yYx5`pIu6bKm2hE*r|FiG1IrG+=zQS^5
z(!Etz|J0NnFKd7CXaD*qb3zNkbp3ngUtZent!cGt4=6n>UbMLA@tbwAr|W(^eD?Ho
z9kbK=i-yXp<}7=$A}Ps$M`X+NhFL}CZRUU26rc3|x&3Xjo?TAP9Ut9Gx42>}@=bo-
zyUn&ZP_yW6*Q(`{G-p)K)2ym-a^K&#V9LRaFGab!H-E{^>suBhxBhRb;fKVxr|z$L
z_T+&5p?iD&e$ZPawdd{G>pCZ<cWu9;kh{X>`B&Rrl01Q(`_-4(e^4qa`#m+_+}5(N
zwLV@AUu>pV=Y^~kkuALdYSb6{ZO==1xK=y-5UbOFZC$2)MyGnU4lZS0FKC_jF@5(^
zt~tkQVq=fZ+V#aG>4nCAgI3qKudf~5f7a$_%KK$J98!Tk)|)C6eOHD5)1TG0Kgzc5
z`RY|G9^P2*sO0>|`;dXu(^CrrG`0I%N;Y3yvG{}o`=2G;YM=Zb$oTiVadR(8cRRH2
zxh8kdhgPEve^wbLXWBCEn-m}P@7(M^Vhh%q-<UA<<id*E0e#P6S)7w3ytQ@s=Wk1o
zsjsO2BzB17x)z&Nod4xxa~dA6*3z{!%y|`D5&|9yFkfYJ<WQw;RmhonwXa`YtydCQ
z=M}W8TgqzHL>?FQ+P>xYKb8ChHQpUkHJ8L1T*&7<B&Z(n^JBZ|e%<r~`G*heYrFhW
zabB|57KeWMsY=%29v!KLkJomKFJwA?*)UjLviDMd)UQLE`&NHgY9i75ZsxbC57{Iq
zOuiGD*|hY))r$@%8kT-J@SyBe_Pqa2jmJA~FMrtj>+!GBy5J43Pix-Uw{?|mLXWAR
z$Gm@2f9-m`+;7*LT(<bi>1<oit<qV1QO{86ZCEJSBUV~g=iXn<etxKRd+sr@|4}mX
z?^m2-Y*`tl*fU8)R&)K$m)ZvJN;BT&*jWW%E}rRo{gs_ez^jKg^X7BwdFf8S7V3H5
zW^=N&!mAsXH8yf79Ng>Ow@kguY-9hF?gR}z#w~$nQgbcuCYWULR#xfNSvOqOdf9i~
zZ_WWnlO3`mzixfMYcBF}k5b&Kre`5lpRJ#N*|zrEbbnKQJ-x64{ucw6-dWMy*VU)R
z&0YPSjr;$OQg1e=$U2wfD^&bfh{&$IArrgp$i_&KRgCxc@OS@@dGqkdrb!11Kd0B8
zT*VR`kay%}#+IV?ka(LPuh)E&>Q(ygwm4Nb&*aqGfVHL*1bg?DgqOwqHjIe-_-}W~
ztDwzGFWeGT*Q$GD$hq^Z^paia&rFUduM#_YTuC5n`zkL`|CC)e)SHdx#^xH!2njZU
zUp%tYRWe!wb{bkOQV!|jI6kvk)<)iPcipcojbC=maHv;)JN-;^sD32Nu?eg73=<RT
zXNAl5xLxmZTO9Iv30wGyg~>f`?B!p$Ple3;+9JEXxcd8#z0pDoQV(5Ts;qbMXT<3b
zZb}KC*B|(may)s}v`DwbTCVO>7cE|t?BjK@@aBfZ_RX6PF*wa%m>e=mJ*2De5`$u4
z!L;XH+Yh~n=j!I)*Yo-JcTxWulNpRNN>khfw;1ajkv)Eo*W=0DD@(k-E6kggYbLdJ
zE$8iwEfq;BJ#Lj%i!Qz}JeYCCeo>?3`s)IdqhB^&ZubeiwP|vw<dGYP?&!sy2~rDz
z<p8(vM23auFBsZJc6vPZiwoz_T_E(<#MboK9gCC)H)E~OnshL7+RmJ$&daA76w4uS
z%cO42-jw48OSZc$p486!=oBxjRZXglyylTZ4;H1nEoS|xw)o=q`yZ_LK2SR~*(Nf`
zXX~_S31{-xo0)#xb>P*KPMPSvMd!b)+|%@Kc5>+INsn0hM3%f*(cA}aO}o0YI-Q>?
z#=AIh>Z0Uizill1KYnj^{;hI*-3jSTmbC(FHcT`*z%V=9ZSjLePiAuFORW14a#QRj
z8>iozxLrH`+}*y-zl#6;wYIM_kFY(8Ib|QZ=f59IkK4^M-=AxQ8GIC41m?@hWOK>O
zU6%V3ytG@?DH1d`qXp_!xw_{sb=Yyq-EHxzJkPn0-8NN~te*I=@tS*0Kv~U~M1{b)
zoxAS{I{)OzD-$#2))ud_SjwfyD!=*jse9|wJ;Z&SSB5rmi<urU=yBV*Uf8vD(Zv^B
zH#1BEj%|sbCt9sgvbQKcZsMhX^80@4@4L6B^5cnz%kK2HKl`)mZ*#fqa{16zTTgO+
zex$HP;;PKlMT@;ab8Z&}6=H<s<rn#}wXE#4V{i)f+kelpwyI>-?a2QQpVn#4_u44j
z*!%3{>8)F@+?4pg*t6fHGDy;ITF$bT4r%p^WiIQ27iI3hs39$8w00}E-xB+PEUVmm
zAsNO}Z~YtgrI>IzcrBEg@=0ZJ;JG9Nsij_;QqL6<lbtSUZ}<O|#(#FUv*4zJJI;FH
zD?_-GL^(u3H37Jqm9u0LIQ2=@>R8sNmPhxeJ)eKmy7<<{(3R=i!XxH?`d({nyt?|j
zUva-Q`}gUZst#>Qu6h<GO=;(1=hq)%T&wJTxIH?)dZxPO+;vyiboV;53+1Xa-aGm#
z>$eaS!_r+czOx@n^uD_nYLK_(;Pc6zW)EL>-d?G@^pwgfjV#Zam^YK=En2*2F*qk*
zG~`kEB5PIj?M9|cNT`0C$B}Qg%X`}nyt#MR`tn($&uNloyVRZkX@%}xp%msfFXhEr
z-D$mUnW}4lef%BftJc3vXR6-UV>2&*%V59b?zuK&^+k=zb>`>hP3>_rw@>}_YDw0s
z9Tz@StT!>!n7m@qil>~@*7txd28F|mdWA3gR_nSY7YBwqKf6_Z=-Q0QQ!lR%cb~K6
z!9w<x^8!<D8-L~g=deHiU-RLjcD^?+W~Xj>6IHx<?z>xECI=tpx2K(-<Tu?qC80aP
zglqaF@$0MH&)v&UixT|yjn_G_TFvF@a`{fT#qE4vZi^!#yWAEp_m}Q*6BKUKtuBl1
zcRh1?dv2iYhv3XlE`Rpu#mX!NO*(@!l59zcLXUvex<G{<$<V(a<T-m^$lkSB5&zqN
z;@#Jb6V`uv%)ioYp5}cqAB!7)_iU~=$#zUtsVliTY3=$wHx_=cE_pd=zva@oJ`!8X
zo-db|uK2xfWBcWrt<}rwIv1`mUNzSy@YkDQ#c!)p*YDAg>NPXXt^8<tFr%d9WJXEb
z$&4$rVz(H{#pcCuD)x4%uFBBV)nxpZy?hEMsM8q=%5YpQZ!f)?VJH<EXtG<o;NsI;
zv;G7gzWqLUSNg5+4XGXXmu<PbudKJg@{E&J&ZGi{7^y?0Z`X)1ZK*uWZawea1ATjM
z^FBtNsX?EwPWq)V_h(S)*1uOZ4`pl#GmzR_!6+SiGDGCEL^FHO!Hg?Ls}AZ-<-4K%
zwbW#j&?LEpgntbmHQDX=6xi(-T;L)pBegJPQP-r48A%c>FI25oO_3Ir4L#M{)yLJM
zoqQ}KWNYQ4#UYI>Eju!<E;w|p&-4Ao?iWI<f1DDt_}VzX?!|%^-EZRVme-rI=1Ua6
zJg=$|b)Dx&>eoH@>(<Sk-|4pa`mFx^+OMjgmnMByw$*!a`l1E<Ig#9)wEvs_{rmsC
zLP^K}u2e6V566Q@Hw)4Cd(XxSZ_IFgzB<G()8v)rSJ3#?s|BEx{#4WaUv_3q%>*lT
zfpq~2J(9UE?jJvpvwQ!KIS1Gd7ajg_XXDhBTbiTh&RnrpxN6E>556}Z$yeik@BhuV
zT9o_M0maXutWPQqp5eMAmTk{1JSm7@ed0TJu`|Za*~N*CN0#2WYO!wB`G{mQsZzD`
zlEJ)gi(4PNaX0tvo8q<A!j6xv+ZWQz0FNE~-)f?$7-6tbLB9C$rU<Wj0dwy~vCXkK
z#2|V9VD+<pnXrG?USE0F_dHK!?)oP$)t3l#Kd#)VlfOKhd&04f<aV}q%pR<Z-Hmp1
znEU*_#WSIE%D2y<zh71#se2Z5_Tq&*9E~}JS-SO~O@DWG$<?|TNo}1~#4En@<;0C=
zBD~JGd$&rwUCsCBPjiMz)IQ%=jO!-!x@A`C*8Y?Hem?A?;kTtx(*$-qfR|s~T?MLX
zc{x&lO3D7`T<~;y3GXI$!@W~#QePOiOgZ=Vwser=qNeT1pV<4vj2<kK3D6U}FSE0o
z`}UU)Gd%V=@JJro8<w4V?}OroM}7SFj|+-ui!cj6niBl=Z+V})_3q7=820u?&b;(g
z_Wb!$8|AM)t1Djb$Xb3eL&TvpCiK^t$vl#5?`xLs`}gEoQjz`)qq8q>U;Y~$TGCUy
zGD!HbHS;G#m~zzi_DRmYo*|;7Rr@aUwC-hbrGEzni&Qqxba;3|u<^xVo;B0CvZwsh
zlU<v3OLs?=T4{2Vs-VY`0^zBF)3-%cNtNf_J+%MI&i3Niw$x2ZxxUiH65AJ-o9_^+
z-n8V#gzk=`E1v8Q{`QIcy8m1giC(L9OtqO8)<#Y|G`n$QQ1Sc?kzIWo^{=j4((<#g
z@Zc<QrTB+)KxOQr#a>GtBwX`&<Yg~Uvf})gs2cR?ipwd}D?xs_n!HygYUE!0Bpy87
z>#BBu*lmLa{zt9z!~TA_yYZ^_!c7K6KUWA`TleRz-Hh~7OD|D-g$cWo8qB$l_bgf@
znsIu{x<>Eb&g;9}%{4_Q^tNznWu`3-<lL#4a?i$H>|FYXPd=`d3#vb_`yiqD%1b=b
zBymoP$*H#4eb4)kmcLjLv{XIXL81?oTc=9b+P+v3q$zMrz-rw$V*#Vxp?ga{uH2*>
zE-lUbY;w(}{)ybj9;sT0D=zo%Z#z@^{nlQ?8V+UF`5cFqgsDwspIv1BV9%z1|1P`|
z-rVv0`+MUv!q=8AKYC*Fk{Hdi(U&y5a~5ZqXyqi{c$>g9#X4s~No&mEpQ~0qDBa`j
zKXuxKk2|tYrH8EzU3zCllz{wuIVRXFYbdA;xwklZ)%?XAl03Vg=N-;a`82tu=Ed<l
zMgQyftv&B?Txk+V`-E9SzH4V}-6GGi(xp}9Wgx>8h383MCpv^LQ8o>%nXJ)qqlCM0
zk=_dbCD%+>%TAx5+jwyW<A+;QT2BNwy*?wp^ZjedKZlxDnQqNKZoo5j(c-L$?vTU}
z>JJB1^0%B864KFqdnIb(3=YkcU76Nm2JgS0o_<#T(b{^e;C*Wg-mK_2s~5Cj@#M>f
z4;x<H`G4oo?fi)9ZRw9U9Q-%=sIdA4Lv33zjiUu0MGSadPtSgSzVP71^*rC-`Kbo)
za^&7Qx7V%zs#oszGeNfm0&A=%-twQlZuPN*sf!k$TCtQ<OyHNN704woUc7g7pQ^>9
zU~>BXof(rRC|q8!=7z)ZS4X+;1_xj5zh7;~uJQ80n)xc~5{pEdx^rBG<<unZ*3M39
zU|7jD??%XpEz+j8Z7R+BD?d#>c`5Nll#Wa?Q}Qw{P80JOHoN&@>ocuWWsh*>WUS^p
zJ6E^Y-H63w%KQ+2yXc+Hue6_e%KiB1e&PbJSkU+2BcEKl`c^&dG~{dnRYf4I6)NHI
zBEDn`kKY~bvI`SeFqqrcUE|{^5$%x^%*)TJ_fh^{YdyKl<q|gs+l_C(wAs||{QGAu
za(T|gHx<I~CLR>sdEmx8NmmPnXOmO-BRW~x-p;fOt>XCNv&+#`D`Ao7^ER1mr}ckt
znLZ8H+HS43_xdYYR&jgj&DW*x1iyT8B)~l?Zhx4Gl&ZU&wv>+ZM$xHp);wJ&{x6Vt
z9XhAe>tf*6OGZ*(w}QsNK(kMwTrG9($9vYji_~k|Vfg=GV#}wU?1${v#UHnt)cUS8
z<)F=n^M)EV@6Wt!bCS#~I&$2yJa%3-=eu1;QbiUEn!i&M@0Ve7yt`xVqzDaJ_SwGX
zhjYaFLOR*ZZf_GhcEIj!_yUoW!fLPi=U<&Wzs~1Y;=>&mXV0&hv(n>L`<MGc0lJk{
zkM7O9{GeXw)k;RGJHecf%=hSp<W({SMc7Q_zm^w0ufFXKdrfwQ;7OsDhm7HubRN{)
zE0z1!v`R!aG}Dul`_ZEbMhhWROrXlG(ID%E$0wFAPpw65&F1;pZ+7h1dnowN4;D$&
z+Xq}*q9yv6uX>ct<*|J?^H*wu|Ei!5(l<PRYg-CTovbb>{&3HSOR7ntcVoUi{8_wo
zr%R66+B-IzJ)TU?o8!H;C+N2Rf%E59*KF0Axn%q2Kb*gc-~Z{%<yUn%EXn9+sPpdu
z<E`@M@?%x)J1_H{Z3<sGMcR0mnp5*TQ0or7-1x<cAcZe-vYl+-lm&uJH+dY`SQ?<E
zG*?6Kl(gZMr_YUhoK+Yy^>hq$o`|S>n_26%e3u9}R(WIiES+Qh=~wr*UOnArpxN$q
zZ-&JDZB;Cb1bOCemy=3sN|(9j^XVPC&Pzwr`R9zJrY_UozURXlBhM#GgGzFQc|q%H
zA$XMt$KLCwmK^zdchZ|vJ-MN^|K}EeSNOVgvU>ggBG(7b8(wiw=Ux4!b<_SQyvYg1
zUEV&@UVRH()I7K^uG|!)nb@zT#5ViQ<*ZwcA&O5r-_HEiT50*cHM8qTY{Y{N{oz*I
z)5~{%VrVW)E82ARav<}R9=DZqgXV=^>ev&~)#v@_F4Me4$u3Jlo%gOjs~0OAW_;>r
zJoL1a^TGUT*ZI=#|JT>#o;f$E%BWu_${~I65y6x%hSQ!sa{;vrWm`6GkFipJ8tGmU
z`bmG`iL@8HQZ7uq7IyN2YmpD<#w`;YCMX-PN{{oKtfISEs5y3>^|Q{?E0(sM+4}v~
z-it9_H!m->oNzGX%Y`?Q6X)}T2BLz69yxA`m{J5@jt#1wm==2fl$8w@62AL5{>_5N
zD|MIlnL2!E=<{__<54UUNM_LCZIb4d+4S`2bB@dj*TND^s?Ob9GfC<8Gj+MicGCn?
z&X;;=bRS+Wt?joa`^l5ewy=JOWk+oj?S!w3^%UGVE-d@wXZwMJx38F1J^y|`e~#r@
zX2qNGza_u-M9rUA=g#o8?dwcwwr`;Z9UDTr`c_U`-_yVJ#frPDy82G_-delL;YEF3
z%=N3b*N?JT<;^m9mo@qGn!7vqR^Mn;VU}_~%F#Y;+8aCDI|<LPK2GvbxM#q&M5p%K
zO6{+uMSFhFzI5pA`~BLf5|`dZ7*wUKmcO16(K?0aahZy(giK*Y$&Sq)&ND*nmbNBJ
z^=_+u{IuD-yzZCay!pBA7vwY5#dt&9dDG{6cr6VoiFt}xa1l}xqVUDuYMFYptJD1z
zPfi|RI_<>drLz~#T@%OOpvR_RwJl5abH&>0irc4kzI@^>CMhN)=C9S3VPf@HJ5%xN
z-rLtx7GHcmzi{%I!VlBuf1En8Vup}vsA;C|KI{5*#fuyRPDMW#?dlD2S$WG;{K?ig
zw>p<=Jhe`e+gPFa>EW-HlWnwLd@0I3`*Lk+PpZ*XPc@h7R}~3MxEEhM;kh(ut>?Cy
z)DTd448dG27oFWFEvRv6j^tN)|KmaI%9hsSX=VL+*XA{}Ec}0=NqcivaJa|m{^z+S
zI%lLU&*YeB>85y1Sm);)DWo1`K2s)4V9^#suk`h8A7y#+nRw^;ZJ%>GPgX^$gmck}
zm)B>%ar`9bHE)*3)TuKBR(oI5&aHjwdNE_m%1*O{Z=Fj*w65M-*UA0((VdJ&uZw}~
z;0+O_7Xlj%YIYh(eVus1HKFUw#xLyJY-P8tlW+BIPJi<vW9ojXYwK@c*uQ;e^wk6t
zFUAWEDVCcqYNYy{IAtNHDc!3V`DD}0sk@Dj<Zrmh>pipN_UrWm`4K-)KAClYTCmdY
z;@8u*w5WStY2R;O73H>gYtzLSN4clU*Gl~K4q6$~{cx|r638|PaFx2k;l<P--Nk|b
zIZ`J5QdFFCAkXKrsra+gme0h?{C}RQS+rJvzk+n{yqg9K)-#^`R{wu(iiy{gs(T%Z
zmz+NFr!Kyj<JFPZu;I^J^Cg<64wN4_cR^buW5S-US)!Uw+gHtRxws<nz@$$_PkP-#
zwXR-j`C+iaA2fQlI~3H!37uECnCams7yD3-ldcxqtEVf!im@r$A#ncWg1Kv-1!X?A
zcvk$BS2iQU&tLhE!dlhq@2>s)yy)VKU}4uuQ+nMrABpxzK4s(BT>brlh0eqo8+;?{
zmwS0XDL&cdS+eGQgtBDsJRQw#Rw2roQ@yq-U1T~WF$t3K!Q|up)0#cgO7+yvym=+9
zrc?d$=k4%y7D9ff&z+hu*Yi*Isgpw7@#gvO{=bv{{8B=9azW<z>GP$<rtSZ@%4A*J
z#f+oY`Ci{vRZIw)SRCWwonD;CIL+V+=f<eJA0M)}KR=(VcVd6Z7me2S0z%DmUSGQG
zbV0A@MmZZ_DzjYV#;(5hXXp4DKL@8qXH8pvK`zGPo#KBn`_P_wLC2q6)v5l;S|7VJ
zD>cYzjo<=MDFwxk_iM~zO*wYxTw`DMU*?wE_p75%iP;Bk(M(C#syHevXV$=PH?1|<
zP15i9bMNMhD-sir-p*%Qcggd+-+!;D2$Q-s%B^f1Z;#D1?g_YcSVCrFuj4_1GsXUG
z5mV*nnX50a&$rwb7`A4S^8NseO$qnry$trASEsZ)y!@}uz08o0@1pCg^?iSziVt7s
z<?YvFx-PgR1UkjzK9#j)-P8IKAOCOcylLO}{C}`!{*q<K4;QDWm%h)6zq&=S{no4&
z+pYU`?^|qGUvli$eV4_7Y$CkVPnj%c+_FksSD-qn`um1{yIq=Ja_3nb-1ub2@74M%
zLU-BoZK-^Fg!4t!?<L>&tmkzTl}+BluwqiY+CTZXJNj#H2_IKr@~&Wh{OI-i-=V20
zzxO(UyKS(<U0>q!x&NZZ#FC125;|^gZ~ghvqFs7?$+5t!?5Xl~3Um2Z2XW5Ple25d
z@7+>xJzd`W!Ktt2&!0=aoA`QRmxhkG`Qg|J8S#@h_4r+xz<f)Y-SPOZtuKqz+@DWr
zN?M~?{=%WA%5$O3tW72@LY!(R>kDSoa(<q_B=X<Oy;F7{EdRb*@LTue$KtITdU^`+
zkLQ3^!h@pHtI=TAofmSl;Xl>8J{(%uEVgTguA6hn*T37@rdaLV86gunrPnP#c87!C
zt}P#YTz4`)H;_6jZ+InuV{1?Gtt}JX^Uvj<k+;lwy;|RN&FKTnzWV&!=56Z!(r$0b
zmRa7a%bGOmlYY(EWn%lkW5dj%#aj7CE==41Pya&91o0ngy8FUroj&?X`COmlYoi~m
z?DxE-*}fQxh$aVRnapBfX;Ul!&D8{6+<2MCO3P}M2*={izLj<>1@h+ocrmrDZNjCQ
zU(*-en7MEB*7!30+Gi(a<@fo2na{X%1M^gwq@s47EnJiOZf~5r|D)z*!}U$cQeHLJ
z{Y)nB&D#;YuH7trb<^`rAsknB)=%2m%$_6leL`!!tct69=nkfPlN=A)-+X^z;a7eY
z_I>f2Ya}Bzug{uY+|Ijc{iAZFKd*Z?r+3Rs=Lf2OZV}-*|Nj1QgAeO8=LcTuKl?j$
zsmc~cc(-Y)bSPKLy~U5aSn5MK*4p_T?==#)o?`RULc_IM#dSkMwpcL(^M%r_8y&4Q
z*De&BdUN~j@bzq>oNJw8u5S{bcl4Wah52{4#f%rl%QMcc&pp+<VCJ;ex+#kmpIUdQ
zaB;U<5BE#)yVk{0bI<=^&X=+`t9ZUf?(UCWpEvvev#(Bnc<<QEy0?E9Z~K@&J@InR
zsWZMaXYTav%A9PLdThgFi?SIrE%}-cpSd6+zAxJDceV9g$<x6{6;8TeFD{*1?zVWM
z>Amc{xz8=zeMP)1Bs^oh-sGno|55lSRrKNPQr=Y)oFZgW^GvLyWPAJE+!rf5SS$!$
z{wK6<K?K)H;a7irjw`mF7X5aCG5kxFw5#FIMbWRbf?b_#yI;C&(oXSi{`mJ*zuk|@
z_xCn5|C^m>a_e(%+Wq{$xAPa)XcaJN&$8e6qEmRwF~QLNzb^NG2v70a;F5XaMMlY)
z`}ZVSol3sO_scx{rLLLs^!NKke?Euu)hmCNt8ZCbpb-84^ZI&4o=wcVbES>B+;9H6
zmoFc)&!@gey6(rlFQF}=u@_g`a)OL9v8uXo@x==*29D6DM|!u09_3?Bww}K^`_mGY
zB-VFUo(e2af^J((-}~=XzI*>NyYBXgDbbhi_sM(91^*Oy>9+WO?c}Gi{<|It{klKx
zONHc>nD1A`1GF2(PTki(ZDcMbYx!S8VA3v4UV$yAKgK;){`T}l)AIQ|Zj1le%EfH^
zvfOsJxXoV|3yzm_d$=|m^DbSsUTIC@)T1mdZtja0@4WaTqohQXp(VAU@35A)gQ5$s
zK*rWf&74c0bRSB-6K{5P*Ua>ZZI^NvyJhKSns_a!`J5lg+@-fT*|6~O3AbjY(#&lY
zhFe$5tHsnX%Ff&Ac~`MndgF&VvBB!@Zws#f{~#;7Wb?bd-M$AiO8!4`%~_gVa(8?D
z@jjcs*Jl50a(fqSHbZmUD&1;@FAEl5y!hfpUg+Y*jT?Sk-1uX%dH_fLt-ZfhjviR>
zcIl}ei)&~0eP8#);{GcBUn%w_KLjK5UEh}nxjH>Pz4)Kx$(}yfIA#C!v#z~$JNEfn
z{eNAh*;O<8*TtXji9fyTgiiHi)4rND3mvsB<le^bXb|0Jb&>B3@44zffybI7@7N|+
z?Yfxpw&3qk-+j+cJ-L?5D}8gzugm@Jb4zDQuDS8*_x}HXce_Xmf)n84iyK=`J46({
zh={%7FvI7$_MeH*6*$Uw2rjEEDzn>F7yDUX_My)u*#O0i_g7B8RDApB#ICKom-#OI
z8En|5w>Wv@)f@Hyl3nNDtA2jYa$jokE7S9=HXlEA8?WlCfA!zyyH5oV`^DJc<p(Mf
zYrj~g=SW4}t$4EXVPr=09xFxRKvSVagLIQ!+2TiLB$@pB*#4)pQ0CVD$<dX8X1TI~
z-c7BHYdCt{6c6~MmY7)0lJ4zuJHAPqIWcfS@<(<5HNQUmW%|&6=jY#UF`;<2hKX#B
z!IIbXe;&2{WAFL4d#}~^={KgO&562WSH?3pe`osLd%e-m?_OTE?(ZYxOZpyF2Ku7)
zlCsP1)*SA)E^B%H^Z47_1#eW8>rSq|yZrt&-b&xy7p-SKR}fH+)0ffOWwGw{&xadK
zYTP0PFZ%N?I<PQoLw3`<A6}`awuZOfEl5scnf`TV`Q3RfT}Sozp9nj~QTg&om`rK~
zr$hOf%5=#CU2EA&tW=HvNy^&3$S8qiqYQ<dxl)lw+!i0P%#jP4`%Xjn=>BGQex0~2
zJJU4w&N{MY^0w(!Th2PK-kIuSJ1gk%@|a@RPm!PHsv|0eDp}n88ZLAjKA)3$OY@MC
zmEX>XQZ||5<@K2dH~ahUdQ}v*VEvOkl^+*nSFxRIisx3Hqx_&%x|VZa-$dUPW-nzz
z*r(~F6<$3q-zMt!>H1>#h&kV1I5SFH)XOGb>^`r$uxWqQwolJHFJ=_Iz7)Ru^O42U
z*R+pa2n{jau}HNMQWAg)v2~MK4>@Y2tqi^95D|XFZSexx$_7tg|Nlp8<&IZ&7DZ+~
zQWbyXKiU0h^w-4sSJW4UO!zN%iQ8GGb&_J4kA(T(XVO0UZ{wf2P1!!j_3hFn8`uAS
zwmLRgP5$;4O{ud^v*aIHPMaP5D(m9LWF7NmpDkxg?XPEC=Qh7OEzx1eho9;7mL(m{
zXLh}Rx1mE;qf5U2^d76(6J!oAQS!3W{<`-bpLMc?bGAnJ>FRxwV(IrPXN$G=ZB*J7
zP=CuaSTgI_+wCuWeP5R~Gp@Ojm65u<Y=K=dDC1`2nON=OVmOpBRnq*L*!GJW&py4J
zH7|$x|D%f+K7KOklZ)Ifb|~l7PKon6)qB~yR296u9^TTokN@&#a~^xCs55K&El%;W
zo96j>Z(bdn#(6rXN^R$%!%12(D`O}7I)o%ToOmFwe?(A%Pp0(S%cwQ)uTGxY*2sLV
z=AWkh0|Dc2e?Au}lwbb3V&WQ|+P&@}=ck-GaVH@p*=A3gY4_~xwxxddr!uDOKl>!?
z!8CK#(usB9#u0&6KRjY|TD+JYT&?h1?c!oSWaMx>aq7|P*{8+-uaNZ3tlIp3|MT^7
z1;^H!zm7Bh+8`ln^!2#|N4VjCSDmVdk?Vq_mY9d~ud4s88<zBLhjiVKzV4X|%5sVX
zuNjnZMxX3`pv^O-;F0-FcdeK$S7)B{`FnJsp;>FqCB@GnweQO<m=16M)0&l<I={Tw
z!J^{94(?q7vIn=@bjMXSmbwWqz5CJCr^2dtZuPS>X|>OvbS6%WaC%l0d1re<-K*}r
zm1`aMxVOk$-&$Ps`eLti#k*Phc8e!&y&)tUo63hM+D!z+?5)I#Ke6};IYb3#-MjL7
zo!)~PT$3-z8oy%6Ej78WTley3rg_|Q*%aN!MWW8VR*Snd!`yyLr1<{RE#NiR%Kz&=
zzci|X%j(<v<NcfM{!W|y>BQZV$y)bpXYDll+!x)Se{Svi|L<l$*?g?jlD~f0jignU
zy?lMEC!081S^j+9R#*G;dE37GpN&tb8wNZ#czCH>sZ)IF>{Z2Xi+%ojCWjPyZP|Zl
zb&z=S)?btRHz+Puox1PBld#TdyVL#jcZgnlaii+$_xJVx<5Jb&Er7+18)7dM76>vc
zZg22iSy}!3jNY3W$>%JSPipH=vd+Izur>K%LQ8tkG~4Sn-#oYcoZJ_%#j#4?^VQ*~
z;MaeQH5#`BY3~y5zPpUSJL~%F+9Q(_C+bJ?UDHo5{5>PE#@OihJnNU=j`VhV+LzdL
zh`h`C)?z7K_E^FG{r%(fZ@)11ziU@!@@Xy`>+$$IQ%^>3^V|1L>lx40Go3{euVYg0
zeBA!{IENxnw@J;vq8AF*!m%qvd42j`*67*m)ID{bcj)3X+m9JSw=+DSu9m+LCALy>
z^@)oU+gShA=ll!q*RT0EvvYcE$S#K)`!8!QNcd)CC50&b9Bv$X5wYc@aPt2`vpQX0
zM#b4YqN-7OzeNNuo}ampGctG1?<@BtZ@c`~nAw<PwJ}@$!!p+v$1SE}=Dcz<o^RMN
zU&ij^^|>WCT@O}xx-IrJopgMCJKxp)myJ(Xt2}VjQr&3yr}+M#%0FkMFJ8-C?DmA^
z@caF$_8-2>*Ry<H7WcpXmj2?v%C4q@iw@kf?Y@5;0u~C{d6p$=%dD8J(xkNY_|_>}
zjXqIxN}i^A$G_hA@Ai7nuqVas8~<mN-Pn`)dxznJLQSTJ3%ZyZU}fRiUN?8<MDMVP
zOb=VS|NZ=I_pbS}y!O4<xmz@j7F{gm-2e2#)1~5@-pt?MJJ~gL{)C;2ME`^fe0g$r
z(tqyhU+>qizTn3scSz~&ES;{c8E5Vp*6DnDd?<Zhh=%t!p|7&pH!R-$`TR|P#{9**
z-Q}*R)iD%S1}g>e<TG4+QQR0^*=3|68GC$f2!o7V4@>sH33iuWZoj9qRp4{bzv#51
z8A~fHepzfRW;c}ERGKR?p?sojP?1AK>_yI;?DIyDn$>;r;)@p@BEqKxw){|4OXaei
zq5Md1r;Bb}Oc{$PM`FnA)c+Tb?JR!O@+2(4SL))if3=6@`O;?VIK}*QwiCDc+mayk
zguC9iK~+P-O@Ld^Dx9@+%N{4Ajzw!&p3lx*?AB#j{J^TXD#)ePHQ4ps#<}McJ&H2>
z!yDWJj33|0|M*$%@stw_J65cyIk~p0@6Lty>~-orUY|-ORw^D;X!q}Gi}<@=)z2n*
z_nh#k=04N6d@ax15CxtTN4xmaiyFK|hxR{?-u`Z$q3ru3s<v^@uCdSNb$0cf-py%y
z_GRi#%PobASeF)DcmA%;U;MbCj&b{oV<ESnAMw^ZVSju@f`g6s@iIH}YYV;R{XV(J
z-HqMz{gpe)wF^C31A7bqJ?`J+*?;%)GPQf3SbvM_EiesPw_i8<Xmg*$BE9O@Uu`$1
z3tp0_lRmyZ$8tl-$w%+>Rd@7xo(TWxyXpLvJaf0}PmeUe6_{OTTQlRtgiD`JtX!)l
zrT{4iKt6e$->jt-BFoFs9$KR1cb%8%{?4@~_EREvUaS3^x-PWn<s=>JcC&N$`{bTJ
zzY*5rcy^MZzeLNXrRz)6Th`xPbM9n#+%g-sUrx=p+P>-a2S|Bw*Y|V2Vh;be<bV8~
zP@~M?gf#{|O{;%g6wJA8m#1^g^5U8k&a1=P?n^{;#J`sJpBQ^#-rbz2e}3nmOi(%4
ze~Dk*?z>NB<&%Of@_w2@i;S(LWbdxcDk&*VP&gBp%GlyM)#l-w_D%Zgo;ol834MRp
z!gxw*%gsajA$O-<h&mJE_P~9I{MxpYWxl*(W}!6?m3~XcI2?X7C40TqjvC4C9W&-V
zu~uF7=t5T&-_nRfDgK%ZyuT~2kGMC#V$!l1UxF31`hA^OHP6&Cp3q{xsBe>=Z^Ue;
zY>k+;9si#gihk=@b1F3OiJaxhSMk3bK&>foQ-qJFCAG2ds^~u7@|{r|9hB4ViP`<0
z^2smlPL=WG>RFdhr<nXYviQHTRPF1pFYo51H034l-)FIP#nlOVj%6M1&f6*3GHHF1
zDLcpfT}k7pP4&xwrR~P<%GqJ_|457fDw;RPb3y#{nEDt0RkB2NL#{h0Xj~FEzs{4)
zzOgFe{7qKfxGNT=mdYn%zwn&SpJv0qc1i&6tCCav%jbMLeE<KvrDs~)+@b9Y9Z!Wb
zaZgiBUKQ;$aJ*@=WLAew-Zj(f?en?bUa-%*zpST4hn+Kb&Pn#it*3H2u02_;CthSQ
zf7<g6r{n6U)_PQ{%P8fyXFYUHsxvt)_vz(>I;X4`SJSt@o4tP4t;y#@BKj_GdSsO%
z-m+1kJBDZDw2Q6h?YqrZxCMuKtuv5f<=8A10SPqQ7ZLwnywIvs&@nGrlDRzT%F6mx
z6ZNKRM?aIhIwe@|K$`?d$;CIv@7nxV2`_#>=jNC0XA>T**59<pCFAjvoyVo5Iu<4$
z=)c0X!LeszO>Am~(4`4?q?Y~gP?&Q1#gfzdeq}4PG(SH1d0cdNlmXLO-q3aN?SK8}
z*{0tw-(Fz*<z3&wj4kiK7p3!lv3vfnTEdf6P?g_r=d)9nHid`st`!jw3xbDO$yOBs
zzI7`)t}Q59nR8OuA>rGr9WP!KC7$s7CR_fn`uVwo!jlg9O)k6eWZtgY=Nn%&+a(r$
z+gq-9r?u^X&U%Sk7X52tC#TkXFei!leYj(D%*;l>;HLdn=cx_s^>=i=5A{@WZOi<f
z^UY%CpOgRpw4VzqNn87&^F)TojN|QUYU0H+MH7w%^SrQ#aky~`)ENOKI5+q3GEh7=
z_nA(;$$8<<i&s0!f8LN)e0}niD}V1p&v%QRjo#Ql-j;XfT<4CYcBiY1%2Q9yyO~ik
zq3z=lwzFaj1y{N){xr!k`HJQH+2-PwhAVwv?tCJgrCPmHMf^FVlZ1ZyqhEK;&qk%^
zO4|9nY})*8pR&bA7t0B2e;oOAwB?R_<%J10A1`%#>CIfMmu^z!l{p361^%)iS#t4W
zZ-*PJLXSB_u)TOu^svh4^}5@V9~VtIJzYmg>Pp(lx#nekm-F`I{d?U1W|mFo(THm{
z>=UPIq|9Kk;Vkj#c>27(>9)m5^(hx$Jeof5`Fvr$U(ffr%PT3*^YGX46pih$Te+n(
zVxz_9Z_zK5b<6hOS9+1kn>?*MzNT+l!jw=OC(gh5S@m}N;`wAl;_P)7{N(R@w47ho
zSaGe1RPVa$B`=no{>QL?<@MOTxnDG5TQ1aT9xM7Xb-j<})QcBifZE?uvb-%zTl<`~
zHZez^T)g-+>+^!^eUaS9w0vH8R{t!#eQm+s30w<yf5=FDe^Twr=3jBP$+J5G!e`xC
zqOBKr`PnRg`*Vu-|NUL5-tg@6{QAG$vIR0{&#Sj?Ele^wHAU+8XPq36#l5WtY{{7l
z@ss+#oG&`C^N3x8`F^X4x}&@IMm;fEU}_h$%j$Uih193N-*?`rkcrya^z+P><sLG2
z8;jX@=l*!O`_J+ITjxJ~Z45JzvTeAiam75>>(V|B*NMIs5~e(F;)^!QFnft{fJ#jh
zt6kAoQx$ZCOV;RlDu8+y{@YYO_?F*p`8tv9Apif9k=t^fv_&UJ-PzIHeenf{+mBBg
z1{y^&Oh!B%9_E^JCagMikSC&{V2kSd6eFqD`zbP;6r<y8o(N2OcO|=OL*373iO$pZ
z{<LbJ^e=Lk>Au%L|Hw5M&Wf7MGUHFHw{mEQe4m|UJZpW(4p~+U(GLO5I}`lg+;C)2
z*dN#S>&HHZ`s;r@SIG!0pC5DO_>PTd=N)KTK0n0&)35yfep0<^-<L;DdEumaqi5B$
zYw1=y76soA_B$D`>Qf8NoG*+(?Q%XnYmmqOPmZoEk?67gSnBewS!vOe26^T3t9LFJ
zxA(4cUOvBVy~^>-pzeZ>j?Jf8@61~6_jIA*CXJXBE&gu_g_Y;c>+K7hrb=!v_ns%m
zJJYA0^`rXkiyH4$lRqg+mOE(fXQ|@${#DGfrQ-UEf<!?{u}__eqIFu*zrV9Sn?38y
z9h)suL64lzA3l6Yt1jRD+P}ujJT;4U9&OWA{8|6^i!hVU{7?ISem++IcFx!0m|ZUG
z49?o6Ui^H1lluBa`f5vTial39Ht$^dN_J}FTYYxE6aFhgvN{?JiY39FDp2d_MTSDo
zPpQaMDV@Z;l7-xB|9w&ZA}?b9Z)M-v4-UJX11{+n&G>hy*V%XKMqiP23-|w@a(HKD
zzm3M$_Lurq`l50kCNjneU*wy3Pf7G-74lSVwD+HK)qT^+;9pPHyZ4(&_4b`iGpS;X
zZF+NFyKF`O)Ha`q1{XxP242l?=J#unpTK{J{W0tRlXqNMqU{toB!A1BY?)eHwf^6W
zW(@;lmsK3@U*j&7X~zb}&eAxU=szb-lJV@q>j#^I^LMCi-gdJx`)<L!udf$6bI+?&
z`hQMi*B;rjv=GxzdQ~Q=;!8k1zh2F}m1_lyr@34W`Io8y9iu4uvS9J*r;QV~d4?Wm
zITXdb@Zv_-&5{W-u33C~VeIc~n&fCOu~dCd+fpuj1*P0K*UOJq@4d)Sn%t{%`10Xk
zGhVqB7xfP)R61Pnwlnlfo$>v~VWvG#n0?d!H~oCF(|Ep{^D-OP13VIKYxn$GVf;u>
zIpyH%ofrI$HB|q+nZVhcac$u`)l1d^-}>_JO1))m-Q{RhV7N>DKI?}@rIo(BAKrRl
zHJ>9~+0KC@`ww5T^VE(NjwZ|c!{uKrdOnXc{L?FcJE3Mxp@5^_4U2Uyb^o5urche=
zsln#+d!Cz{r1gxdW*aUJtZ56HuWE43TVdw3Q_F4ktXi~n#rZps3bMCv9aDor^;CWV
zvBrxlR+sQfUyK&;zo556_~`!+0e_3$B^_M2wsh+m$GK15$fvmStH;)u)XPN$@;fHZ
z+xTJTl*5zQIeuK6)Lzp3GHHr@#jkw#{-W-ln`sd#zr17Tu1w-)P-Eq1n7mB=y5x<7
z^JiY}x%{iVYSM)T;hA2m6YJxedKzC?&HQA*d2h)jbz`aCOQ~ANXZ3}B*|+H0qU#T*
z2(Rl3;g;N0TyI+xAvf>Oq?4~6WG$4G*d;tCJ1FFw)r$I_<|5t$T~=z>`DY)f6S3@*
z%oYfhU#2JOE8$dfbD~{T%%VB&8~A;7gM3O3m7K{^O*1)lU9wUtc;}OAwVy?&xvHk<
zUS1!({M%AHNb&~_jBH{~tSowL&@U(@``>CU>!wA8eY3BmSlw?_?e;(Ri}fqpN8M|G
zR{meQP*3bIFWUmXlSRy)x@N)0-&Xq=C%Sn%Xjp1owV0B=P%zV~`}dDGzVjx1J)$^A
zRHM7@sD9S*mckNUx$KMw=jQo(&1AOU)KJc@(_6BNeUiTTr2V`r*K_P=$yuQE=<X_Q
z7yhN6KZmluIQm^=mlxyyC#xT@Gi!hP()+j0!<IMA#nQ;Cz+>tH^~vcC>GfNUg(nJ}
zmS^Qui}l~RYNk#olj7f{6YaT9&Isq=;9nmZn<iiKf0CQy;>GN;pne>`l@!Nm2HAEA
zj@~|2%@&5B7j;k4q)t7mEBE|9{lbMEtj~{`pD*6Y9slFb<rx}z(xy$<PJO*!-_5jG
z%s0}gi2Z!51^dHivn367v3UMpT<pJgo<~9bq{6B_Yw{enOnh?Mlt<>kGTY5*ZPUD$
zop9lhvhESpS8*0p@w&V0vek;2hG`tZZ~ZMQ&rN=LB;)m)b()i#4VJQ-cv#sSQdrqA
z<HCyl7pJQ4et-P!?c}+8ExzZhlkAe~xVxh6yvOB-=4VnJnl;|;i|I9KYD-r%+Fbg5
z%gU4C4}~ulFaA3-c>Vra$_m#e-qdKF*&V~#d*xNX{gZC~L+Z=QcROm|<gQt27%I-z
zygugS=Jz`%ueaZEOd>b5T`Qc=M1nbC-z|o`pWB-Lo_^CT7ZP}l1(roX{oap@leacr
zxFhjo`k5v<o@2VYN<4QL7QO5deWT*4YMSON_UGd9{Nw!x8*ep6$IUXHIaMf0^{KVW
zZqM)-DcSWx4<71Gex&*7Sa!~$K!Ir-#>pEZgBOQ=;a&AG__^{?exrwf7yVFt!_qCt
zlljB8q3KkOdbZxL*(&uiPI(e03`vdJ0-Vn7Nz;lx8XEqQ%%0S8O5)z-6Dvxbez__x
zU6%AKWOn<L9=Dl)z0H0xB_}L#vE29gfpv#~u7q4rPv;ko+9f8NHr@VnTweD<tzdJf
zVwO)JKmV`EJKtDOvFN#&u|L?)Q`dOm#fx`Wfu<RDhw`@Mw)82V7O#j|?7#jB|6{B9
zn|~d)%P4<Qbn@=8IkmsyC&@fz;8bg!+M~MnUHvtE=3j!BHvBmHe1iLg+O#{@bZ2;~
zy^UZ=V{%GkUHtu#z^odJ0I6W*2T$I0h>09JC72%JveH}BK$UBu51Y1BLPNZ4_av@^
z-jTkaE*#u`g{RxgC#Yi6l<xl7{${596B6xL?hedXbn`6z>r#L62FJy3Cs|keD~4UL
z_~T~6`nbbWLF9aU`!mkWU#u>UzU$@}R8_ft$ud+4?ql7by-#c*@6>Zy>r{`)&a8FS
znqG8b>C%Zu`GTBTTV|eqfgHi7uXlVhk}B=Be7%L$-|kqg@!s6TLZ|EJR>*jr>3*a%
z<;Uf9v3I8S*)7)k?X96(d;7$$!v7Z5)!Vf?mP+T{@>)D^<|U!8&Lx7;^~VlOco5Jv
zg>51Gfn&OLChPwkxTM;(-214<6rXLESS0%T3$D*_zdu3h*0Ix^`hh<eJ!jtW$?22+
zL&k&;r&Hc#pJV=>wPxeZBF?Wrk2<+ntMxp0T4X()U+=13#|K*j{);-R-mLw#fWPGU
za)pzAt@C=a+!Mdgn)T*5gSvdA(I>`x-0K#exV7T)q5U?l>-B@XZCKf-Pc}K%>#DrS
zp1oEmTPAi+YW&uzt;`EAUIbSHplJtP<`!ow8-Z)nre9o<{l+r=QqfH5sM|XfckN5P
zA&_|HNBuu#9VLlNzU{|Mzs}M&maG5s^ZCj2){8o8q>SylC)y;cERH$5Xt9(dYg*Nb
zHxsYB&Ux6faa!lQJ*6(Px43>AXHB)45-0wCCPPKfQpZjQ*1y#!|2`CM<z1p?dw}Ol
zQ<jTv^3DS<P3PBFB^~G6)AVDl)5Tvthi5FEWww~bPw~RZ3=#EtFD5KkxwE2&%|FZV
zss=}Rgzr1mwJ`++q1zOhV*efa|6y~F+t(@6w!WSE=R|6chsW}bMI5L1y;^lkgab4a
z#BT-a(a4qfupfF8I?cgi&zpt|uJ6olX3sG3+xO_w28+eFd%5S=6}{RT{`6nvt^b#m
z-hDfBx-p{XKx)48Q69IolUCc;#9vBES^e+laqkt+Z2vT*v5MP#t=Oz@`1t=Ci;4Xc
zyiRoUe{3t5RdS9~yzFAvrx((-cHc4&=!Z3|u26nak-)r!QFs|waK)1i_7i5telON+
zYnkU0V&U{>a+`LEhuN{$xhvjZ6_)K;mwe1x@XL>a=EXX?2OlI|$_SAU=J+0Nq~hPt
zRU74E?=w##=<~&1=^M8UHq-}gJaXS-+J=?JD^8Te#MVd(?!7nRK4av*j0MhHS!ZrY
zzIA4j&Bgt(2O$+cD6ZX(zj27zcE@7Pn}!RmGZk%%?rc6+`{16&a#ij`fxb(7EzWHF
z_geq^nK=h}e>EMKKU-XLAgKJqgeU)gepXn~_OI5w=KI-M{&tH_7T;6mZ<=f974t2s
z{G_9>{+mm0e!ib;8vLO_Oq|)9#my}7pX2km$6Xt~rAjm_x!du6`1MKT8C&Xg#giQM
z^?P4G`FHE=LH?VbY{jxZMvKKX|5Sa<=#=6+*jVFvaE5%BJeQeOw9n(GkrCx?%bhRg
zr<zE;6>u|ud?-P%(E63bVi)#5$%m4*telZAkQBW5Wcc%gN6)jKdFoj3bQS;aH*;(R
znN@Cu-E67$y&>N^dB1+2=Ie`-b*?Y)d+S*OD&;^Em_|xs3@uOF`kZr3qRLp=SGn`?
zc)u#unzHw2znx3H)b^L2(MNyH%YP;x9CLBCddc_q_R&VKuFYgW+xX+S%TecV;lJ*0
zdA&ZbjBV29u6Z>pKE|F4mXe+$FxA8{@|XR=vrqH)&9hOM+it_UHuI9IcvkE0iX%!%
zT2D+KYwZvS^lWhWarODR0@?d&0{hNCkdK=cC@lVnW#W{Z?b^X=8!s|#SNW*8&-L(k
zzO^w68+UE!2wOA5eUa>8CFiycb2jYfG++ELW)4T~q*;?$;}%J{M@M{}u$q@EMJM|R
zo0D!tvo{kw-N&*yt%|ugvAKWEt1J5$9v^yM{K_=kXXmR=VwO^Kiq|A6f8Ug{(ls;d
zuX%jpiOyQ3|3~=SE^IS6;mWPLi&um_`0TF7*9_C=-FmZn!Pkevn`N7icnW_%Gvi!>
zsQ#(9bqAQ8G}U6O0tIxRp55``rTQoNGOlU!v|kl}y8C?oF|)OQ-w0n@7{IsnM{D~3
ziv8ws>Wc&KC3rDsZI`w%zjC^8?)luCF7Dxft!=+XG8dJEyD{HiXm`X}>j~Gq8(Sya
z?mTnJWzV@C>>H<gYgnyaZsE@MYEhg{#V)Nyv3ib<>~4$xWPZ=%+_P~}V5Ef?3rFV6
zIcDPO$2-q8In{d9Ur>v;Dqwx|$1_MZOOYvg^|r!Y22xA2O`_7Az_aNQuU@<`5|}1s
zWmUPzmdnQZderx$=^D~^8kG7k?CO*|WG`;}`--QW43G1Qi*NHIj(DftzhkNMDZZD<
zXw~*dbLUk{FW%c3s`2A#NkN>5y>uPh&z8kD8PBfpZGOMc`C~JO*H8Y|K6bVh`XVO0
zuLWeK9`|ibp1_`XDD?e)ao6ClVw<+s+FcNO|1;%O-$DBVjx|oFCbxH)J>AaZ%EQCh
z@RQrlW>Z;imct%{{&_*Jp9Nh6ukDNq__m;S?xd`zzu!OYaqE|JbmHmuj(@Ai9C6QM
z%Wrd@rc;@k-ww=F>s+R`#cbUyFUG`WTIwZ`VOTf!>5UsYE^It^QaD$drz7zBvsVWf
zh6nd%y;|{PWAULMZ`fU4cwdzkbg&R<k&Iog-*-Fvm!;>z4yy|WA4PlIqL+x-|JTu1
znP?!Oyk!}S<r<es`=^}@k7?Sla=u}0qJL!VgQpw^wRHN9Y}@#J-b#t8MJE@#KbUbj
zf7ieD^Oj$n_%70MuG}nc+l|HU(<az%`e%B{v%y8|v}D<}_8GU*I6Jgtl3slcZ$Fxv
z|E$OD;C{*N_hfn}dPw#9?fj;-w7+1bLZtGSjr_KYT0Aq@*`zp=66N<~Wtz9vaVn}z
zxny(gU1)UZ#r?s{YeZWez^(Zgj^N=)hZ|C%>G3noG}(T-G|!sIJafV!iFLCptIZR7
zZU@&y?ufP9P!Tw<*<eOHi~AJ$*xVi21@F0QRm%_m7k<F<d09+lWW<ug!f#yS9*ZvS
z(@6<*SfVja_p6_zNC>}rbBf{OKsono>lXG-Ui0Te_Cwi^>nh(rv|ab=vmRro)ay&k
zOfuE?B6Czv&ntdbd(>d}0<HQImX?l}hrNw=a-Nr);5kvw=l(?lpXbYc+7b*ttc*Oi
zcxBMDjV{(nYAlz|@B6OTB-vT)aZ>cnZ`&=L8+`YD+H_@x*HT|2St-uG|MM?uq%HAW
z99Z!2y!(qrU0;#BmkLMa)K)pq+Shd@L*$k9PsG&6Y6FEML8{JEEd}_tulI=--CX&4
z-=8_rp+^Lk>|C;M`MXm)bWcgIXAC?bdP=T*?}z9$pL2iD2>i03?XRn^;o?B9XH)jH
zv4}r4(fy>Q`_*ir=^2$|2ak)-CC|-V7S<+VD8l+@%cfkHxfAqDu6{~;DH8kXQ@0Oi
z*RM%sEA_sXvF-Pr^ot`_C41r<_tMx;yIaq1b=GLQ`%rc3Grzs>_yhZ1@LBanKIdkY
zRrFu@_2gOCbBhi}ckB_EHDRGeX--?Cv&#Ktmzd1Iz1NPG`W3#|ZSk+PMzf16F0R<q
zs&K}|>j<lge*lAlSMtgq`*yH}HWcSZfo2>of|twuO;uQON<udK78ghChn{zbHd>zi
zrxRsc$<<pUk*_qPVEf)*hwX~x_vD}S*4I#;&3-w)r0ZXzNmtjU8)=-uuD`W5)~8Hd
z?*5sx{?4w@J{{dfO-2{n<$KO?NlR4rx-Aq*4Bq5lA#;BZr)NO5SXkIR%`aA+IaMFL
z-8_$-YoCA8ihbK+h3)@#=ercHyvZr`!^L=tyZ1b)+dpNL7!y4XO!5{9QC^@w=Wy5e
zD)(7V^B+t}5jwni5&O*2>u+Z<-8Bt;+~K+S;=x2gpQRry7#6PP$=cAc;Vq=)T6N*#
zix;Q(TArTmb-rtKE6jCSlSS{l3mc!$nfNi%d-wj92W*~~n7kI5Z_~b*=jrp)QsLNa
z4*hx~sa&4NX<=Gf4?6P>E6ouwElgac<?}REC-2lmE5UaH%!@BJsR#%$$|pSyelAp6
zrG5XkZ?IB+@3)IO8ZRDAUUYv)=h`Ko>z5>kNKKj<;2L>1$XH~m#Db)$zQ*}`BVVkz
zw4K4{^2&1au%b^byJws|y<UJ#N9DJo$;wAhR_@FA#3_17VR2x`MAsElOJyU!&114z
z_7Bu&Nc-4yVol3|72JG}yPvi=>$%<R76;d0pecn^1)k7zFEUyKuKqI4+#q~*zNKo)
zCl|}zDVk|}XS@;mdUns+=$eH0ZP`oK6`WaeG2=>w@SKEa6I_k9E?%U1QP6<d{AuJR
zwU9Y`79B_o@rf_%kv^?!&2pl!<oJ1?TWhTIwNIaJp5WFJW>pvcHFQG`>r~FbJ5kZi
z_Uc0N8+msx_gz{4d+n2RllAvUoHE{Dc1!KB`swqp);-zyWUBaL`T1LtqPmNxKXv`T
zq<Ds2a2z+o<i6$S3;!kai<`Yz@zLqZg9lQl5)|`Wv|F@;SvXAQ{n+1@xbC6o`)^)y
z?Q9n_&0}6aX#cb>QFJa_$s(_LoRIZ1kO9@i5}C}!fqC8f@4R-&dh)#5o3oVZcG31*
z$NMjbOQvzKGB_T%$bWH;?JTXy>lSK>$o+D?`Rnw*zk!-UOZ~pzxj6SF_tBg33)7sg
ze^!2U={Qf%LN(ugk1oAAqr>U3x#{7-!UetyTz3UWP75+Lc%E~0y~+;0r61ecYceKp
znm4QKDU0&@xfy~7j~|!4+*K$Vl&n5s<$I|lem%Aay(hd>?jMS2E#Q1)@gO7O$mP}s
zu9IyZHPP<ZI&Ca-eH<4T3d-t!yKA~<6_eDNu%``uZs5WgRNsmzTUk{$J?e`rKdfPV
zbH3@rCcRBgf+td6{^!|#_e=dFcIWkKAC8?h*PZes{n3YsQy%Zwdv3BA$8oJAO&{7;
zT-0b=q*3wY?(rVCo0hZwI;>w=lbZA@_}{XyDV}#63q50hA5FheVQ_&X?ZBl}`wi^&
z?3eV`{BRMo`>V1)H$%6S{fpI~@P^zg;rlEONOD|CzR<VOZlBkKtC>4`<8rueK6di*
z-P4kg9Ay~(<KoxX{|@Ybyz^X;P2B`rahrb{e-CWjK8HQ#V&l#_fsa4B8udjiJl8ZE
z^jw{oyl|Fu-4DLSfkzzvWgY2VdEn;7f)k<PU$1At=FdTkyQZ-_O>dmQlv%R<tZm^u
zwIC_|oy=)G{5FRbCtus0yVy;q=Gn<JYa7ya>OYqrTe@Ves=SPW)#K$&5|aGR`HC0x
zD}5Ror#a2*p6+udV~XpW^g~Lr4N3b2!WP~<^!M}glT|EQ4u_vio4cJY-OSrv_JWv)
zVdsQxb7E)fdT{EkdjGRcC#ccNC8|%MR&;6JLE-*m%QP112r2yN38+eTKV0h`&zoTv
z%sc<r4+$wB+lOD{>sRK>FOofKGJR7AN9Cmb0;+LB!sqo>Vh&%Do4)s!?KWeco?hNR
zme2R??pC{aF_fkBl0!xbba9}gd-y{Ki#3as>PrO_mLwl{@L-s=!D~~S+vWt_3eOM9
zwgSibLiozMcfQS+G*hW|R=8ZXMAL-l#qrGr8AoCS16w~jDa!C4=n=d2LBz&s0Y~2M
z^gBhtpBm<Dn8&f&B;Dke@8RSZ?S>L<fyumGI=@zVOm%x%^d#KH!9z^N&GG8`DKBdD
z<mwtuZfsxbAM~1Ir_UWz>!Vyh5_vXPdX)0r{r)cY!;@siCyx(II+~^G>uZ%LFmdgc
zwl=X;i{hud_nN4lxEvff-&>Y-#(y*G2d8+nrt2MlUX`37;3y=0JF@)FEE&(I4K2$i
zcsG8}6jZg^)wO_aEALmtP<kkXK$}*6iA-3~KBFx&C#E0xYoc}PO7^-8O>W6aTc4h3
z6maie#^Bkv;Gx;9>O9?~!yOY&=-Tn9{T5SwDO$kf(HHVU)aKd-!<%{S${ml`ckc9;
zV~i0|DG-+vvoz;js3_n%TU2m*$v;C`PGRq=u#bF8*G@UMf8+CcGgmS0I-s@G=tK9Z
zP4+>$f9HP?T5{xy%-oZKeC-QF_Ank$U+*(x^0YuH_o)i<axrr}S{E*^_`YRjrB&C?
zv;>2)0~0lVHJ<9`*d6$*-O@vcXL9$<wOd%yEBj5lnWmjx=2BE!G_~!$vQhZY#f!5&
zT&ow%-3h8^P0XcaV{bNY__K54l7@iD+f@d8!)`b-$o;aJ{;k5*qUGo!K9BTebpgsU
zx4d7hbJ4vbC;j`c05?NIjdzfuOZg-L*0dJ^5l3B0C00(?@Gj9h#<E&DJ8X03myQUp
zMk~&Z47}YXbBbDCxXje9W>uH_n>4fI^a`8D-w&rcH*1*9+qm{iw~~drz2Gv#Ox-Yx
z7P%Vb0}qtKrNWuQGq<d-xEmh-XZJ?l(1|J=okBzejP^^tHVON0;Qsj0!&PpZ(qty)
z`HMZxI{k9%1O0+cJ#If=rKH4etiR*t4jLtC2CZaX%r48@@-~j`(4S=QDw(Ljer|8Z
z$q5N^{?~0yINHNLzn*ybg~1(J<!1-FHofn^cCJ(ShP-H?T>nWM&d!!YZB5<V973kd
z=vQ4P+u`x*NsHSBkHbIi-@Cav<-I3=VvmN3%tA+3Nzu~+Tlscv5}DXJL1><KjA+e~
z8b-#DY^{Et{+=eYptV1=UOw(p7PLM5>zm@W*prLaqz2|KUVF$yLfg7!wcfHlg-IK`
zC-=`&ei2Y{Cd=@aQ_X^p+)PhfTaIsRV=GI$vLUs8rpZL3-5heCQ{5RK>ZSJdt()Z~
z*}JO;Ryt=W<k*+U1S*w>mn>79y`Z8%`LwOcA&#0EezoaO-k40VGkEI1*Z29$OJ7<#
zEKA>Qeb>`|v46VMfdvfTdu#Xm*IJ55Gipt`dvcHCuU{p>eCjS!Z6$j@#cycY?jI*J
z<KPd;ZWAT5FaA3ZFUy{CZ@-4(4px)h?tLvcS4gW1$tOuw>3BtzEe@>ve_(c1Rd9L2
zg1$(*GKSxWl{{;I?MU2qLtWcHut;I?@6TTuyJI9&uJpgI$;&8Oc6W-iV8RS7?$=*V
zm@Z`8nwU_pATU4L#zS%YwbS7~db@i1N~g|cD?Js$9OLF*z8W+T1RBzP7%Jwrn4{{>
ztxKux3T&(|{bc{Dh?ce#WMpJ$p8TC~_x1W0U(3E+i*Z|g($7*L@N&77rjOV?-QJ(K
zZYOLwbWe)qw62|_NL6t6ylSgmQ}diNSRS}MI^5-UwvLIJ$7$2?*SkwZ&({AD+~e<{
za3oQxVX}{hMw8L6fGt0kG5CvLv1v(-WefU~^6OU4LsjNgf48J>?`fK3G<TOtAnW0X
zl|}z2Khx&89+T`<v|Q5EYTojf!4tLOmT`2}1T$nAHF(Jzy{_pD$T_jLXr{Eg$*)r>
z`ru9vXh^f_!p5hK7eb>W4S!t;I9hG&($T~uy<zghe?jKQBTCe)Z8Tl@w<)bGES|q)
zy{&QjhSJLm7%#5WGGy5JVB_CRpU~H`io(7(bvI32cG>d#y{Z3o9cn9fJ=kNv_;zoC
zn?Uh`08h^>4w0NAJ#LnE`7w)|GddIJU6{HzdWL_D;`=HEqsweEk84zno(3t2f8KfI
zP0))&S0BW?Ee>4tvqH2<GGTv+uf(oyE4Gh<uagc3s+E1(u+*ykWkKK5rUIh_tB$dL
zO_29JsbxLUUM!x$?Rb)zRPJwBKc;x`#gF->qM|RaerzbHU^w*VYTd_=8d_4aDSNzT
z-TP!7=l!l{_WrVGah9BHFLH8NxeqJtE%x!>c;ZGx(9FORY2J#Jm)N_OzB^>OG3}{l
z(7%*l=VfiwmS#+q2xPm<X&4YGe$nZ9W6Mjyv+qAY4D-M8;EJK&(~br68h!q3`^lI+
z+4pL*$)A-8-&d@usyRLF&QrtWs!tXYXHGqK50Bl<x|7o}P<e8?-({oO7E2T2TPB=1
zd7@TC)p!f<XIrMji)OR&Kl%00tHF43m}iYV<DE-tyj-8IHVg3?icP9rXKfbi+TC|m
z^ld{EsPh6@=~}*;i^Dkd=Hg^uMu!`6FHWS)eRucp+Re+Bzu-H1*dX(v#*srRYAXdU
z8EX9R(eT!AZYtZY;=opZS!HeD1JxxH@66IU;_&Rklnb&)WH>D<E?v;{s;FIMa!UH(
zpXQFw8(v)6Bcss1hi&8H1xno)Re0<-&&%Rw2{zOe&y`a<+LF$BgC(<J@+Q>`G2g8#
zj;=A?eNiK8gHL?W)6|}<5?Qyk+0X5NO<2d3lBmXc^A!KCPdjZ){%M`Rr1NZr3d^bO
zVyhM7jn_SLIleHLzXdYl1|Dw~V`xb|+uM61m}Tn!YhlTaJsy7@YyEB4MW?T^n{;+2
zhdxKPN2}+7%ff{dJGaeNI%KfwxJB5duE~7<FP(Oj8~KS{GtF1Kn1B6A=b@cxu1<Gc
zW(ur+|5Ht%Y1QHA>}?lAW`25MzfZgM`NQHJFCKhKb>M4?c#yU9*yn^TL782Oj|D^5
zYDV%O7A<}CD!X+~*q%&bZQqCAukCvHYsY5k-c?tPzr9-GduUNXor$bVNB6pps+GlI
zpI7npetFBV$UHpi%_K3!_R^h8iVVFQ=afFr-B%Rjdb;<p*6oGaS3tWnwy(N)F}37R
zv~Q~Fim;rk6B`Zc&+hnWm7!Z6{x|A-L!YqT3n!<&&%P%ulf5H(x#W28i%s6=stPa5
zn@WW$N-t6<{M_rBKJN&((5ueR*OVqc>ZtbW%HCU@XT>&EK;i4AH{MOU^1M>9S<`hE
zHx!60IC?;Re`N$;;nZaT^P0Z)EfSgV?9jiW*9)!17vH+_rA)HXh+FH2`;_1b&Z~}b
z_pPe8NS<b!H~&=}+Zh2Z&(-mtK6Rhj!Su5!;+)OY>YulmwhI4wtPuFYd+pTsU!O?}
z*BN&--gfI<qB!$@&p(rCd$m?xeySBzvSzK0BY43aXka~jCPU&it@;v~z|c1i7QfHk
zJ`x+eZimV)yNC1tAK;qgYn{2m`t_C<%WN+%-?*>*+L<L6HSR4@FME@a9bzBz<&N>9
zBR~6X*G#>kqS%~%a3k|Bj@<cw&g`vTeb3TyVUMhms^@&2&5KHfr!m(VluYd8i;(*y
zmmsa6yX${foULQIK=)dcphZ2dsfKoa2HaYkf})r;-+t;jc%StO%bXo%E~#C)5jU4_
zzvMgR^TExNmUpRn7O!8|$Qf&$URlngeM)88LHjpui`O3Vm^iD@_NUTmyJ;FHlD~h+
zte7BW6XP1Eyy{fAB6Meld-zU<#Gi|kV=pp4JQbI3T-EL*5iNiJXUy4uA7}jkz<kk{
z_wTPw9@k}FW^GK@ef^Q^UcaS>gpGmDAtCo`>rxA^PdWKu{wK~?_v^T;c(VAN<KGCs
zky+@qN8ZvdI(q92L+xbtdKuH7si*AA?oOY7x`chR?<}XSbqOaQbuf6B{GNP7YeU~}
zZ=-*XTym4^4takuk5#mB-Me5T`?`fZyiC(dlC|{X5}WtST2H&hyk@11+~)T?jTc|k
zaBgU6U0~C^FD9^NbHfz(C{8^W-Km03-8ygDFALrCW-yM=Dqx&#;<YG7d3A&2^oti?
zyl`}1ym<8ra9eKOrW=g~&sz$2N_1Xb9k%DM*q;sAmyRS$n>BRkyjsX;-=SpF`YdRQ
z<b&LwuWgguCtp+lYoODon*X5t{1!Q0bq0e)=a*&*Sa#pEFH)ZK@LG=IV!@Y;iyW#-
zDlXle{iZr)(WEl3S<;1ZjN3Do_e7oM+P_#*@qpr|1-Hs4ulHCsKO)w+u_r@mN~`~5
z?WVY-N4F$TEGeCw&p2s+9E<0cM^8RBnjgCF|K`rZAHps>d)yZ9vEJ8^;pJAgGp1Qv
zi|y#C8)@LZXlHxZg}EKy&%1t&Pnd7jRC}vyVzvTW%k+OLxc6PN+u`>==J(6v4>gVR
zcY5A!J`?7<^UtFVegB;I%imI%-IsssOZwiAGTWG>7pP6*JKGiA&Of{Q{$19pCtJ!n
z_ug9lz@aMU;>|?{ZkP3Sr(~=Ryr7yUD|O}CjCwVxxltyC>AXp|o@nb$o!0#^=Tqs+
zpHmiUs0)}luMkq5kan@BWN&4LDf`5jGcPZeTRmNM+Hk|f{TiJjo8Fx%(%5JHAd2hn
zNxkXXk<JPSdZx<C#zKnG7cWk6wMee|b8+L2MuF&a!o5H5-ibI|w?T$)Lh-wO%ypOf
zlFzLO3VCp`G<$hm=}s|8O_xcRa&6@n@=R6aacVdq*K**^G_#{^LMvB>$Dg~Aczf@`
zY14#X7J|CYA<`@AFYv{!{8F&0)R^bi+TX9Z8GM`@4%|M+`PlGt%e_d?CYiaDOTMjI
zEzD{7t?b2<5a#rZv#v{Ad8e6XWSw4m%xj|R&ETDHvkX<=`M<2$xX4$es%I8w<C-1k
zUgZRGXD0I2c>G@1<GE4#Y>G+M*{NBfxi9APP0*X({iO2{bl*+Yg^Q^rIxARO*2bAG
zZSFgoV`BAxBKy<n9WSQu<G)dG|L&XS;Q!w)E<W_@#%BL^=8JRx34gqO;m(64-MjPF
z$+^fYZ!<Z{bC`93@`Ho7TdLJ#%L28xZdmu?tJ$Z_kX1)N8}EqxwCnft^M@tcDtBfi
zzuh9eF7ofg-%e{*+~izm@MgWuv5;i{(hrliuiNO*CBfDp>@9KS(39XP0Zlig+Zf9I
zX05p1%4xa4z=+}Yul#*pvvvr1ocJNH`R)I7(VcVeT7>RB_+j5B>0YLdE3J3Lta~_>
zA=(<0tw1faT|6y6SO2-VF{4r7YyVEiOqXQ8^`|zgKU%1?XXeMpk%_gpwuUFh?96=7
za8>?`qK4D1B+2WS!sCuGipDwZ)Bf>~M`qDu6U&1h&s7o@AF+3P+_xs0`)xz<2ARDJ
z92Hx>UnmXsjhu4&_<{t1*H;$JWZttjdh)alB2tTs6b><7teg72f3tV6q@u%uOB_cR
znau5)Y$<hizK^<6h}_)`j_+HY3nwnwb^6?%wX-)VaqBI~+<Rn+cd)?Sr$tx88WUB6
zK#6bXMbHS&G;Po}l_T#~22c30;m!H;MVs^9e|!D#@Xm+p-tV7V@UL=B$(dQ-FZ{KC
ze}DSqE4%hzd2`OOb+Kac&DZONZtuwcr1C5O=lfN5?~i>k-=Wcyt+bBqeXvFEHvc5W
z%g-dVIj=2WJH;&4?Y+py<IK<fZzi+}ctjR9O+48waQ}Glg}Q@R9>_F*IGv)fvF_yG
z@cJ)|zmtQk_MNU2RQ<putF9%!dhU#8{;A&Eg3i`|QM{93ur`!?_35cP=|YdRC$Di-
zjeF(>8d7ZT(_>E5T$pUA?(cD1F}%QOdYS=$t>!KFTZWAVY1^gy&H2_Q9-sA5bM>z;
zZA+6Ac{WDy-E7R#Hhi(@;2&43Klg5K4!YZ*a5!U^LQMO;4q=~FqUyI6NKCrXmSDnl
zVk3vA+V}VmPm*&E@rl?Pn`v8o-L+cMVd-iyZ;6;VgPy=S39mz^C2&qZ9m>m?rnh)8
zWJq_GG;fP;f8W;7qtc%JWh(xCmzHncb|6G2RCKN1@}y~h!}tH6SF*YJ^faT{+rK;&
z58U!%?b6nwliuguAOAC*&7SMG>q%2usQWIf!s4l-0y@WC<el5T_+0y5W4wJw{r@}d
z@2<}iNl?2lJ||&|knSf%k;if_u1cye!cr&3T@H~KPgKu$(bk*3`bV!D`*u%BNO`k6
zw6|~7{;N$66ODw$azC-S83}OPwhQkr(+gxeay#u_^LN2c!{2?;w;zZepIfbVcj^Oy
zhUuyGmNi0x6Yocto_RTSQkHqm@6yf3pUgEfQdbU$iC#Qg%<ikjYmP~0tlWCtI@wcX
zm9Bc}NCX&HEZituF1d+is^+9DnO%R@UKh9dxFX6YRxkYH^$n-Yn4Dk%B_+GqVa8r7
z7OOtHwaTwDa|1T#?RVYD+Olx_n~9v4{bSkf3jG~hXV=_x{n>Buc-d>wPkue_|7@4X
zmYc4WlWZ(Fdt82#de3y5!$;5Co>fz0xL)@w(1fule(^<(&x=+bb9!_B+SB|!Vm)pj
zH#BM$_APvFT+Oif^i!>Kt1`V6Ow1u&$i<6S3n;u{cyYta;>oO{qf5Q?6L>zUe9Zs#
zHC(^);mx+X+Kb1(ot?RN?K-i2Qsws|eI<L%Ca+rm;~(#9OY=U<k4<`>QrG#7vajwA
z*x)|zQH{s%05R7h?YE0xG2XMwauE?X=U=%j_v?)|-pP8u(mzG+nDJ@KFZ1~8!743k
z{!^u%7VY%fkmb$G(c7m7p3clr&~eU_$*joUD(7co`EZ4*zTNbnk%e-zZ+xxkv6^}O
zcmAV|*_V#o2#|MM{3#~#+T*8b3ZLIx-p;f3TA|1P`*vv}M?WYgsU2>4(H?kMPQxT2
z?qAf;JbfL9o074D{FgSId;jqH-fI5!F$dMyWYy!V0&g5Sq15f0IrWI^wlyU-r=Avx
z244-GYApa7yUsJQx}|*FA>z*qi%oxPQe!ycS?m*bJN>e3nI>(q=Qm$xLf6IclHEK}
zX8%6i{dB#0&6~e`k_{HcoA&LjDp+;##V&oj>~Bk#$Cds($N9M9@#51aZL|LW`&%yS
zXxw74FJo@YVVlKmf670pig(3w9#CLq5lR!7V!|C3w)cAV-|+Ykhu63BwJ!8>d~@yL
z;S*g`0&Z^lkzP`=vulsrvmQ6+nVjH215FVr<W!gBtbW27E|mY`n95sQw&X80daplr
zl`RMs`F7i|?93Hy{qBY0QVQ0_>=uuoN&ibR*_E;ImXYxzjfryI^XtV@`ClnF7F=Gy
zXgPiQu@n1#_S>wu?({l%!UO-^Wr}}~-s9d~*jBLSALn|l-Acb0e%@%Qe0lNf>l0fZ
z*!)btc|~LT>ClRUjgp`Opae92_%1A0Q=#N&<AzPm2@$ui|EQmH_Ko}$*E!CIQl3ga
zl2lptcBbXrm)3W}PTW{vKRNKgg&Un78d}|=>@2dJADt_?yC0vkEdIS>qRi(DpHf-p
z8~d&*n)ooqqS0XPkNunPZf;+>zt!K4jeXs}548>7;_d(cc^_XF`Qymqha8{f>KK$<
zSEu}#@S)topro$s!;TYyokcri4sUWw;9ju!^otjuEpEMi^{ZE}3Awr|CY874vGx4h
zY3o~6)wXFolKC5+*<~cPRM}+L=QGjy|K8p(yw<-a*7$E*_97ScKi!TB4z9b^YNuKs
z>vKz4eBQVt|I9zm+aUp|=Q6$=Xlx3#D6%tovwde(K#8p4#KZs0KPFgg__y|Y@(lIE
z($g<qe44c_D@v53w-3}m1}|O$E#|qZ*swt>{bqdJ)<w@}FVTOnVUfumu{8}@CecC-
z`~JPw4?M|tRsVQ#Yk|!_%dfMvmE0Cjmx<V9AueXWNYATw$^VTWYSt%aE!`+=7R=yW
z@n=i*_CLuL7d3wC)>=-!xZ+;xoO~vKu7#31Pd0Saam!U(tZ5euvq_N1J|Z$@`<dB?
z{!c#W`t$gXGrfA@jHY`w1xqW=2PG<Kvy+t}@wmfrqYw_s_QUUlMETyInw)R7H0^%r
z??vhJh2pdv`1vKy-fCq(J9&bHkA!cM!)4)Zt*#$DOSW%Kn~|VX58D1d_a)!axvbYE
z54}qa-0Oa=KmVpvo6C)vYbAT#md6&WzIrrI@-nByk#%gllK%-D7oW%Nt*vXY^~)>0
z#fw+Bo^o59%U%Qxuop&FX{?9(j`coWE}&QS%X2~Z18cV*es#|Z{vGD$_?fcO=-C&o
zv?oOqzMa;$R_}@b=y%@o`yI>2$6jAJ^{RRw<0M!9P2WEIzkJAY$>|ys`$W;_lcvX=
zaM-rjwOPA*uWxvkPTM?R`?ojGTEs^j*(}05L&t6L0o}XH|NGiJIPZGiCbKDPwvpAY
z80Fgn;F&#0VXni#Va;GQEm=gdX<m!bvv;%Z&Xn_u@_DFjS*EsId+KzDxcC{H7VAzH
zJ>uZ%@?_=GyYavN{wRFnwZM=?_riyhmpx}^e7oZ^&!e()^QuYpJUN=-L06xg)|+%u
zBYO7RT33~rA76x5+rM%4Q+Q?)utnv9nKmdbJ&KYF`sI=iT^X_N662v&t9q_3yin+J
z^XDm_osWW^tWOD&KiVTNSaVVIm;L|CH~w_a<XSM*=GMMr1`eNu9NhnP?(cpRx?p|U
zd6v_@H7++TE7~Vr`0)5!?wSKLf6n(dk>^sWemB!jcU$JQw|6h7gO>jPXEO{a&~8gP
zcK*mCBdc9ri`v2tv_!7Hm0AL=QjTw9JjB=9r>u2a@5A3Umqk9h_r(`P-!#wH`>|xF
zb<*X<pR2j$>RmQ+sqFuJCqh{BBd4Gvzr^lVA68c56HaRVTh*BBj+;L(i~D_3z0pHb
zGbQ!?o5-`v!c4xrK0R;0tZkQP&zyvmpi`U);mlt*PL(+DqWa<5jU11rx!jq5I<=(a
zY6`m(d>FB8LYA$9%tXo0R$^AuWCem$ekXqX^!VD^C5{Hqjw{Shd%{v@Q_woIB60eL
z{Z<B&2fBY=I8*%~uEj!4$Z^w!b)J`Y@i`^G+Gn|W=I+P)Z@XPH{ItB|n~mGz0_9or
zV%)YCuUTN7Ib+fB`v3oS$7Mf1!Wo^N{emNu|J4(3y(x7SNzeN-ivE6)Ubpn8u=@p}
z&fmp5&-9u}=}!3t8m$J^cXvRibZibg{^;1G9Ld&74-fU<inf)D!u@ydoG`^<j+IR7
zUG6oeZ*Q$G^PQ)1B<kO>?8N^!%kNaxoPH*wagC=}j{WR}qs^zM9g7M&nZ8{7%l-ZT
zq>NJ?TT)c~cWYj6<UBCrqK4btSx!$l&WJUwNfhqcmHB|7NY>$C0h2=fm)0N4C%t2|
z|KjjTu_FGW4d?XLOHRGWSbXu?ayyXYz-vo)aWR0R^Jun-)(OFXwqGqAD~qxM<(CP4
zPSBlWHrZ{lgZSBLf6CvVk=zpRwy=BSfhRd~atlAby|QP%+ouDYpUhKqU{Xp=&#|;r
zwfJ!2)>bR+m|UjW7j?L19jY^u3jHXu$9b#q7SHS#%N&^lq)g{}B-r-pCqDNSFMoPx
z8;^8T@7YJs=ed=d{GRH&v!`#J;PP#P=VpRVnQ&jc__U9PLe6}xPkC1ZLtSgvZ+o)z
z`BA?YjoxuJdM%r|4_v9+`RQ)l#pP%AecmR#yUeTA`9insghmIm#CJ`F-XS}h&t9>R
z5|gw@k;_kgU%n|o`-bLW2^;UjI!Z@YY^b=Cu|?>OTOd<1lQQq3+wT2`)*a)WuQ&bT
z#>XLrf^(q-<Sw3;5O?R}6PJhe*{xLyUoMtxc;fr(hllt7FJa<7D{NhsAbOZ(?y;ZK
z_FwxOarl_q>KSKQ*xYtoUA!4_Tu9Bdwcqzk;;QdKOD8yRmS+?upSPJB=5sXsLcpwz
z-J%UWQ71V5q?mMd&ETm_?<x3e9&dPIM)3c6^<jq=oPKI#CB+d7>d#!f_##3mRUzkk
zR-wX~xLg~(io>Q%x>F7~YrlGV^-5L2-IOAJS^o6tJ1%BiX5`ub=KlFGH{RrJiz?cm
z$z=TdEWeCbP-WqT`+c&?<#uXppLDD&7k`^~MB-D_r?m%TOr!)43Pv1%uJ+X@MsNDg
zi*AdZXKRAiS%bzw%|UJbwVi!$Cd_5KEhigzX~z2CVAaEoCuL_GoGkr(iMJj{xAgBi
z{lynkPHQZE)85ATH>tu?_~kvz%{RAXCe+8+{!BdI^YWyG!#Q@7yJ6wo={#Latz0V&
z?szo6p3isVYt5bPjG(JL3r{~Sl9Ww0-NW_dbR5*npsuJCNA$v?Th}u~%5G!_m)wam
z=6SeorA392qCs=#!$p_WX52q~()g!HMBm?X-&q}k88s;%Thl+TTDUMIZo%x;>_^LH
z6kh)7er?Ua{3nWu6LL6%xc=K$mmj?2wrxvc&Hk(VCha)`0~uv9M#VD@`V^iyv*G>Y
zFMC(*l+v76p;{^PH`G7(rg6I4Y^VRL&cD3I^j@(=;Khu>7YZ$XI|Qwq++TQzF&}!9
zaKSl9wB^!*?<#ZqcH33emlZi32rfPM_j*6u_n8;U>ORE%c(lu1?#dsB-Z#PWQs0%M
zR(`FGHe3BiB65Pw+a<U1_nSS-+`hc#MV6v)$m$@?lGm&CGcUhvJ1(!g_t~jEi=PMj
zawuN-7%+LJg@BX$3l7<Z$|Wk@3=1bUm7MY9u2`P%>F$n?Gu6|N9Zx+}%76FyE^UE%
z>CeBH`03Yd{PXPfTGcb>`0themt4{*Xm;6uM$azKtFxx83dz{4$Dzn#rKWMylR+`B
zrSF2Exs&@N*_M?rkIlL8$Z-aXRoLCq*;c1!yt`9wdaQQSdjGizWwn1Ce=K_TmG|Av
zweD9A8?RC<^;SK;YIlDBuEee1cISu0UJ-PW_I2b??Bve-BK~%PatYXArb8l2lFI^A
zKIeO_+i|4rV)^xu=dO<z<@xgSuhx>-x8u=`0QbPgb=f?7zZLKD&6w@9egEfWVY}X!
ziHJpHOWMx9@NHF#0F&&0E|vJy3xZaU+?Zq;9~Sxjag^ZtCE2pt-*)5k{k?AGdwx&*
z9QH9){A=Ew1+O2^o%{2+{L?+5-w$s$TeIlJCGNXVR#!fdJF9rcT1{f>lZ<G$QZIvx
zZ$mj1Tb8i*{ds-j#m~tO?svf9%hKYxU~!mNK%L*``}JAdjy!4XUHn!%{K}o`^qXJ9
zvkhv)Lzg-helGTRwb}G{?e(qCH!n``ec1Zk?M_r-$&>xpBRO-<p52!CJxgx#ACTK8
zWt}t-sNx5Q1}Ncha6Fcq-&}CL{XJ)kbLrMuvi7&Ged~X``0OI<dzHc2Nvr+s^=mvf
zeVL`*;;`5E{TwNoJ3s&J_I$CHOO{hn#aQE_s@Vl_3ha<x_*l^L;Ddvc=U&<v*z)h}
zGUi^l^kc_Lk_yg7E`Rs;Q*o}+TOIw?{~zvtRsHUa{lga)b3*pKG7^4P;QV(T|2<#7
z>d+S+9Ey?c3{EdPq(MpRf?=Y<7deL+e?sn7u8!*T%Dx>}o4M~%xsQS4{h)$(Gd=$;
zcXW5+uuXe(-Vzd8Dmw}<D){(XJ^QiyV#Y^N@qQC?&Xz3E$qUwR&|Ox?m#5Mqv(9tP
zO>k=1G10-Dd7=MfaRIiPdl@0d>MVz9v%_zTGRbl(w)_6$Qwd9g#_+<$jRiB+TOC)J
z{QY|T&Ye3C?%8Iavl0E|=<akP@mj{0_sX&dTOgspA^VvBP{4`crh`|OB=^0S?tS;~
ziF5X^pu*F=-k<*$T=~E9qtE$YrF&<at+V=Rafd^eQ}LtMvc?P53zSQa^n&a=#?lzz
z8EN(G*KL(qwl^ltT=!GhJ3>)s|Hmlj%%8m1PqgoHTA-|`BG>EYx|@X!9EG5KXrp8<
z(lu4aJ?Lg{CAX=R>S{mB#3fr@74CdGw7LD8PF2cwEk%{GP0ocu@=%N1HgO2JsieM~
zAszKYLh<4s=f(}+X6x_O2{YXMV9#bTnLhso%8EYoepm}cD0H*Q!BWg74uNG#vWyGc
zx1^<WwY=31KeCD?>|R;$+w1W!Ry=g^|9<5`!u@Ny)poy^ym<7PKS*8W!bAb3Pe*mZ
z1yvKLExUkTVbLE~cZVGgAy03A{<)kf@%}d5ce{Tcm*4vJskqzisI3R=E+;R3)w4>z
z?Nyd`-afl)*_<URElb$<%oeZ`^5KwOn0$$uBe<pS^xyS=wmzS;@7bDQVH1vvR^543
z-!vKX7cEb}s(IXf&CM@oCO>n?)t<@|DjHLJt5bS@RZhZnzt}l%-fy>3JlK0-qCmM(
zvr(eM&)f4GLB)=c&kM_j0?EsTm47$x`_z(rYTfRv+u8ctQ&PXZzhSp6|Nf1A-_Cuy
zbSr=Vs$H+Q?NBKAExo>U+SC_YAJ3gD>&p6CzIMfjMW55u)md#yWlHlHV+(x>_N?~4
zZtdOey>5rfBirWcve#jM`|q#T<vrEZ2eN+?Ps==J*@epBa?gtC(2vU(pHEg-vMPI5
z^MCHfK0e3OJ6$i=&3N<r_ScKQ|38Zkxs(0l=kb>lCw`c{ysiDq;d}b_=08ApE<FDw
z`+ncj?&8armtK!~Sa*Bc^m*6sF1&SX)9dwR_f;<lnhQ;mH4;!$0Y}3N4%x!Tf|Uyc
zQVbSqS7tUo4U&FychAKY*ET2aJ@@tMo$~3+j&(;j-Te2+DK`A9LD=2(pT5oBzV}~O
z#`2@Dm{x7yIsNV5N5R$gzh6yF+cQ;NHv0QrbF(rh`KyX^UxzNea&+6DJ^yWsC3JRw
zJN32SX2tXu>u#ONsrh8+;<7+l@!gX@-mv;34^)3#U&6=X+?X1u_(n&6_UxH~KmBGK
zaO+vz-s@%;qI|(LeU4CI$d!MWE`Bph4-9;t89z0?=IGIL$4hVI@7e8L{(Ws^syqAP
zn;*|bUsHGUw>;e`+say2wc*!1>lD|&R(EbBXwRL0SH8ZXcu|{!yOYo{8%Xie(s#sR
zMhnBCBks?Cr5!ugqTO3;5z#zzv;XCtcIwKr|NZcdwtAkH-u~)!$f?Wg+nirZMU|Xn
z-F9Z*A*<sdcZ!^kWMAFl*3S7{d&2E)R<m!u(bxQ^e#>3db*|Hz{|~Km4MQ1&O`X38
znYJ|dwWP32N^-ih!omGThcu_c7so%Ghf)uSzGW5N!dCYF(v9yk4*!i2KU?w3<lndA
zA4v~cpPT&o)2!zf^2fx(;M%gwf0CV}<0}j2b?@E#kk9a^y3E~4Qx|q$diHP9qF?jt
zZhX2_oN693xjsgUL-B&3mC*TKx4-IE(E7Q-VCkJ1)1Q5JTRiKLfwiUK{X0)r>+k8W
zx-J%=%~lpV&Hav+#dn{xv&<hvP7FwAm9GDNw5vMs{xap(|CuILmrEc1XO#7tBPVz5
z=+))(S=7Y@nPdx<PewgcNZGChDoG|X96H?4SI54vs+}wL^5Vs_=U1Ql9UNMI$Ljx;
z6CG}>yRti(?loR+DX!Y-cK-FEEi2D14Q^&$ecr+{Y4250(+;IY7gwB`YL*{RtiL7t
z>fex$PsO)COIc~G)zTrwB)d@gBwyC`j04`6IH3j5@uSTXbZ)yXzO^p$_u1)A*DId?
zI~AS(<z9=Ljgj58j2{=bh271Ko|w&arS1I6gO0H)cc`A){$jQ1=YaCp`~KdljJ+{i
zQhxh2qgQIH{ET-+6#R?alwJHQ{xB~u`;G`U9*)L7m9WKuiTe9I)xiys7ah{PEk74d
zFs@W_`^4%b??3y(N1Kga?^f;jS@oVji|4_W3lrpeOxXgWJ=gA7t|{^>wA#_s_``uK
z2hZQ>zN%?rGg0Z#>f85ga?_Fyz2lm>%<K1ys_eY7msh7}t17lM_Z4z0wDie<J!d}2
zwc$c`kYI~re7@x054Nih<yO2=d@pNlZu4(LAIB?AS;wAT4#rv~;cp#Ut+ItK|M@<j
zJ>Ys+>Gj-mQ?Hiax4RRtzO!l9?ftdUSA^TL60IV3mzP!Da(m)EyXomJ_IIJ}mm=Eb
zI2A8Ue6m!Ptp!$Nom6s|aj4{rDaY2I!CN-Z6mB!u4?KFlEGO%a^A$$X+UV^s*0r&>
z>91nS{JMAIvozD5izZHIr``DViTki`uax`3%gt@Jy*vAV_0H;BG4V_GdCSAU?Ry0d
z<%Ld~S#j>6+lv#9?sq&G9!_Et__uq?{es?Q9OwFb;&(?CKj*J2xnOA%5UiS0u^>i#
zW6)u?((JOVtlQG-t-jY^vnlBRbt+=N<n2PM{sWEweEsbcYcoQab#{KbwB+w?PQ?p`
ztWv$dmU)2NNiBUW0?V{yYwu=+%#G?PQ$Fj<bo-!qw!z+G{I||W<-EEaQTdi*Yu=)+
z4D*oi)zOE0dCkHv%-r;PUDmJ9<=K|XTv@;V{Az#Ce}46adQL?aD<-EG9I`h-tsI4z
zOG|_}-a0G@eQV|2efOwCdX&-S-CEj*_IH(qJ-s~7|Lo%Xe?PWIB}99g2Hacn+()AK
z==8W1X$yZf3OFrDUZn1yas7qkq>XEsWeY*A&=gI_8Pm2U@PuD5w14t?|ICp4mt)v9
z{VqS0uKVe^{KuUM+WQ_oI(ENq-t5_z8=ara1<tj(61?kQ|Kr7Ni{5<{61<|)B2e{2
z<*mfR;||b9_>ta^tceyE3@5yQzrVets$j{|n-<q&W0!7hG&^^&tmxJCd%n_d-@Ws<
zH@ecA8D4Vo=PTaJlcuix^x&Pp-IcH)VP(aZBjy(jITb){WGg54J06eto$h2Pe3`fB
z$+3*^ii4K6udlDXlm0>a^$UqRo2&QiK3%u<pW&;2i|!fN>3$b<;wbUq;{aD;Ursdk
zJ(=LZA^Z7Klbq&`EqPaD4)ONeFXCGG>)?$G_O;90-FIiNGF=zI{(nnaWh*Fz!VD%z
z^0=w3{BRi500MO^I2JBWfA+Jn@7Cv)8{c33erM&|1^>_At5vY%VrCTix^~%ui*wBz
zPS4wTew*d-w4*uJdsfwV)G2K3$=>x!rKCpoz2gji*^7ZMPW0YpZ+Wq!-%H@x?fBwJ
zOZ)^DEk5<~MDGg?g+0Dj@0LIO|C&!$)l)uBS*HG7s#%GM)goo9MalLYSC27mTew)|
z<#mNK$9rF#=zZ~Gk+S)}MRzBDycWvrls83Xt-AtPEl4?2%TK<^Og}GdRPn5`<-5I-
zUv{UU?8S?jp=;R{t(X+8yo3Zm#wuGadVF?^T+0iOj29Z7qGvC1I_0?>|94@c^hH6A
zog0%buDB35>DkAHr!rr3^u5q1Im6y^lyTvOz+G4O*nF&#+5bgr@(w}Sof{SM&ai=G
zb_8BB{mR<%^MWAQK0(>W4fgu}9I~phPL(WB3m0ErHM6Y$@|2e=&dV}!ggU!>&iZ||
zy-yG1_9A7gXO2HsUoc!%p|Egq%EgRpIUtKW`kaot{AY41xx?PbA*;%$Xuc@978C>#
z3{E92U6We+CQS=faB(kr;#T6~UUEmS<xa->o{%SQo~M^x=Ku%#i;lk6jvajt8dEO?
zZVFeE1lb01P%=}?+P_OPciq?HYZ0>Ya<F*f*wOc*LOjpKy(EO6V}8`{;(q(qKCxb}
za1VD*j*Fm>k-ZrB+HuDFb$2oZ^gW&2Gdp`7I{IF8^p!m+SZw7G;oz<?<w)-(qu$~p
zzgI132g%e~E>ad)^f*zf=Nzl&3yq_PWj5;NxwtP>wz4aBh`5uyYc<<Km69pbGEW2x
z$hP)Pf96&qB5;pGwqLc|O?Ba75q|F@@w0b3xnJEaD0?x`q2gkRjoEb$)rE_*qLR+c
zFt}O^62F)kTJq%B-IZJ8kGIsn*~ry0=}2!BzY`=-_RCCVPt+<|GxLKAr>y8<u>;QT
zprCSbFKrNz?f!PkL&$0sPs`Ul7x$}|L4M@8D9EA8DcdL@dr=UC-b=RJ`Eesltk+A(
zDyvh#YLT+}B4w+vCIMOb=qo(_lUn+^e#CYc6)IaTTHM|D;s&czNzI&94jP`1j@@w2
z_vz@n)6w_h#q`JT?%X;*cgpIFYZFx#KAzDo503}Ame)*9o<de)BF^@oFI;p5IWN!U
zxSqhG#|vvWXM{{zvYJT|q`GMFg^k=TFDhn$95d;{#wo>jUTo2_TD17p-3WfCyc!lK
z&-1r#e|u-KJU5r~K|$HqDL0;5-2Eb4mZN^*`f|P3(@uvT<>lo$Sd#T)$^0MfymS0N
zp79Vj{qZ<HcTVUF4REL&f9lxLr|0i6Y11#q1+$MEK79RB100UW-4(8wD&*|-Q1P@h
z-CfP@w#&hN;bKRSV@vLw*=m<(^_po;%Ec8bn!CdrU}3k@kmXRtiwb!GuSu8ExVPsY
zlCvsO28Ey&-=WvPU*x@sp02Lq2}(mVgh8RI)+`{~o&+*v@iTYdG;qkNyO*#ymDp@?
z(D3wnvHyGh?dhk5WkJEQXmNwV&X;S-85f=wp0s4mtOm}*3m0E7JP#^RVzg!5K}Nr3
z0f!tYy+3{y@!EOwy1!9hm)+1-_VmgWSCugbMdo5z%R4`8I3Az<?<dy#OvN*6+x2W-
zXfFP0!_mAjIsamY-=rlu(1N1~l%N;h(4IU^CDKHz<O~l;ZKHrJ|JAseYg9bfUH~VX
zi-y82cPvB|e7q)IF>wLsg%=%t4l_KDuME?lv_!>o_r6@^yEdM8I{NNpTo9BsU(V{&
z+UGE1z6xWaN{Nd*C>y#QFBUjv9p~}4%TLg25;RmNN?$bOI^^)eVvC;t5*5!|ac3>T
zG3UPUv5|ty@rzG8m#BC;PAXh{A@EK|-+NZ45}DX}9^R9#968$B_Xt!>H20luo*=zE
zYL7?IB$cn{n*z+8z}EfYRd8|F7xD}e<7nSjyDaX-3<0Zk$|Wwxk2-Yp)n<dDg|+2&
zG0QP0aICwy=iRwecK2x3-<zKLrXt;Ls-BvA*;+uQQ%B#66&f7LwjF}9{Mt+lRX8~=
zg3HC7fq?>SPRBP!m}q&P%FLMU^K~IOIe^Ouo|Z{Vmi%%NC{niKlKm<mu<Wv-WD6)M
zPI~2SJ>}CDmJJI*GNK$D_6oB7TffPvPFm9QtE^n(X{NJ5iHMb2OCQ%3J%L4wLCK*;
zpv@UxD&8r*`}wYx&5I0>7nTb#JXBhHtM>&sXYOKZ`6y7hDmQ-H{uO`EKhB%xH))A>
zMms3eeww^^8jGUUx#<oPd7^n!R2acYiA(l8vr~!9HKFbIH<e6Lv2>MSzrkJ(a#*mF
zyMoK{<m<Zp_9atPSYMsK1u9TMCHU9o3DUtQ+WRIgS!j~1X`k!_jbD~SELMElkKz}6
zeRE=>O0K+y1ivgVC}|fdTjlL5ySwz=mny5irID<!E(C(3f1>ooz`CM6?1?5NJSJDC
zG1sou^3?SGT6)0QJ%05fkRu)|@U-?Fk9xr;tE#!wIrDt(GzpM_ixxM05We*BN@$w1
zyJzH18^dXv_JPvrL}}I*`L@3I8#6-KWK}sic3xZnD#xxdI_1fn>f3Z7aFUQiL|L%r
zVvu4%S=N@$5*vnv7XpLaYIo1|>O9^83B_A~*1tYiJ$u=O!Zo~tCl@SUVk2<O*}cRB
zRE2T0{Qj$7y~?G8$1K`Jt7OWQD<QYE_rNoR1cz+$+=hS`8k#FV>MB6ey@<fR<k;_?
zFDjmYYT>c+@_H38E9BWiWh*IALT7O*x$~a=hJcmVsTUXC{nI%IDtVR7xj62xx4+h_
z=dYm}zuN27?Ykkb?WZc0xIh9%twBK6U17?Fz*8&qZ|}S&KKmaZsB8z7@P(gq_t%Fw
zgx!%?@Hiw|zm8LOY0If^H%g1wPJ~wG6Q$2PO7P3hf63A^$<bYN<<4tUc1)DMSXkTK
z_hN;%g9N8+zOK~N3xQr)T5n^rqd=bS=)1$w^5VzV*EYLB&e4?3G6Q9Six;o2dco21
z;>D+ymcCP`G!IR+z5ohvP;2Cu<B8tn+&z=(>xHbmYHyz1$^~^{qrqfQEo}5+#TM7a
zTjR3orqqB=;sh5O|L?zlpL}TP%L*1J&lf9H1kO!&l*ktY7qX8}bvGHvSsmN`wrlw+
zm68yzV%=~KSix)`8{S|bVRi4VuGG|&3xSrsOKq>sl7s}X3CM+@tWpx<m3)>Boaz@T
zgW67Vr_NP>{I1R^TdJ{pYV!nXNT$Bd?^IG!=`@MQYMDumg}@?cr4S>}v9plP$<yih
z62GnUN^2%TL$mPn-@6N1`_#MLR8L-C<tdwO8+-fX<rYw5;YCN^cLknrQC5o{$A;S;
zRpFEko|V<f^+EWuAT(b*e)fC1zJK=v0a<39H*K40_x+Qdq_XgF$gCZ&?KDB<@WsFv
z6?}&(7|j<w-u^CC;MnWKo|Aa2`na0}WWj;2p|D4<MCNs#qj1q;m4(TFKDijZ1*L6B
z&0o0gZP2Ce_P$9iea<)kU7Yh6R9u#b2<+P!y5r*%7N?RaDkXc?eqA^jq(xBnq9JR`
zi;C-0MGh@otn%_o>Gp|Pf46|r=oV#m*^3|bKWlIFN&C90nSp_U!PC{xWt~$(697u`
B(5?Ug

diff --git a/frontend/editor/public/og_images/manage-certificates.png b/frontend/editor/public/og_images/manage-certificates.png
deleted file mode 100644
index da02e0847d9d1f67c72c2cf7b6a00213b379f5fe..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 61723
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H*?$o-U3d6^w7LGp5fe
zmpSlp?`$uXtEV5TG%nGdu#L-wnT16`VME2XD|$J#8@?sHb>7+J_Ao#tW5+@zjojN@
zDY?5!XFch<6KZ?i``vy<HnxOsziVplANf8z|NPv^Dlg}!K7PDb=e3-i8pDJ7vjSd|
z{*`j~_X#m1aHx7RMz0Q$yZ(BwpE@H$Tfiid4O=@q*V_CqDw@Q=;4ER_dFgCcsrLEP
zdFG6ajBNpvmQ=0%w&bEl^<EYh76~WMNv|ePe!J*L)HF^G4uh6SDr^1yw|6Hca3?bz
z5b&Dx<?@*`m(z+byjN#Xcp%_4spR#eqj!6IH($QY!oVWq<T>fn>FJO26d6DU<()rk
zo4vIyJ)M(*!=h!9%H5q+U!OjER$$@7;BY{3ipt8uzrXHB&tPbn;jH0#>F&>;d*8lg
zVK@RZ<(;n1oA+;27!;m??5HpN`2G2LVFrOR4pq->9}ce$=VUNwnY5%~ZC{T~MAWa(
zXJ@m3Yz#UO=I$=9r!W8Zy*k4I0k5DNIf>8j?uN>3+PKkOTYEkqA2^gW)3$AxnyM~u
zuLe>%iD_DI|MpF5s!OIYFgR;?a^3hYu4l9EdiC++FsnkfqAUMBeWC&l)7e*Fh0U9O
zH;;*dXQ7H_g8h{&f2rP0*S#4U6sM@LuCcScsn@kWbtcrbUspnQYp`t-04q+jKX=9^
z*Npvd9aQu7wDfXwvvYp_!jSkotslFo70fLBU77bTa&;;<BPj5j%6^}kI(_!+!w(Ih
zuCTto?xqtsEOz`gvfsab?_98jT{rJan|~`W1N+p|aQF5NA8x<PV``YevrxtJySVuO
zijPW+4iRkulTx_t_ted0P*4Cx!K)J|nwKu^ude0<xzm#|T2{7p$DW!$-*TBiff95>
z_l=B<3dlMYRvl^S>Mff-z5M%|1(e8^G$0ZrDAlmO+5P!>bmTQ_J3p{TxNbx({j?+Q
z|DBgm{W-ZwNsvSc3NXzC^VOlz9AIYN*QmFiiv#Qa%>l=Z$cC>gSC$3V=$?jJ1WS;N
zAbXC!x%TD_Btde#-@o$y>%G6X{uQr&{!ln{*Y}V0Prm7<NX2sQI=U<6dR*taUfoHt
z)y*pmJa{#fe2p5Kt^^$EN)tJHwUoE$ZO6fTyj&eudM?lVu71b%y^gUAzd`W~<IjJe
ze4f_L&tt7;Uh~Q3`A^fZ&}*s7;yt_s9IF(oEUN;mGM{~7U{P!laN;QUofQ%vmuDm;
z$#B5ZK$3Smf0#_nzuHyD>&yN>f4^91Z^_jzRgv~DXAKwxK<XD}&$dbB+9be`{=o6<
z%0DZGHBQbs@+V)-ZiVGp1_uEr4#gI|{99Wxd85|e%t>3s%wQnhTaqzZ>I~=Fn__uJ
z39AKmID%Cf)E?uRxLJT9;lfL;>3WO46h*zfeb_hTKx`9OdR8m<?5ymW91IL+o(aDW
z3ofzTc|5%J()Lpf1(Ov(4oNI4_|WV<eTFh4L(H`|OYcl-`Fb;whhaMx$O!_^bmIPO
zSl7qMAmb2TTs-Sh@k*A&S${U4dlt^az_M^Rr(%o1v(^@y{gsn%iZUEn`QhxNEit<;
zHJ_{L`}2CvJ+X63{Hv?oi=y6jT{xS)-R1g~xRggp1`^!f{H^Qm{`)*@?N8UKReR?#
zg2QlShfYo9Z?nzp3=DU7msi{U-_Bt=L)K#1&uhN3v^D+&f2;ZS{-B%4D=X`nQ(nG!
zGfVVO@qr_jbAEH3nrVCC+MMN=q#s;;&0AlabY)Lwbkoz->+i{=8qJh|1m+|ICpB#z
z-rCaVe9R0zJ=X23T~-{tRJnQg{XGk(3(K{n9{ikP@He6UR>>QV$woWbPw7<m@XRrp
z{*C8m$3kEGciBa0Y2s1qc9uQf_I1{+&lOS9jvAVZEdqx)cJ9gf`)ite|BV7hhLH8K
zPhUta`R%>4P|&H#;OXUhx!<Wz&u*G@*j`WmOZK|>!%KRs>iSD3-Q7{@K1abODmHnq
z+WHkuj4TUXS_PasbaHAxwJ<WY`CaVEm!00EIsfnKxWlnrS{fWLEe{uOv|hpXvw1_s
zH4|$)-}0BALeK7d^w#j?YO__-|7=No_vnJFVs?F$sNCEcVR4~<AEg=#GlYhv`6;Tu
zW&EV0r?FP*LUO!M?1h^*Rs96aOzv%sE8h5yi<!fzlS{EhVAa%9r#5WZw%lKmAweU9
zsYW)WSyJm}^Q_A~0x~VL4DXe`tkz()muk7$_%G*(MDMXlpB6h7hXwF`w9M3NeYBUo
zUs8X{#A)+QD}Q~r>8`FW<({@~Q%ro>2Mc8vPA4bX=}9{kbc`;(na3<A2u^lWe5Nf3
zdGjsg-Pey@;TlWkwYpz<)%ProjX{7d_mSlyw(tHw7JdC^>&C%%h}m)S`e$z!^N9$x
ze97HBapCpX*IQkKxj9SzT=_Y*-TxDdT<PKu3M#v*t1_Y|1r^`!i{0XSl0&fhLW)_q
z?A5$GQrqopwmtg5xqU|<n<Ix}i-222h0E!uo?foArY}EsUHkm`-6jXt8y%Qm+&}%4
zXc>2?)~Q2&yACon^fSr?HkZiz<VR~Ov#=}Ho;o{8smr0!(PPuZiBlE{#x>swd$@6O
zx&-@qMISv5*LHi3yBy%8yu(?~J4Ca*dX-VF&G(<br}TVX`sA_s>EoA6|9#xMclG1P
zyQ89Kb}%$3tN~?a2?<3Vj?8T>WuMvfn2vHDQa>NZ;x|v-hShTUnTSjO)*XJv+`{1m
zHrOI-Rq7^-rAgDhJfrJx?z_kO&+h4+Yxe{0ynp{V>AlaE{_`uJJh|7$$JWs7C=hfj
zR{KP<3{%sDbrXK-Do(rQ|3u-;IqjuBQu9o%^+!&ewDbPmrU`v}F8$~#-hcgS{NA5`
zj%rW7sbg?dKYr)O-%EeZ=JlO&jRRB=6wEkom-$-%s`u6UH<NGwlHRGB{5R&4Z}-Q~
zi*-uwsAMw;v{cuI`s@Ea$Z^ndhH>7Tr)zw;>_0Xel+5kTQrhmKa&PZ{kM-AsALiWM
zc=_3^3tt7-@b5iX@crK6$;<0cUl8$$|FHP0ar>8o1xo`tSKcw-U~D@3w?+Eh`t`=#
zMW0Ty=~xuMQ~JJKcWu76cK_c^ij(w?&a^6i`L3t-Q1b-2wk>sE8MoiMawSe?L&HA#
zYsY6#Gy9dkFgs8;KIzsU`S0Rk7oyE?gsv;8=l`x(xLEw<?!9%ZCyLoreLC|i`q%rd
z(O^HyAGvlv&tFyc_nD8M^`st0AI$x0d7z8ozsJloq4&@1XlU3hDY<K%9vj1kY=LLK
zGe3NL$n3_!=Ok6`c)K&CcCk>4<L2qn;g^?W-v9op<j$<`@4wzZ$Gb63%p|??KhxWn
z_uIB?{ZSfV@cn2y>-sHm4%_#9c>mS)*s?G236tkcvwm<w`|0Wr3O$}a+vA*r%`40U
zHGkGE=nppdeCM>+R-gB?OL_BdiP_&+-ZR^1{-euPLH3^Pg?F_<$vNq@zMtZI`){7n
z^*{gFrHW)Ol3qPw_qX3N@)8wx=Hci6-ePBHDoByziaeIPpPTED|G&VkNhi-<O7hwl
z$mulsX3l5ELmfBn-jSMDu;{$$OrOO<E%*QL*tdH3^Y-||JNr8%TT+TY&yGB3|M`D%
z*0<?=71EhcZ2vF!`B5gw`?g>)xEfJT+4L`Ye#v9+Y3Kj<)rJN1TQ-I)dG{fFf<c~4
z>O#gy4mY-@4>3MdDm8?;-^r}A65Th`dtV@@)2#n_#@?4q*>{-US?D`kyVUCL3YLfB
z_jP=3P0sz>xrlY)+g`iXvLRe)r+cqy8c*k{tQTlmr{5y*=-70ge5-GnwU4`tXP)z&
zSHN8EH=|(Xf&(A^*)lUYTDSz;+AVx*XXX-jKX1V$>AMO`a`k5abX+dRzD8&Ls%M;s
zZkNAPdv|SuiT8ynUfU%1`V`H%pJhA+iWcj;8FK7&p7-T%y{L%Iji%rH^9$maulu*_
ztf|QMFH;n3e|g+D0M)Gvz4?DhpWZs(WQn)e-M9I<*Oz#Hefm^w@kGW31(9WH2i{-(
znw|4vPwkh2E6o%1wr`m!->Er^QM*6;{3jO0_HSocUz`5f-owT3B==Hprs?eRfUs6q
zwM#wKg-sLQ-ObF+et-X$_t{h1cOEN>dfYgv+3flS-lf-^t(S;{iqDN-r!SZg&GYMV
zUd_Y}tjRTZKj#})eo9GEbP(X$SWp%4{Iqz_gfsyu9=F*)H`<hJ4r!W@w|n8yYvEN^
zRvgcD_?DKR|1@_?<w2fU^HXaV)&{<2^{&5X@!<A9qYOo`=Z>)bof>Gjb5SZ|-Mc^H
zbFFf3ZB=%k(8}OwG2?i6yHr)Rq~c8lm7F+vueiPU5_Y~hcv#(}^g<NZ!ayFUUDsOK
z><dmG;W;!R{!k0g2an57KJUM_ESD3U&4i@Cggb70V&+yjS^dt{EiW%iZ;9IcbWSRR
zK+F6;kDY>;9@ptDk!g82vC}O2_3X&gQnTL~KJ0N5h<mu|DrZwcY(>vkqg_ASq8)^}
z*NU%r90YDo%`Legzy0g;b7~qQU(OxqiQKHgEy%;*=&?-O_TBtPbuudQEu!uIAMVU>
zS}rr+uKwj5#~leTwKm^;W8=6((MAkZD_pqB_V=JjcemR@HH#f9w@uq=$ly4`I4`I8
zux`{FBgY$;FI!Ko7dy0M=l;A7o8os$bNNbFDclh|n=0KT0Mb9<x@=M8BCpKK$K3~H
znyPE}u<e;?kpA&edui#JzYH9QHa)1^o4a<)rKwF5G^{IPPH60T$z69w-|oiEt8Y~t
zXY4ZPckBRVr5_(1>r<6?ycK@;S-RvC%cc*3wYJ653{4+GeuyoOJO8HT-P_yC7Prq;
z;pm*Pgh$c$#{V3}vnnQ1y^G~qrj$YI39B%kU(K$2CaWjJd7S8u-Y&tgPOjzF2H!Jv
zTkI?E1O&RxRKIfR(W9C7EloIl)r5H$^UtyIPZ0aJLu=38z08g$8bJ=xc(uU(*003@
zf{7R8muQD7v;29hz#VU9X2cL<&hh`o=Giwnt5_yV`R};S^(o_);{SK5n}vCM%foX+
zxN{CoxS(6r+^EO_uIyv0FUa>ytgrdR(lg;Cm$UQi*|TmaFf=HbNb>mC+1oFXT5~<+
zX%GK{^^TKnPR%yYtIwG2S!{o+<;#bKyV(_+3=SP`KK@p~iG%fz)Lr`*{oDR+s+m)G
zLEa}wll5ONtOa(wf1((JqXk2)|9RWDCl#+gXg$)xGqoo!_Kd=lif@0ezU!%tXJ!4&
zqR3m9z~RKQuwY`JfRn~i$9jXSr;8=(ub(({ZMlD>Jc9y9b<{l*xph)Oyz}nt$UC3@
zU(7;kqGivs>$=h9Z=Pg2MKvh62-L-tD7Ofh?|b6?ZJYm!k4K+$K3ox|rG5C&t$DV|
z?|2;qw%P8uA7D2{JH@MORhZ5~aZ$Zu1MA?;?A(XEr>|Gy5NtU#HO|V3Ly_(8L7RH{
zKhkzNSGBGRZr%0yYxc7?29||4@6<fDGM!hj{@L5p|I?KAF0ycph$uUe_UvlxzO<b_
z`35X!BlC)vZhL0aB;cr#yWJUNlw(}x4EBFp<rfCdn>VF3R#*2-E(3?t<hcJo{_Iq|
znh={dOYOk)xN|p~CU|(9+q84jqYs=cicJ@ex>`APB+uXSb^5ENMb91U19T7fH_P^X
z`?#{N|9xI=D#MN{fmc@6@8?<AEs<K&8@622ZuxZ~V-D|A{aieUm{r+x*DdK+=3r%0
zblo~Z;m;#!7R5_~P92W*7fvp*P5jev<8(&+{os=)zq~eLKH%EC;p@G<x7oGZs#<+c
zE&snnT*#7xU+&_qGkZRZ>+?rczPO<|TiaW^Uy*~AE%DVoo7b#@8+XrSojW)7i=!rM
z;u4>4_O>=Uy$vtiIOf*9*7s8sw|K#SD8*m2F6&Kp&wTk!0y|O!g6>|;xvyoznlB<c
z<?Q^kdncT5^zdi6b%y`dE=Fx`?_7C3+jX|x3L+9MzqwAW6<@>MohD{-w_4+-f{5NF
z!IvBhudw}fobj;tq%fbMox+10x3+b=XEQ4NRWNz=b@?Il%a1PKKE!(M!PHvI%E|ke
z`Ae=<*mLtjim^SH*XkXnHoK#r^hTH4NwqXiem>JjjpgCY`~NmXo__n@YKQ4g_EUEh
zIF9<dFHvrh_!8ciJip+`vmaHD+fNs&^+=c7nTM~xY{;M@-Lg0Tww9RglBtK9KlD#|
zvUlISEp;Nz6ZkaP{AOj(m47&~lR0eNJ(<+KIe)JFylZPa?ew|W6`OAwm%q1n61cRc
zes;d!i(PNS*PGi^eA%*R)hsy$7Xd!+66H&RNf+Y(_v&ZZzmVWQ_T!QIxr=H&^8S$-
z4q{B4Y!7EIv)&ocddcXaW5i}#o2!q7qil9Ldgw&&Jel^=w(?t3^yM2R^UHp&nf`Z|
zV$p%{-F2%krk%gQI(v)fi)W4=I$V+7@=pvizJ2n%yw6=gNp@nNK+*;I61~j%k#qjr
zwd_{&TcfXUF4@b&(8==f@U6{~^NgaDO*p)}`~Pk#`mX+e!PIjCEnBoxH~XaN{8_o>
z(TkbI;-<g7mz{}7D)xQ*)0<iUN@n)<oliZ^Mat}|tUffY!{t`al37LP6}Id<dc3OV
z`1WGwHTH39ZC@XA>?m=ua^m@Qc%%Od7Ppg6f7}!~`{d;0iLDMyju~dxvp4Oy?byol
z@arMwrN!w*+H(~-s;f&kH`PBo<h)~lPKU|NvuC=dW^b?kQoNs!tL(hOlH5z7(pQ`J
z>dxMFRJzxV%jw@YH-RpFxe}4B(u!<<EuUYLZ|Pj*Kd)is{o3-kCj_6LacWRl^7yQY
zc2l&13difsn~V1IEMWB$Z8@@4dizfI>nv8^f5%5f-JYSFcQ<d7U3{0qlMB*3CB<jT
zKmQA=-7MaE$#z{x^Ogf?0@vbqzFgwCV%kYI3C@Xq>t^%`H2+iZ`6xB_q_9Emtu1V8
zulYy|^0778&i@;oAW&v%KK;x*KY4Mv7V$|!J0>svHg#XFS<(vgre`|h5zVg;CBMkf
z_;1p!zfAAJHD!+6OW(H5)tjXF^6Zm;+IbrkYCf)tG;-9q<I!<>Ro>)2i7)Qa^*@E=
zzpyKw)sZ|ZuQ9`}c-i930u65t7&<k5xVm-qEC%~u3qB~=>^03f|2!u5*3CH|8PCX-
zl$BoI(mDTnj;wjAooL5dMotsgz5iA%Si5Ta`dPt7-}Pg*RUOEC818t`J3O!F{#J2E
z3yCjcyg!t-)Mp#bTq57%;l5<?l*@ui7vx)h|8=YX#BxO^=0-^LX&Gh)o7r_S0%o%I
zv(*0g*eQXM5C4A|C;5^&UjmdiYunoHHHrQ3=jiF<e)CpZlr*_<$L%Y6{BiR0YyLc3
z2XoB!=hlD!@X>hJwlBWkvuA$qZg_TG*X((afzvO?jyxADFAG`4yqd-h5|h>E9DDQN
z0eflbnR^Ti?r!PR=Q#V!J5%$Hdkf3Mt<06Jmz!QF^M&rNWS(r%P;YLueg%``iz6>P
z*ku*j{_boSxb%75M57}!glBH9__+A=^qGGd9=z*(b#T$^?K@s5Yu7LN?_MErEp=Hs
z`!DNVY$vO4P4@Z4aI3+#=8uSNb*8QGq;0%{EgtSKmn%>Cx4@nwaShXC^*QJEOqlT8
z{B7}1IfnPUce6>0oj*HGK%(Wj@MEJ8Bf%^K-)}4TEuZbl?y$Td)8_9j-HRq`>@97l
z=gIh9e&T*?*@Zc7r|h$nCmTsLD!5qf3bb-6?619aEq>ej1<CUT4$akCdbvz+(}$;T
zZ|59g2-xjx`^iK5N12xRguZVvZ}`+S8SdUuuGw?Er`3Mz_Hv6-0k@MWbFwswtR6YK
zYrF$Fa@O?a#_oc7+qHOjYp-58;>N(RH+Suw0*>d?%@nJnq9qD0D#U!c+_wCDypfZZ
zqehHrNrbtQtm5B}quQdH^G@xxo3~Tq3;V*@t3Q%HwQQDFoIZVR{QXZa1ep_d#OT{7
zOjXzu7;~aQo9*EgN$;Xhr@vI$t}UOdu%+6{X^HYB!%g`Y;x~EC{P*z2^6QK|znU)`
zyky}kGQDNfhOZ}u*$!-2aZ~QyAJY}Qw~s90%*d?0eWBv}nVsFD?fzfvooDQbcE0rF
z*rH8`O`bgd``bQP!0|+9o{QBZ$Kx40bv&2)d<@B~aeID4y=8;Wfq17tmaAT=sSy#k
zFE7vOU`V*~y8rK{OEa@4?6du)Cdt47a?ZuCmnK?&n|a6lMSowd*rQ|O9CMFp?BrRf
zx>LtyQCPW&`DR7NhMO_#Pd<9rR;XnE^LXnLmdz)RFgOS($;K+k7Di3|XX2)Je`UxQ
z+23!ZznEXEyv^@4V?l_AVb_AFrHgdl)O>E^Wo4KbzfOCu_2tT}4JG&1h<}yX&neL2
z;eN7A`HtdrbuH2AJvN(bY`$M!u%BT+*Pk}tg-d+CP5JPIbI0M^yRGc@t=>A7Q9)+&
zPsg(_Uu|7&wD-y4tBo`7bqT)?v$qL$zRy#v#n4pH?&Id>xJ3EV#jxKO{g`+w{l9-Z
z_3^8o%;V_3_+^Sy_RYLEX}%5P;@Vn&RrT*>Jh@xM8Pu8={(Q#Uby(V!wPaQZ%gfdm
zPiN)dT{1n*kIO;e)KeAHg$|1qc3l*`JaOO5h}I^xu;rECWq+64U2D&g*tdRrwu@j7
zXmH_5Y1yWUObiShP7jr2kNUg6n6Y-hh<<3;{RQ^hZ~bZ(5bG;kc~aOw4^l<1?q+0Q
z5K!i5?amXimtDAa?fxJ3{k3%xU(AnPKg<5tk>fP;ALW!C8CS0M@blQrpS}9}%Nd&)
zK&D^3ET|-#ELvps?d07bL0*&Pn2tZV9?$WRVe!+V={-s_4C-va-B<<&C3eM2fi)BR
zzWk0!x_|9{oc#LQzsK!bd4Dwv98#G+&xR4XBg*g~%dvx9_O6laOX-f+yFaSly={E_
zy7vA1%XymrDYPgXT=jnXDUhWcF?!6vz{#q3N${>juHlRRZU4HCKicNcv2gCy9~C=2
zMGijE4F0i6fPq1v<;&^q4io#zUb|(KzA-+0TRVJ>W4(aWjOWkeCaWjB+LC#_PsVVz
z4-W&wfep<9FFQ(PI=`GdqAjvJ<Wz{hfA9JB<oQb%e>oxFB5-Lzpm~qd47+5v=CEwD
z*)yFP85ltAx0e!^w}Tplm%hmU)+t)H)}BLgN%M<|@2o1B($36sjXd#&iGe|Z<6^Ie
zdsXbMU*2Jw#(Vd^I5wS0>dW&l(e(mO63Yu-pA-%dmbnuWeY%YWq<CWA4(0Z`)?c4*
zEKi@80*a7_dQ*i0S&GH<>mtIBGcYhXzGzdDwa?1Azw!JOd-lH<H~QcC#;I5$X}rgF
zqVt5)hupt@<pFvBLhj{>{|p~bJ@tftdu`RTUzPGNZvV2Dc%XmBi$ihBl$$#;ME+gf
zGhu=_FE0-R!yR3Ym!JCkrFdhtWs`rm?O9$~nN_p*+wb2~zVKGsYfPIe;Pis!67zXM
zIXPw*5yw-9ruX)Ot+}QoyYxoyoeAH4@~ytTyj=h0^8%MOEdoyMp4a088M&_4UJ`UW
zk<z+w;aOi_9tMWCqZePzYUnKfb@h#YVY5QXq!Je^Es?+Av9sIPe;=4{zRyGTzl)zc
zhvJg<rLE!%b}v=#nQ;2_we|Uxe`Z)3F4(;J^_iXBGjFyQS{qNkT+HpYT59&Y<SQ!n
zd-v}8rER`;@6{V6?+-ryRxWEZKifo#z2;i|`n$WT-v<_dmfjn8o~7XTx!8Bbl{H_U
zNJ_I*>E_LJh`xPm<_-mpqc7YfmItV;oRWF(?{T}GYwa~mWEEQs0#^#$D}CWseh$?6
znK_xUWY_o1S${b1>piM_`)tl`i!D*r*HVlOqZ@wn&%dzyNb-d_q8B?eue6`(TK8_=
zLA&ffSAN>By*I0R!JFLQ*7L&ScNHn?{#&upQ!+=u>r{WyX_i&C#f**`R~4SPSgC1D
zmCyVA<=d<MA6xybdN*_{ToQEJaXeVl=EfaM*@aOn*YI#x|NdiH%;%6E{=MtM*+0Aj
zyYi~5tJ#^InlGI4ES`M1$Tw~C0fi@jv@~XHn$RTU*r6b^%;R{)(xmOnwf4S0HvP}P
z+jg=AZ-f^~E4D=1#T_!{dC39qR<XIw{&2$Obo}?s`2~R|Znd5ctN(b`>2$xmb!FSf
zCIuPu)PGZEdjH;9^WEa5#k&MY35!g<+G{QE#ct+o*c!d){{HLA9D*$#$NMF2m%o|Z
zw&(rZ-5-}m97&!p@RCDu$>(p*zB)^kdp><xqVpyzGcjSx0`<H9_Is+GUu{w1ly9)X
zuBz1P?aTYm^#4xXuVEq3vM_tQF}Ib~?sa!_c*4~q#U6haU!TMFaLt3MYxt}F&$p|u
z{LoQ$@KWeBNw?>IKbt?i`|JKiWQFg`^^<s+N}n|xE%BK8d)ECkQE7j#?x=UpX;xVB
z@UhJ?2kWKDKKD2J-}-g>iR>5lg&8k76m{fYOTT=0F`q@o%j!^u{QOrxe!ROD#^$1K
zy?)B?P;1rV{bv(2bZlMzN1vE$a>uA~#+he)8=0Epy7xKHYggP|U8OPSjYNygs~sYF
zzIB1B^#W0Gmd?w4bZ37^x+^+Qq2}kRnKzl651yz!yWr+&R{OS9i_Hrv)Th0Sm#$`2
z{408Sx797j6#)T1dhbYNB<^vVxF+bE{O>c5+5S4d@Bsy#vt-sxolnU{7cCTI6?Yll
zy8b<+Xw$mQlNkjUa=Y$~-@1D1*26!z_Q$WfFCh0j^}>HYk8?c#W*(aKU&*UVX5zf=
z=wF}RZcTpkU&m@mR79Ca`o(13wfWoM-ngnCy85elr>D>R|G}qpPxl93E1d5Uo^i>2
zR{VAs)g_k>SA202Uap&0{d@ZRxBqWgb3fO(q}EekfBxv?;_~wE)_-Km`yWcF+<5rz
z-MPRW&bbBl<==m+9{&E}+PM_TLwRY6f3FoE^4Y&R>gb<syXPPCoT`22|B=^oT={K&
zx^2JIc%w*7kfZ#q<$@V~t+j_47EYU;kn<(+cM0>MWOcvk-(<hNDE_*q!Yi)w(CqE+
zeD-j^z7_h~F7w*94t`ht{qZ+nY~Ir%#rSaB-0J8p`p*uBK2E*7t#!(_L;o)_BvwdT
z{W_}sYVJ(Oo6k3#+I0R7XV|w)qY{&u>*OBZ(D|@>CXXzyY<K>y%+ko2iHU1<ANX#+
zHMi?m>mAj3jI3MlUajrl@3uAN!`Z)&rd};QW&77lnBg$Db?vh~edhmGH2=4<X(<;I
zEA2Oa=_tKdlkbqI%X~SLN6Q{;sOB{J8M7m&bW?-Cxxh2*y1V1V1m@X(zo~o9m?iHr
z3rFJGgHIoSx%0=j|4ALQdELjS*Lm;dN6+2<YRAdVUl?0i4t=^f`HSMQmsfxJCX2dX
zmgYG8de)O;Jw5Yg&Ybu7^oc)rKJKWEJKLwPHo0)|$t&vG#+n)#FEU<46kYax?cV#V
zxn|;8k@cdh&3Bn!SaLT*k=t_RqqE0!@9w>^qQH5*{iJmtmAP0abA5Qd@%ih?`@EF|
z&c*JKIZ-12s5wl$l8510$L$Blm&U{gq`gyR<={Wsr^UuSe}cn`qo>1fe7Y)qiG{;+
zm)0693FT<%?cL|6%M?B8O?~?KFtg%h<GXuPs^sezGR{mFeD<$d^d)yoDX*;N?>Dhe
ze+12QznQ-D@o7^~6i8al@@X#Kd~kEgwW~*a+xnJnzn2v;<CW|Gd&TR+Zyoa}xBVhi
zy2QZeQEx3<@0Dq7@3$}gFsVgahjC-ZJjJWc@5Hn?@A~*nPMfP?&YGOm-v9MY{JFiq
z&)xma>8&KNN?^*XBQH0LpPjM0;_I%naT04@oQrz0^WsUjysqaTuKe$0jTX1!UoXS4
zvj3}eZyURln@ijsyCSD84l7L7C*{>YXq}k6T-LU(D@84A%bD0KnqB#i&FXHfntjgh
zbCz&jzd~)7?70TTWDhg0qvm<{<b*gh7mJ<`Zqs_BlI!vC#gv)cm-eN6x#fC%UTE{b
zJ)6#-x)LwDW1;y>9$DXIf<G-i-7TEmosY+r-``vL=Z8Hncks3chG$g%cFwALzir`a
zg9{&@{z;#IIRBBAfKuM1#&;Jp)k0bodz*GuOrOM9xMpe6i4?|#$1HzTD<|52@=)6N
ze&7Ftw%$nrw=?}#8w$M2GT4@6ve3>(plK7A_Dkz6Rtj%ouIx|WU$md$=o6-g^7Vf{
z9_i*4-JJ8Z>ie6{$?0FZ8S?EGtO&L)dtd(iYq0gJyg3%R>(1@Fwm`B#j*a7e?VCf_
z7sO4zX0^gBB=$&y!PXZMQBQvaO`CkSw!!?#-n?c1eAJxXCwJ~=4Qfem>uc+)eYZ3H
z_LrCS|5+<k>Tf2AF^TCHI;?ne^OWiAM~~e5=gWCmY$^@h=I$vS#dY`6g#`QaA`FT%
zmHyu=mENwA@a<3PKZdqk4*NsQ554p2PrUx>!mZTl81?ebl8n=QOK(ZYaWF=;Zhd>}
zchPf!Amf=a3M#eB8Fn%LWjyTW8+716Vlwk;pXFzxUgUd~sOQR9gb1>6$X7knovQKL
zyfx$c{};>oLoS*woOI@l-Ob46qT;rvPx}%t-0x+z*mvP;`<n0PQ$Xdzvbzxs3NzPS
zG%USy<NLnfJlw(NQyYKT+Ka6U3Op&c-LHSv83$$er}rJ)-=DZJQCQfdGgEbMib(;7
z<9bGA5$A=A?H$rAL-w|@AM*Zo<>LHEW`#N1Gg=QBxb(_!{N|He%CIMqx%ix(%Ih7`
zzFw1V?w?o{#oBN=v0=ihkn$|0c_vr7-S}G`PCfVHgz-w9-zg`m<3evf=lwbFvA0pm
ziwq-4t6A$J4Yj5{6i&QyGv!4@FmKhDi+4XilN4K)VW`Z=HA&Y!!K+<le))t)2e!}J
z^2z%#%M0Gm+YDHm?6q=dWGRR=v&QYooc%5<oV(`Vs)e=dE1zq#JKZ}o$<Dcc!s}<L
zOo|tl8sr47W_Hq$JuS0;#X}!Gfo*RB7BSewGPN`A3Uj{a&$<84r`fOX3;(b_^oI5H
zoqvZ796WZu-@JaWbUL4lTG{Dscf$<@+?x89hOV?f!{8?J<k1hKr^i+)zCU@$-r0Tf
z$sHF%(ytgBGvDxDXEl3Gl&MFve0|OTO{to%1UI!_Wxr<hVbbiniwuP|E*3&=A^cU*
z_wp|u%{|jC#_`ge`{$pTdE#;$m1-e3sva#=G!d!_PCN7ePxpEec`1(O$qB;C&UD@h
zVdGb14Ka^7k~{kg+qK~HFR$^0n_mtx{J{{*#c@^pN9k)nThRx8KNSAX{^uaUXkNq;
zU9kSm=AsMpPuZ=HXzNp(eDcD@mc<er;n_xcCM7!6pF9sAx}vM&9IK{M`9gMjwfZ!<
zCI5sx$|mMTbv9pQQgpM(3y*7hZeRRvl6JXd>QxC2&8Ma6>2L1Jcgt{`w9;Z|xm<XC
zvwOVsF3-Iw3M*}{pEUchP+UKLwZy$Y1`aE>rr%%4clY<H*B;kQ8!}?qo$6M~PMB<~
zVxAtdFZkO`DM|BLpqzI3!kss_+#Nwh$S3jmp0$z5f2MV@K8g7<IcDQI>mQG1%dbfJ
zvc6#J?khg8tbTa5u{iylt0vB&$bNK=Rk7Zg&;48+=D9Z?_LUv^Vw$B8ax7??&B6I|
zCp9WXpK>p~Q(AWQSH&Y9)-TI%Sl9?y-E{gDn_Aq(RXz1;pn^=SfaA^O3m2aRWs$&Y
zA<<`&R#A%|p9qh$+?Lv{c<1T5x4XanWbeqn=(4;z`;6t@X4k!^N+xjDCCasOmfB^X
za_KhmE>D;%AGPD<dP9Lr{4d24m+1-!IecB2#K!k`M)O4Gh27~q-~Hb-9X8;RUEX&2
ze{7N}9|wO+lxTbZ{l70-*B@Ve{_5(*4jx7qI?i3Vm|`Spb#0&8y$SNVha|0}tomxc
zUVR+BUFunD%<k{9D*4T#DGS6^ZyK962eN3SpWvMz^X6-l=auLg2Bn{SZ&!9KURnR@
zK>j(MuKRVr=Vm$2+_a;${>dyZ*CnP*PF5;Am(6J35+uc>nE&rJ?`&-bhG)JVVjN!s
zwXPpeuln@m=8mes@~R`Zc%w_YN*489?vQw{z4^U^PwTSp_CMLwOd5+nn7X^XPkg`~
zo+fRyCRah{<cW^pLJ_IZ3F&jvUSt@}?2*on|FX2)m)XX+WJ}i7jbC5Qy}SK<h5kn-
z%MD$E@3+2+ICa9Y#$w0GXIJjDo}OQ`a$??*!q$s!v&=R=D)B$q^)7N3%SyrC*Kc*+
zTAwkUKgTp*Qu*B8;Ei32ue1t1IJVkA^da{t=Y}SR8EH;e1UPCv{p4OGyy>W(X8(x&
z@b7?Z2ainEe5ON%>F1iBzTN%xm~L=-=z3{gfvm5RCP9X0a#GH<l>b@1et+(*Z2`;U
zaxe7spGkEsUsOAN5@S)^QroE^^Za^e8aVHMRM(*K#?oTlujy{rB#Xs9Zz-Ly-AVG$
z_Ssvy<Twtmwx~=BYq>Zbl5Tojj$V&t7gh_He&zIzix&bTD&8GnWVZi*X+s5LVp8Gx
z+BZis%io_2PPcqf^*8zNp(llIVJBEr^A`R6ZvV&QWBQ#`&!)z?O_y@5zp?o(o$TDH
z6kqeYS)0)*;K*z{{f|Bk2l`rT4@yKXxyB~YHY2JrbY+<<cT3f?JShRg-w&r&$?p_6
z{bFL5^6|%JO}qEVh(D{`KL3*V0<W+4vrp@@I_7Umldg05XRvO{mqzvb4|cP!3_9wy
zdFkz^Gxj;m2r7}8FgMjF6%=<ovdV$)*Z8c^UlP>Y2dee<xK5sB@>565_z!nXK+7(c
zzd_<+Q<whR8!~g!buP=zj+UN@GvXs$F4ZkdQ0pn4F3;g%{7g^nV1%*46{V*?W*x7)
z+VRg;r+5*olhH=&viIs1wG9EO+XWIz{iWq^>E3QuXZ&Q`cr0XBP<`ful*;W@VzL$?
z2OWR$n7*+K=vlnLz_d!C$7QdPak{kT%pPf9HRt0RCKl@2HlIKl<67UYloX%rYi~|J
zKHkf~eEphi^$PLO-3zLt<HPLaj;zXiY<|D4U3!U-(WTkF(U-o9x(6>(sBv_u@-o==
z@=h?P>h_Z0nHq+24JyCS&SG3B7Tf)J`I)wgzZxeBE8kvG6ZllLVzr95*^U~SI(sfZ
zbA>NyXZz*sV?EPs>#c0;f4}KIpzEa{EG%uV^l0OA=?NU6c^BrN-FN@zxe3yHCcOOn
zQT>(o)Rbv*^$QuVIW9W5i=(Au|D?o26O7_OHJwje-^rlLy1a}D#(5?sJq+CYttu~Z
z804)y+Py?RQv6a$MPtI%6MsuQS`w7)47sPTT~;k{d7^jT!&B`^?%`|i9+{>aU0xU+
zpZmoA{{+6MO-ZuXmmk#=)t?i0{II+Khe-!{;_QNj553=d)V<Q6tm5V>ULV1hgv2)=
zZ1$wye&>2R?6c{E?F}rKU5?h72!DE-@?+sF{;hrUZT8k(4m($5su8=lyHtwffAV|1
zIk$HRS@iw4-8!v&Y3>7q;+pB6?5CKI8x+*Y@kJ@`p6J|nSVhXSEI2JKEiLcx^&950
zpRH44)$Fw|?c09oyZQaYMz4)m*RG%P@rfgcET@&w!((Bk3Li{Z6-!$B0<(RJw`~7@
z<#s;zF^Sg+0&*Yjb`)%611WPn?)BpJd)pTrvezT7g{}^tZ&&1Ea4gEgVTSKgyS4tA
zyKUSXnHMTMx+}fdp|W?|a?Kb=_n;$(HYOiuNnZ1mx#iQ>tqXJe*1D8mn7BY$@M+JL
zS;gmmX06`JW94-G>%8*V`1?OPg_{hQB{XcXEjbgtOlb2%w?n-yCK)rctE%=bTOX`c
za-?_Gg~Gk>@6S13U-D~9LXWAvLx#kpt+#u3hGd1X9$Nsi{MNf$6B(X1_gx4Sx60#a
zV&hgnc8n!?&06Lb!wVb5*e38>36-dH?YG@0yi>2QK)EExeW$8-p1jm733>4z!)0<U
zXD@A>@vT9oMCFBtNPX)Tb$zQB9I{(=x0k%Mt^VfYd4KgWiDW^Jt(ox)9z5f0>SK}Z
z%t};vZ}Nge)^vUS%}s3F%M%roeb`zo51+_nJ~Ve7^R6i@vYh5ZYt4fM*IB8=m9+Hz
zl>hVKpi^R1QINs08%+vR^lzWrrm?HCsX*D$ebH&3<Xr#r%h$f_SfHFI6SMKr#Hie|
zG&h4|5#A0r!mRQ_N<OnVx;OQ?MCYu2ctEYGZ%1IgRo<_Q{g2WVlX(Qp9FNb*)Y@6u
z1PYBsbJywiJG|hKo$PTucmJQK!r^h2=GNL0$v#XiS*z0i{NQv1#m2>d2c|BMEqciz
zyYTUaQ&Z31t9X3p&YXlELte)UkE3UWT|kPa8tqg1_t1^CWXZ$O)lxblyLt`TIKKbj
z%A2QfsJBHrQ-$Z+(jcxFc3Deh_t<K^9S@G)&KK`7bXehkcwMjd6tEeoyvmP)%UNX?
zKHlf8SNZoKJ8LqJz^e;sx1G3ME=-(qVdAH08~vpGSY%bbB)IR_JP|x7!Q7H1ZQ#q}
zz#{9(DVw=F+0;QJ(*2U4mD6$O{XfrEpSMw#NNxy7{A%#vaP1#KP^|5?b&qS7^>)9*
zA*(F5@Bg3AO@?e7Q$qp^KeGse0<QJIRP(s>%OE3;=`a2B++M!&qbtZF!*Ydyg3m01
zpmcZjLO7q(9S+&8R?6wVTA}}M-}l?|u`Qv8@z9N1Z!Nj(t_Xqb+M%-7v7F1v{l$ug
zzHDW&c~!r2!3LQ;DY&2^SfUc-e4O#}h5Hp=FFY<3&P|nl_xA65>-QYTBGel<+&2)@
z5zlWnQ&3TQ;gR)X$4#UCtv)QWg^#Ol?@RmoYU5&e*5ozS4jS?6M86h;ogVb$*xYq{
z_bpF9crCDex1iOx%6q*x-~9Oa805j*j>l(p%~tQ|C{TXOf9LDUD>Xt!Z?deM++W;y
z{(JkA&+@fD7AEwlO0+D~3_cU1v&=GMO2-0a%@tEVD)XLVlU=A>a)!;Zxm7qhc~SCl
z35A}n$$h_>r=OqY!Xm5r?^U9J<oeu)ZZB>uEO`^Z=}F&0#fTFU3OT&8<vZ`#IJ#Vz
zcx8%l@3Rf;AamZt@A`6YZ}oCDHI`%^fqA~SWoDmmb#b{6=vjH&O8SJO`-=`~_G$Y0
z8w#Yv)RK4v_+~uYer3Hz-aG}RL%pkRJ-hKsd4jlX;o^U}zYg-t>4>DMsk;^(mr$6p
ze*e|pq6->=f+Zmr^UmL#;8h#^T3on9<;9N5qg}^eeZ4tTa^e?5Hjd<F$)W;6f{yN@
zvOd)l|2}Ez+aYM>wdJY1eN$@><DsLa8gD<Z?C#*OIu@_`<>^(hqo?Hm*01|`Wor1j
zgHFd77W(|I`Tk+j7N6<c4V09c`Vuc(H~an2?FENyd-%GVcgLiUg0ctWq5RC{&pny~
zj9z%Su*j-P8=T#Ci4PRyJBqJrfdc5ywrw}Umh9Nk+~?x5qp&;q=mE1ACnPO*6uxH_
z-&1m2w#jgrK+E)*&#s#-*ws5tO2EloN$G{fn_C+v@_>!`|EN2@{)6K|iOXCqpLn;d
zt&%vxZ}Y;##pQR+cKxZpf}}aDKIL95D|;}>`(DkD#Dfx-#acdI-Z<&w<8<jf6{ST%
zx4H#1L`#nJUf9?wTL1g@_j#3W2FFZT691Ig2vpo>QV;rcbk)QSfdSmjSs_n->J}G$
zd4F|9)uHzjRFqb=Hro7Opj^_@_cr0-@AJ0m63MR|S8Um<Yn3r&*0cD($-jT{{+Mc1
z_t0lv%F;74=X1%ZnJAr-bW1UFb##AmqPuTp$k+4rcAp+~H*H)es~}VMm{~DN=I4>R
zr#<m}e-|zJtD=?mCrhH|!%w3?!HWx0wcHi*TKX;&?oI6Z_xHVeTz#y;wN~bq+})K-
zzt7tL`n;O=w`>2WF3J3jqGIuulV{{l781-Y&hhO5$KRavhbOn+6YAMo(@?NDvrcoZ
zPlaWRwfAq+Uq5Q?Eq`xasK43ZOJ$UY%dhRHi?@7|E@|o8^J2%rP3zvgwf%a|y2<bw
zpMckrhCb7mv(+<9suI_K)BLaW`(?zFOHnV1_h<>eymRot*=0eWzY3Nd>AiJf<N0mt
zWA|3QIU#s3;tg{P*Ncd#7tc7~g!k?H7U`4l^nyGubKWxrCEL|0fBYRa;^TE3-CuCX
zZr)aV_tn+M$NM;sCCMm+I2`}mc>C%7pEAAozOUA<dMAE(@u7(myk$E*j=LRlxYu|=
z&|IrCfAzDP|HpE^)vNn)9E<p@uw_ka@bklW=iPQScWycOeBF=F-V^`sS{NmfQDMw3
zcrkU^Ow*oL@1@{~<9hACJYQO7jzw*h!LeJchcr}6?!3DpTYI+IzJ7bP<>GnuGX$)J
zE>6Go=thvj6n=A1VX^I(@l0bK8Bk@Is*uAhYaW@VzV}D??C0@9Ep42I%7VPR&o&Ey
zQs;^#y{D($-CAp{laeE-a3=cN^4u$%E*g9^SaEXiZ}-x<J{+>08SCGl5(Z_7OUHYE
zK0W>Z_U`hkBqswkdk2l_OjcpS-7OOhVtJc|L}JcJ8ZW-}=V5c7OUQ{Ig1dwy^+9%6
z{FwXxz@cgVj83d2I!pFGsV(4d=Hkm)waHAp*TG$BRa@OT1C`TRlAt7Bc)ClJU$onJ
z^5jLL$vgsD3m)%NNK{xe_b%hYCFhM3UwF9uU8cjaP&u!q&uaTucl)X}ar5WS6znnF
z>!5Mb@4V-kjfUQro(gbnTObH>`WKD-$WND=`z{DtW!<~bU;n3KubsJdH)F&kHjef=
zDGeL$?Yhpo@?jQ3n{;PM#)+-BJ?-vr$Sz#mRJJbW=a<lM)izLJ<9Pbgf9C>Io`9I=
zb1l3sOw5@6`~|<0oFyozU3Q19t@;NlOl0I<d}BOx&?BaDZ}2BpCzBH|jaXzm`B>sy
zR-OZu1b24)-t+m~h6#oa8u4+iqM`~e&3imOE=*i8<)ihzx(gHYS34bN7LWh)Nw%DU
znT<m=*x`8dE;*AZ=jOL-m^e7CCcSbyw7@$CoKtKnUM|hI`yybI&=BDGv-Q^F-B$Ok
z@Ba%<;n*&ar}C6{2B(=sUQ6E<7Vi61PXs3%U|1OUwnUcKUTx9AJd3C{4y#LIw_lk}
zas(yl)BAtl{e9k!TU0{f%F?xcYj3yj_v&E#c}+vG<V{ywEPIvX@pm@L?OOYP-<|k;
zK06POz^eSoYsERTGYr;wtvWBI+SIq@`uijSCy-&hi@#0ZFH`$c^~M2)g^#kVY&Er(
zE{v+_Wnxx(v0{tUt!B?yxsoHjk(X`$^w-a+`Fxh|3IlV?Y#r}Sj!R#DUb5nrZ$Eow
z?*tC>AXBT1DI8W#$LHk6U%g%Z>g{$#m+5>0tCl`)beP`kHo111&x`5jc)h$YJym^q
zY=8Z?db5Aecg~7i7|7b<av`wvZ`;SMPgmSN)O*1&>EYMxYdx}-OezuzJyZLtZKh|x
zh(5I6fA)XJ&;Mh8v1_gn(yFuYak)@<!RR@whJ1<2iyJrft)9s||NrK0Yq-qGd;dS)
zx1aKHW}J!MYw6hTHM@_dzTf4pkip}zfz$6!^HE!Kk4+mC^(>nECjJ%ud2e}{QKPT<
zmlEE|{&T-SJag#6<@3e8*H^yMI(Fz>8(RSrv%-}XPaarQDpfxTxbWWkOpB}j{te&X
z?rh)xYfsYAOUn1xSp0kZUA^w_%Om>so5WMS#d7DH>X!d`v8OY6CR?qIrrd#>7QF(B
z7XnK<+4dH(H1#c%f5Bn3&SW<KpI_PG!NLKClh_?rT(@8NfFW^CT)0eHZIWxFj{b?|
z>_5-UOIdcEr@}gZ_Q?(3@AtmWpEhmF)vIN9cVEAJ<;vwdZ;CAbeUsd)t9!S%_uRK{
z%T}E_ZCSSLi0t}vAH>!Amb-J<t}VHfVD!f@>q^5(gSd{%f{lF<Yj<5r((LRkw31oi
zn!(pFL48gi>k_-ET0wE=PE=MIr2DAMW?pkU>`cS;yB8k3eE08mzD>o41Fvg8EI9vu
z_Mg=2cXxk3Ki5`xbJg#jmHYgq?OLUKm0BE*pA{4Sm~YX#O<EA-xouIuBX3+}OlWz-
zz|nenVr7rc^1_4r=k~0>{B4ivax3k{pU=H@UwHlcdHYrC`~NEc7W>#A_u>7Q|5sjr
z{d?DL`|fQ!3hr0ufA&1FJa=(mi@=>3sm7<<?_c(DZ*e$&<HLupB`WFZ&pR$MusQ4q
zTVJ2FaY}|&S`=qXlGX&BNVCiPr)w(B+PB%g{ryby-CD`s*>C6P*iE?DC-dU?{^QR%
z+5ZThoKQD+-@|wBR-HVRk{!^xA>fVX6b{7;hW?vQJePUVA+RmHx3|Y;=A=huR*k&^
zk_?KfbNVvHCOZf`6XXc>`r3I=*#7^Gy0!QEi<v+5FS2xgXZvl@`Ns?6AKE=x^`yA%
z?DXuuy5C#%UAAhve{oyPq3BTfbw!|drO^sD^QJzIk{D^xQX|u=%wlb4K;cuk_@;(H
zi=~-yq~GO~j14cAKF^n5`5{*JSI4hkHENvl((~@ctv_vg;mE@M>ObvwSzG5%n<`>w
zKeJ5lYS!YwhJXT&g%*4JG*)O_5G-+7kbLOJ$K}SxFZK0!cp3^KN_<SZSQgH8kWleV
zt1A35ThzqR<8#HF+$D}xC)+o#-MaGArLWEGS#Ki6udC1R?zY`+)|TrKHFe)iTh)s9
zUo^L!UUB_t(#795SvjZe(@7ETeB+v*o&ECA`V&jnH0XD4<+_(4qS!LYmo3j`X=7i3
zGLx*Zy5F7&^Y6Q_UT0vyaA=|E^6TQA%!$*^%7jSWkrFLa)I50g;e(>jckQOQ-hZE$
zv7`D`%GGIGF8z!bv$O8>w@holy-8W6%J-@N%oBWyDaS($H11gi9X!AE!RGEizfzpc
z&aH{`l;YXL$>?-Yu_frtvBWC=5*As(7c)#Ug_0HP)7Y7r6+&Y6r3h}lm=Ta^kpJh!
zt1~5fCe!Y(Q8>%~Z|mM2Nk1pOy&QK=R(R&$8~-`qSbsBEegAvq?)3fV)c7sA|LUFd
ztx&X_D5s_(-1h3EFo)ulJkym)mOBJXTnZkyO^@5PrPey4gHeD_b+>|mnAfxgQJPUR
zr+s?yMK)bA^K5K%$cE%&SKNPm?`b`{&Vje8@MO++#iWnj=QrLwI`5d<zK$=2!f{@A
zk8GdGd3Cb7fRo1Yw6KX;3zT1UTsRgUw{ugy{olW8MF|Wog;jqSu*!2>Zk=P}*dD;z
z%jW<08~1&wDgV4%;x1peKHe|;@6qKs7X|-pKhfA_*UfM;{{0No-uKbYd{3%pUNSSj
zDj8i<pZ%fW6N^*Ek}!d^(7A~Vl)s&D)JT05@=@mq14pX*ygtn)GbvpGUZ=dZ&hzW8
z+`ZuN?Xkh)w<#QHt>=9oX*->4JRG87e(&fLm-}baUYO>lobt1?k>5Yf&cxyN>RYb!
zZ5jof40i>tPH+MxJw}bcz2>jHyqn|sBp4P}SmhbmE>%#OD!TuVQ*`Xw`D`ys^NWjr
zK5AwBTXJpTdAoO+c~S*MlX%ORznpWJk}O?Ow8LYyfRo0>1?dV??t8IVX>sPcNN!G#
zx2`mr@w9<aplf+@(?x|Bl1{5X99{ISKzi-%FIN>FE66e({MPWWg8PE)g*WjRyU%ah
zto=gn#pR!yTWx)Pf8U#TIzQs+nq?2)@tEupaLQ;tsS)4oyjb~AbKe5xQ*(@;ADd|$
zz{TcZ;c>`sp1}T;FOPPqymN@NKRl~5abLCzv*^qX38#)kr!L*ce(m$@o!jd3{YqRK
zVx$h#zjSnOnb31dhviTMyHyj&w95B;cTb(V0c4s(Ws{lI*=;jf{rKO_{Jre@%P(`M
zC^zi1l1c4;W?U<H)nxbl+{<x`UV7bnHsySDRaN!*W9v9CxQk!dFV@5)E9ewyw)xnf
zW@$%vn-?5n_tvj$j4)t0<bG;f=go{OdYz1lp6`z>WZq&lS;IppdE@4nu4g0O%`x5k
z_!;m0-AZe=U5`I2D}MHU%u$!QPMlUsEh}P9E;4=V;0}tV#cogQf4%&x9sWS9$Dz?6
zZoT}59SOPJ3nr@<<)j5xpL{dd{PycNU#rvlucd#Aw0`?sH}d!W>f8D8lD8VB_$>^m
zy_&HuK;Td>$HGGft0lHI_AO8jTdg#AUB$tsY1!8oi1Y9|Xec+9h?IYFS*OC&a-IL5
zvF(X?i*@nZGi>JhAK~0-UbSgr=7s!+E3QAi_4Sy}S97VUXOgzESt+$V`eGF*$1LmU
zenIf>!pphQ8y0*$#@kqNfPv%a<-)xSdfh&&c279EC`atv-MdGZv;S0icrib0!~9#G
z&5s;T?5cmKQ@>_n{n}fT+;*Q{VNspAedZA<o)Q-hRcYSU?!8q>28u5_Y>OO@AJ}>+
z;l|FI%G+zBC-nSa6yREz+~ml^!OhV!D}3(0nSWnjdH(T--SYDPZzN}4yVS5o^z`(S
z`}>bCXMdS}`swN4_hv4CcPOx`Mx?QigEMDxr-O$51;IQXj~PWQvf+}wzxVy$w|ODs
zJV84KCq_{_UUh$uG^;P?uRg5!Q_|inU+*9%{ZB{!tl=f&M(5cocceta!egG4n=D$s
z{CQH*q92ph1zvPaSe3hR#*<`F!RF|GAy8S&%*@I3umr=xgCF!+)j5h)HY*6sGG$Br
zdC9e=YJ&eh)9~=8z4D7gnpsX9uRrZ~|H%RAOKTn<?7#QEc=t=bpOT%t;^$WHd+xiC
zrRQKTN9P&6nc=TXY!=PB@xbkZV9AlJtEOSE58khTpOx2^YjA~qVGqj%!_!i~)cr3!
zxqbGM&>>M*1)G0|w|h->y`(IhH~*Va@w1~}Pi}Q({aXF~irAC+k()n#5TBpd%lG|n
zhU?S5-bHisPptcs(DN^J@uZo09bi8>EvPx^Br-+##fsDg$}c#qj@`&fH8k{VXFe2Y
z#^ChLV_y6xL5;4y*}BUv*i|-tIA)fbxq7u~<j0qeWnbj2MdAcGep-K4>sfp9)Qer^
z{r|Q;uUlOB{K&@S`}K=U{QC2Ag022@hr6?1SGfDO-h9nzN!f+3P6{{4E4wUEb~5}V
z$YIsg=TU6l)Mq&9%K1a*{4CsmGH^^)Kh>*P|B1zSrEKKJE3Zq0I4rlUdy*%6%hdnR
zALY5q=h<UFH(o#e%U*uh`?+>ob6<6r@OQntCYP7JYR?gUpX+;Smn{0R^m%BE>8$43
zRDl;AF4Ge(oW3smqQk-cLLi6iV<qK&71hR82}bsX8dhr3y+<FK#jTiUQ>dtU@ckCf
z@b<+yADLXElso4}eswQDTw5e1EA64q9;D)|Bvb44vPr+)VaKa8CGUJ@Ddy}CJKuLU
zpm2TQ?iZ3yELKWe4(7xxzRY_qOY&gv0_8g$S6AH<kq5Uc4y#GD@bfeT#9D3IF4`LD
z*}N&Zv9EPf=;p7Ba&FJa{{8KT?bPd)&&^JHExY#O?9$KsOD<*=J-VOVywCHE$_dNc
zw@!(j4c}5TW!r&=HA}_!u3h`($l|JgL8cat5|<|L%`;BaePWh<=yoA6VL`G}iAjV;
z9Yf2ia0NjQ=4%S|+*#XFOv-(hJpN_6|L|Wa{kSFbPqnB1TT<9FvBl(m^JDg8#qBcD
z|98HfDlQV4_dMG;Q*P2XsnqKqzkJ(NEOM1ek#(}d4#7^{%d2Es!0Dumuf%7b!NZ)i
zW!IlJ)jOpyv{+7ReX^|ZrciV5&Fu%~{`A|SwESY#xm91zzPVuUy8PI6v1k7mJ4!a+
z^O;|vs_%aBh?=ubHOt5P^4sSf`EA`Y__wd*IK-4=(&gZ;vL)uEl5kN0C_NtPJ$UVx
z=VZNS&%amh4G=ii!JgQ5Rfna8-+!J&5!bhjn})?%&(}uRS)ZEo>v6cN_)X*IytjT%
zw)yEI{7KWL>f+@qAqJH;vA)mLucf3{&Gnn5xFquIw*9X%mI<o+E3jC#xwU#Zf>PlE
zWiB%@zj<dOJnB~^Cj8m&(%d-RpvY@;2V)}NSphbqSvQl}nZKEte||c>W!K{SYbKmD
zj?%As^*uiG{e}Ih{QHZQ&mCKn_PM&myU3xU>gjuzfPWTB)=!h}-!6VR4OHDPNX`&h
zt{&O@U_+E>NsF}O@hRbPD{pON)>*<Rprz+nB7Ig(QQ?fL0Na*!`M_-zitz_LC%4??
z<!!h7`(vR*?w51*?26VI|H3L~{(0#rRo5MoA38<c&fJslIY*1=>FE}?Z(DM_+$Nb9
zTGM0T{)I=;X@PQ7zDY~lcW?#6A{)HiZ||o1{cG$+3>gkBSd={Jq5@0H&%ec~X}nrL
zKYgyRaO1X^J-h7Otc(1I($^S;dfvYDL0dzL<<Pg);Wu{$Th387l>7C>nMqML&+)b2
z>FGL;&YSS<&&e_A61bzWOJuU4+w#xcYAm26Soq|UVeYRlbz(^jElJ)15sGtd7Ur@h
zn(?M_M7G=gZh3aog8SxcS>xpwrJrONq?f2XzN75VrX^W(@cF{?cGK+lZ-3nzxsH!L
z{^hA6OPMz<wcnJj8v|O;xc-oqRlE?G@ls4!F`(|CKd9zpkqvzI=4NSXDua-N1(TA%
zvx_H%XNhMBTw;09$bYZ6wB*9O1$T<7pP!vr-zvL#+4gJyPG&AInc!M2C4E}#-15>@
zMc+=GoNaLJ<~6VV=gg&SzrC%Wp`O_mFqOfn#ld~!&D^w~f0$+6r%5}yvxudgpIiO-
zilzalf(+x$+-JEDw;klZaZ;G^e#kL5g_O<3`_2n&D*W-;|7ml<_u1=t*;`lw+b$iR
zUw>%5=JIp5xBo3$X8G|lKTpez3=u^Uqmna|*W79l$YTN3t$`ss-|w&AzDX#8iKBT}
ziFRW^Yg5+ZKt3m{vZm$>uS?|qKFj{;?Y7;&dg;nlljgC7cscI#2>rK3rS`?O6$L>n
z-XD2(GQNIVDQkm(qKVUs2${U@tFK$F1xk)&g<cTMyVB75ef27bWdiJplMWv6l4)Ez
z%lC+-?q!A+6Y=8`&vq0Z{(ghAy!`si(E1biL)6Oeym-ydFTl~hEoF*b?e{n4Pws!)
zwo-p<%({i~Uzim;1E&^&(zJ((tS~RzTT6B;E)GzdcAvZM!{+l+>tYz^ILWkp^5&Uk
zHlwG-r1$jnH8;&Z3rl_5D13Xlf2#W~;pZ8f&RxD8J#(6taLc#$%RO&I9R2<Iw@cQB
zZaMwp@8)zaHU9~REqAT1%|HJ-FXO}A)GJR5Wd44$H~G9$jzhO7z2xv34n+|T^E`t>
zfwnquk<`?;`pd7k+~V7=TyOSgNEEm@vDRfHhk#g%Ajj3L2|xF4yvUO*)3U|-^jGHJ
zGrv4(nDAxm=dF=_udh!Hx)9z!J;+RJ)}7nm-$nmX3dzrY{qOtzQ1O<VpBz0J`#2Q0
zdK*h8ms)A5ML-%ttWB+Jb3~=t93)gqQp_&PwYc(spURo>E&bQo$ncOCr8_g~`k%eN
zk#*+L^tcK3XHWdf{%tm2b%9aa`80!^vsoWc>uWG9OtJiPH2ur#Kh8Jj=Fk4N>D1~h
z)nY+SKaa$)7J*Y+W_dP$VwQD0egRw#t}~M=UmtO??6aB%E2zo6F6E+3%U`(*Y%R|p
zC*6&WJ))%)mhXMK@%#O=br!B_#iu6b`gomJx+J4qnQy@LN&L;@UpDVn>1KXP|MnvH
z`J*Juq|OEN-o49RzsKW!;KoA+hEgrkf=(fQzLp%0?mGlaj>uUm3Z_5&Ctvp>Cxc-H
zgVV&+%WjKjrC(=hdD<=h&BXL)p2?{RWuKnQ&*yOJy0_W%k>oe+KN}CI&kH_3efhTd
z)!W@|7MJMH$^QNAlIxG-rlE0KbssDLv29J7e3)q?yOmN4*WopvN+C`37ZR(E&hY7J
zjqUACxaz^S@S;V;LH<J}-JTpA#VXxw3U@v~d%d<k?&Ix^o40LnxOr8D+c+`xlv}+p
zU&$+lv(A@Fly1vCldn7#q2o2VrB_`40`KSbU#rV5S6|WXms1uIf6*b(b@}zqQ%Bg%
zK|O*y8tb-(y?%JV{(X|Mq{Kotr=OjS3mYb@ueig|JV7GNBK6YOzrX*8T(A48|4(k_
z^hM?K`ukrO?|zx(Q@3Tw<mbOz68(#VUxvp|@J_AkvORNbpWL4hwX<TEyuQpEzHHfw
z-HUmqYIDw0WRVqgI_c)TCQe^_E?)_Yth3z(!IGHl%~Ovbvy$Z#$ZlygxS25}Qs7eI
z-oP^_g)60O+$7R&OX<!1^;VqE$#2aheY@lk<>r%}i{E{CKL3JZBlCKZ(%rkIrCxo1
zbL;=T+y9f7IDMbj9sBrrc)0uVh5hzVlD>HF1-I%ZG?>lwePa6))D1W!XQ}9a+`{u!
zdZIh~0?{S~9zQFw*4`VF)l<&w+_?Px4L74Y|EC*!ow?QelwWE_HJ>^qZ~yH_`TaZg
z#k*d=n>+8A+xpXAzaPF>_}MMCP_R17P~9je!+ekFnP)q~&TltfD(S&?XwHg)r5mO^
zcC&Wiuu@Xlr5m=n=4E3aM+uAUd@U<A7dJU?zp~P@rs#$IP7h1YOm~@MBUm9&<Z^eN
z#`DP)JS|(6d_GY9p66lHK7-TJ(r49p`qxE-{d)R*_x*~ge=O&y%kkHJsr#?^BX0fr
z*nAnA3Fc~DcHvJ|J~K!k$P#Um7F;B|{Q9e}MxdVA4#AQduJ0#2d%CQq&U#g5)u`8C
z&`@$lu;3F*_m3s6%ftVjlRxv=|5s@GlHzBYsfvPm2Dd)SYrYMOT>1Ws!p09b%;P`v
zhwfGSxjX=rR-70${5PFoS9}3(BRmfFKEC8d#xW=U2o3?Z6+VHWZiKEH=g+vs|DsRF
z+_fy0TB{>_ZdJ&m`vqs*!V@O<&bt@K=d|nUwq3gpX$mv5A98xC04nZVuK3!0c5q+Y
zB>msMy8PiCw@IyxfBd_2JDT{6jrEL;jg2SIJeQr8mbUG1T3VXNqUz}@U(J@<D*JHD
znwr@7okwOp{kt=MKPdP3y>dH$cXzgv(~{3#5ey4$g;!kO_2dcXvlSh=(NeX0W^7&Z
zP~Zx~GE>WwJ^X=>xmNx>>)>lT+xTEwlu5<k#}>Rni&O-<xL<HsDV>OamzU)GVhgxF
zVkvoYtor@EwiPR^w^TN;3f$7(x6Z7xNqOCm#qIg}IvW~W)|8n%Z+*UE>giXrTeQx2
zulf5nyzJD(gHyj5bZ+AN`;DVHLEupD0_CQP%saYICBfmxQT3$a{cU%hDc^)P9BH1Q
zW`4)~9FJ4rWc7?{FW-{8U0pl&8u(wEbU}5l){=GePCh^1bv5Bs>*g!oZu@LK%vYpr
z`L;d&Mz)N|%O5KaH1riHH~q+7%cA(Aqq&dcPKU1h|K#KARMnbVvzc3h=1l8zQu9Bu
zVynJ-E`!=U8$acjs)ZXb?7g<+$PMS;OQ)|~@90(UYI#}Vw%ig$vA%n9OD-7tZA@U6
z6}%wGdF``wuM)UUnI(C_@WGFd(UOvH&InEmZoZKDQsU*J$?76+<6d~k{bf!5mBhCA
zth1Z@RMUw6=i`G!wOt=AU^(=N|6cG@FP3J35*G*e7BA7d=<Ru1540>$z5_}|X(}JC
zXl}T`>Y&lnw{V?ZrIS(Op_9pXS$|&AoAYPOy-R1#Y+c~MdNqWDcSro3IVsZ>_XmD>
z_Ila+@@*%DJKlnfRJpZ4{nJg=1<HKjA&wV6-akF9`}3!OltV^hOz|g{`z@0GHoGiL
zRplKIN}ajzPqBI_*X^mP^XqpR7%IN6)nZTl8(+Wb^K#WR<tJ=bN(&Z0_~SQib3C-A
z`0&_;cKLT}Rv08PwmegJSY3GZr0|@>El)NcD!;d=Z}BI^uW!nNLsXKbk2;DwIICrZ
z{rmK0jZ<@xnA!28t3E$h3HrjP$Yg$~m*a2xiFfy!r32S;Ssm(Kko@B?e|dPQV>ZLW
z$d6ZdaL=+i_{#XIt<Q^}=4TbB$SbFqS9Ntg>XX@$|5Kw@|M!XyYiF;pnd%r4_+0mG
z#HFJbBAli=XzaSE!DQ9c*RlRuAUGp|#!eQ^tE+nODs%>~!k+p^X0KvPKC$edefsQ&
z05`{@yjgBhfBx-WHf^)5XS)B_Y11~WpKP+iVBwZ@3v&~Zz2)N7i@E*hIXJkpDDYg#
zlv!&EGH|Qb3l1^9xcz)P8CzDXy0LJ)^mg_A&wYQ>MoT?6N5?Q1FVm&DD>Y44I>o)p
zd^t^FZ+D{6!y|#Sv@LF4T$oX?ONisWj{Z{nZzq}=oLEX+9F7a@z4nj?(sE#wy}q`)
z`s2}sv&|oxH%t&0pKo)}JhA1tnANJ~28xY6N_S%=<nzCLTcp|Q_2y)ahq=l>PjjEU
z5}WJ&e~QolI!#3X>^YBkm-*+GE?`=!<vWjoL-2xNNl8r*-<y+m^=i*QwVnw+F1$T|
zq5BhY$;1nR@sfU^aX{OmH?kK5Oa9zEtNZe-`Ee_&1r`kfGwZK&&$3w<w>a=zrIXY@
zzvrAcAKF@;UShUn%d%a&qb5(@G{4^L-;0L@{b$qUf_rXlRen8l`8rnC3%4t0H`efS
zWtwE&&q`!zly*G6<?wIsxXO(mr_YZ%<XpXJv)ikz<<{03!oJ&&<;To_`~LOW^QUcU
zoA%m$i(4Eh%`6NmTVK4`QWz!HS6(Kyk-=$N!rpI;878NW-%iNw-BP&R;);8JzzyZk
z%F4N#Cr$1DPx*f9^hWmY7o`_}f8%3O*OKR+ci-!GZ(%$C1nJdvKh{~Awe31|hL0!U
zwbV9dPs8*Ojck)!Lh{RnI2whkSr}y>9&1`Yf5*GGmbY#cga>l!Pfa)>cGBScL+?-D
z|2<8c$_#4tTwS$5`A&v&-NlSc_v`By?Y`Z?DiHLilwXD;GD=9;;<3EOCdbyI(`Wnp
z{JwuX_vO3)mTf|6zfXB})|W(UaZS~~mA2%>{d4Au>o2}Y@a1)=n6JR`V#iH|KT?mj
z=PZc2@a)2bmD{d8-5II+zao3t^4&j<K7XR{rKnta)k^stf+e7O;lju8wPvqBpI_eI
z_P|QoVa3IQ&D$JaEEY8Gns82!i#_r0{rZi%j;&`!*tyUCl$ZTh^~|AI<3y&3m5t2a
zd~=5t98C><k<ZVE?D>C=SAPAuDNBybl{;h^_2tm!5QoGk`gMXw4&8{jx?KLW<BRo|
zZ$y@W3%Ny6q8sP58XrD<t%5`0%cYDRAD<kre5t|07U;LZIpWX5-&_Jk5gLaT_xf=C
zoM6VVv?$n)>1_NQx5cL=`|Y^|f&^GfbZQ@8eb@7)bJ;TM?ryi6S{2Vct?RhA)-Cip
z_s0AAnR@QGyg|`vm5Hq7fq!kbzFai_ji8p^)Ox=URd?U#<!QT#UI#T*z@_7UX`Y?;
z>#V)^KRdihw&jn7x$I(IJ^RWg`6BU`*{T9sCK>Pg=JV>LOm_@&ogT>5)X-<n{I_>c
z=;y1?!|Kx>@%7K~e!kl7=Zmm{3jv`|bK>t``f}ybksn9a&Tf91I(Ows)%AO(>_~pC
zwRI)uZL{*F%V+(2)bp>`>gvUNlPCM$o?#ka6ZYxW>7(oSM11=uU3$O1_-X(BJhmUb
zSFW43vZ%kkdC*Sl&H;8s`vuCNf@r~F<<IR01HQao&m9~*VP2Jji9KKG;t3N=HcDUT
zW>@rWTky-rj^ph2dAS@hOD}3X6Hwx~6Y=#UJNM!__peWSy5{$RE6%@X{}VR3do?wt
zQrFl2JnxtA+E0mxzUkiKU)Xf@Xea08`?Dr8b5^ge-+gFiAlqO0yu430`kXHaGJ?8|
z7pMK%S@`&WgoQ2d`%b2X3|5yi5)}XEizEr~IQcCO+}Ld@<=er|A;?m)L}c#|nYRxl
zeZ%tO`j-Ap^C&m3*{gcuquBBvoA>YNSmo(!ul4`raUXyFZO4zRR^)72)ctb)6NlAI
z=1qMC;EJa2^nE$GrS<>!S{O5bUCHmnSi*Cqd!yqDVHstWDoyELu9!6!Gu9rK?sa2o
z$yVf;RQ>Z%O7Y~2DHm5dy<7L#OS(jId0+X`rIXmg*Jm#{9=YUtz{K=loyuMQtA9L*
zy<F?PDsSsL%T>#d-K}8(SqW}3WF5PFc=4t4`7`-?cRyj`h|Kupa%kDtKRbRs;nX_!
z<oi^?EfI?YwbDyp$X9%cn&H*2z|mVJziN%atTj((N>-Uwp6@%9K5xzccdxH?d^p(k
zX=fv2mDb}Uf=Am`-ru`7amEI(g}?7UO=a7&TP=P0?W9F7ZY-Qr@bvwjohe0!TK4UI
zxLp2Hzx=|#&RGt#{$F`~Ma=Z=i-l)4tACzfVe<RY&8bsftiC$K-}(Y5^IqkD!C_vN
zcmLfZ9TtwgTcw)jpWT@BsYTdC>hA+vK?RZf875_qZ~fSx$l|zyn|rIN*({yTf@Q0}
zT%G>!|F^SjzdU0?@)+(#EAxKkwXgH%O;d>|Q&YV+Z@#&y;#rBDKTp*yAAXXnPuaG=
zKm1X_^LwwKzu<UO60R<~+iR}J%VhQFS)FUPczcG0d@%A*Z@jRw88njuY8owAeE#0v
zt%{1<pT@3dbjn{e#U}e^%MoU6mJDUt#s5#=tNh_wn3w<OyZT*^-81g3R=uWjEF-BZ
zspsXzFG*E-IUCCZ1z24j54Hv6Xoz+7_I2?JRzLlI_4~b(DbL;*Bu<<gd%k8K|IIi1
zexG}zRP*DV<?~7=0oNU`jw)UVztC_&qW9iB<`%7~rvmPDvA<`%R8VGlaE0;yW&i3b
zS{A?i_qhDGU2Fbcy`;Fuv#wUwR$Ke|cKYA>9FltU{;O&JHdRX!7AG8ibH1Bf|MH%H
zwK@uO=1Yj{%B*++gBE`;x|c6s9xrUSGDP7^$cKx9^UW>RcDsH$(saZkf9ahhLB{%j
zH#RabDK7kJ<**{?=&DWcUcTF#@b|*Ol7zA|XLqO>AKoV#r!VFZ_1k3n^poOc_hWf0
zcfR{PsflCOt?<06|97*+mU%_In0xbZWYN4|>mO&_@?9J_wP^98#YKzDR=WvWovZj$
zxFO(ANl;@z*oTXTra}%U=8GuAt84NszWBD$MCxo*8TW73ulhxyI@7M`JpEc-_1XRX
zbpKf$qUtN(WzUlpxOqCcCI7Ite(wKg-bOe1^?Ve+GH&<(!L^L(z>(!^YV#P*T)Vcg
z*)1Sj{u$><i4vU!y~XEu*gM7M#@&xobH7&@5O}8YPvUQ{C?CmG5gD(ux&As!Vs?Ih
zF25!ss>dyLec;qZi@`9t!E|}~`>r)Q@ewN=Bx*|L%$K<T)uF>cs`crv2*1S_m(FxF
zk<z`p@b4n6sq(t}|K|l4YybS!UEI!R_~BZb^@(WxiqBj1*8O|>^<|{Vqqnxn_3C@~
zZrye2qcLB9<bQYT7k!5JcbT7jdw2256&uz%yBFV->z>RVSMT~{<JM+2t8*tz^Q-Dr
z7H~Mt)-I7*zIxTQy#^;fuIbX8e9p||$Dg~;yv{|Wzx}N4@FM<HOIP2i-mX5!NsAue
zv8(;|{8`)o_AN|_Ef)*78A`n^S}LW`v!cvTM&4!dMPZ3vyCUyLKNjDN4_UgXZtKhD
ziBE-(Uw^*FV(WIH?8&kF|JDd|zhC(8+B2&crFZ_F4UY|5wB+jKg0ifVWqRtePPS|H
zs&^iY^0w@^4Vk@l%iTPtzRm4Yj>nlbKbP11Kiih*Tq*zNcfs?i#m`wD&;0IY5FKHb
zm~*#Fhhfs{-0~0aFTK1RZTIiO-&>l}oBY2%DzQmEckOz-MP1LFp2w=U`|`Bxw&iAL
z`<nVcan}3(Y{HVQocGfHWd>Xf1Vh7ypc0?jcRN@8sbM{&aqY~G6AXz_3=JDJHn=T5
zY;`}Q#4%`&kn0uC+m4^(rJ7DZec1a`yidOT-=3JgyXxQNY@Wn4eP&j%%<pGs4lQ^p
zCb&SAC*j<cYgUhM*%tP#4|~OIr`>0yth@fLQ`Ex`=6lyqzJ4!qu8qazh%(bfMb);g
zH+xLGcdR=8*ksK!n~xsf4)X_Sihh5hxVbK^=7+<I7c1l}Cr$^YovJ5G_~c@?S8irX
z+>({4(qM4+$0?VPo#s7m`s^3Nm%aFWQObVBuH0k)Q&R0eCA{RnKmX3=+h<mFK2vSK
zw$^lW?iR;gn*}Tu2s$iHKD%Or#^E{<#mqN%e!Mc^DqpxwOYY}6``Kb;d#8P}SHI!T
zwY}DCRqB5`2f-D|b?3Jnvf^8}N>*WxZLnQwJKy1ZvKMw8JU{dOg2xFVmvm;#7I;4Y
z&J<};SrBB_b3MLAJZ{DPU0=5`9Ll`AE3%7G;fzOL!+IY#hK7QZ%KT;PF0M$}ecf>J
zMNeVt-8K^QSN>SY)gv)^@v<j-kFmU{lvgi*8)LjdzFX7t;$IC{wU8pc`Qb;^D)!2F
z%q*`tUgq}l4e#V0<)B6tfBvFk`-wp_j=Rpw%~??Y=|kI}V9}=w>%1r2Ww(fw*4zF1
z{<YjitVeGt3%1_VPrt5jUs~ZH#iE+q^u!@+>WnWldb;{Lw;Vp5e$FD!Vm-$_Gj1`J
zV~3+Qs<^tp4GS#^$qOlo`SfbFZ}qn$b^^b`KU^#feA45lyl(Mr??Wb1PdnY-G_R>M
z*ywp?`NfRTYew?o^0JqkwXUw3=O5&Jc=Hmo?3*X=?tY;CZ?5qHH(rB~n*zbp_W$t+
z=wLSYOP=WTvoA{NdyH+p9LExa2*b)p*8=66=iXcD!F}Mtx?@*&9$9(0Q)}MEUB!1l
zpWju!VDVL{m?QU=tz5xye(EB@!-bMtzlR#_IsUYBed_b`_FdPH1>d-^_g}%ks`uhs
zpHAklWm@>x_x7KU>=s*pX}<lmEY)7ChF!L}=fVPOj*k~^nO>Xa>gmYh<m&F~{?yIY
zJ#=}(!;7DaSe-;zU(A>#QGff_DVZ~8UNl@>@!)QI&SKvaJKB`G*`7XXNHM9(NzYW@
z=hhHE(?wKs?YsNWFRcs?n&f!zl)60kRh=&8<;_Y0_F*?-59$6mmGkd|t@U<;a`xqG
zE0@)?uPeBD_vBUYOMm~LV2*m{>o?_{L4VQ}&c9467W##Mdip%+XutX?O_An#2Ui~5
zJFjTzj(c*}iu<_ueg)<~x<5bS=m*}c@75f5te9-V_}`pnWnOwltZCDi9Y&Ws)@!bp
z<+x*AY;||fnb28^Zr!iWhOf!nR`YA()=;;iM@OvRb@<*3E(w9cKiBt9<CCu|c^}7m
zXu;ygds=p+9+X$+S#nY1{Gy3(o?SnkE+u{5)U>nvj1;%v-qX!Bdn;C1e*Wlg{gl<|
z?*A1ztAk3{EwJk`za7J#J99@{m;b^D^?xM}ou}V<y}NUI@$JtyuIc_?aW?vml<IW;
zVBd}_{=0SV&UhDoeC~pkKiD2U)Rfx0C3?Z)=&OHSa&j{IzKSmT@!_v(e63>zn?CPj
z8TYH(SME4*>vK}E@f7Zjzh}-_6E)?P#l<Jq?`Hg1U%yp56&!D_?yko*uHLYIcjDiJ
z=4Z2{SPwl|^mq-2s(%U_0|&Qz?IU@PvsO<Wtn*BstdIYH?)K_<$*?asSHw<MyS6^I
zc+;XiOIN+x^ki8=mMoi~?A=uhmaa5>w)c<Hbn&{V<TMH9MO}Rly<2ChY|{wZa@TR$
zvp?UhE?qkjFh_o|)V8BMY4_Jiw%j$G-LB7_psaUHrR|>Ue~pZ52kM+8a~<TfGLrIN
zomwuZUG-d7E7R25SW_h~D|2JrrMK+g+q*8VKNq31Nleu8eR=b~n2)8hKCu_pt>@2I
ze$Hxr_JsU>k#MtPMxW=k<og-#oz2s-Nkn$4^x~P)qOze~t;=7%65(iGA$fP#&xD2>
zZ=}x3{%Z1H92nNIefIY-rp9l!;%e$r6HZsWnfO(?E&u1g+n+2q_vPHZbSuDLbmHYs
zSC{6FV^;r5a&yDx$30|944Si%yK8}nZ0Hg@nV1=uo>|RMIdafd>bZAX&stxr6Y~W&
zKUm9YyK&OB3A=?peEzm}V>riJyQ|&m{t0Zsdn*K04{rKse(9S=U{mg#qqp@$_Xi~1
z>2y%>n;>`H?Edj<7w31lIvvwLt1|ELf!3?P&pw~K#N$O?aJspYuyg8b;WhnpdmhhD
zRg%}$t$!d__F<;i`Ix6a7rQ6sC#lFLcDijAe)Q+?JW$a;O-2+H22qb6JqqiUyBie0
z-a*1bw^u+{r?X^Y!O6q?bF8aEn4Bb8b<-a2Kl}Up+c^e#mG_s6|NDJx^@G)|O?NiT
zSAF~L-7~ju#>`#&|I|D`!nt*I*tTm|Kkoe9`Yi4HORwYq60fy8H+x&nW)qb)m1&YY
z+GHM=nzlyEmRESX^Xu!|ewV!9m{#C+EPme^iRcw7dz;MTn|B}Cb*(Ktu4&ep4yoFn
zJDtU6{?C$_FYq_2Vb>lzTi1x9%M0!vp3M8UxGnPgz07-z&z_#i4Lp(%z_Y}A+DXsT
z^N*zq3VkxEd3|Bqd3VR<@4iYbvI^U!-?nMVkJ~->6L=V%)^6DubU1}+@^#i-pUYw`
z%BE;<7n@xWB3G1it}6Z8;*g&?H}}uamvL?`nc24M+|N!~7N@6fpfXL@a@8Vn?&~$5
z&(2)zzF2}|`SGI*Gx=PN1@t_<I$|ao9Ex4+t9tvEsnk{<mz|kufB1AF_hg+&aQD2R
zC?FWQ{Vl(4-G_f)*x#|be|Fz@SmyD+FRsU5sAk*Ne*2(k<#%>g!xgrv(xG42gM4=1
zx%KMD#sg88&tK-gU&m}6Amy&T-2blCuVAJZx6U#gF?9W-S#sa=>zPf94n97zmqFp+
z^rMAbXY3ulw*OXTUsyRskJaGwLf*q|^Kvs@G#E~`%rY{zSYN;RqO!F4mhO*Nv|i3G
zwf+(@Z^iT3vwqxqCmJNq+9q50NB8$Pqr{G4o%``WWMuVkw#A<PS6S>a`@!#b#w?S<
zCVD8(2c;V@PG&K&vy;=Yss2+T!o0AaRbKY85_?PcWThAtn+ZEz%%rCNt9!H}e!E$9
zLjC;N)e4K66^-ZD^oRxD2&%cVzaq)4NWH#aM0V@j&mM`6vr7b+Z$yfERM~AbQ2g=E
z<Di>jSL`B3=D=&NkHQ|sIqc<LP&8-Ctc4xZWm1KY39h)%IKAPc=EEQN!m~y1_?%n#
z_`tH(rd1gxUXEAy%Kf<W;Zyg!Ot+ehH@Z8_wbw0g;gET#^mKKqRPo;ljtjL8+<3z9
zGek=E$cy+IrOt~hVg(Obf?^jG$Du423Y~(2{`uR_wJuaT)@bnKg@;MOk$+kJUsM!x
z=Rf<cm9$V(uITZrqujmHpEO_mUHd}(-qg<}g~G*Md>uvE%N8wI^jKFwPWM>+5vwCS
zZ2y^x7({i_-|%TDF;>YR-#$H})OB*)i#-3kAMcvKn>Bl}_NAiJB0`^QISwrm(X5-$
zvN}CGmshxi=kCS#UQ#SGd3%(*JcUG(UA04s-bOxnciyIY#l+n2=Vm$nSO02tcxH9F
zPjQ3lRhtQyPPS-#Ik<iHosL~^o|^Broo_Iqru#_#TKh(a`k;~?PfaT=F!b~B()#nb
zzk9jAw!p7&_2S2OI3#<eF5Z_gSsa*mJMhDgcd^m+GMl#?7rtk^DDhC@jI9T^Ecp>_
z!o4b}L`U|sY^d6NNuIFWQ>*4ViiG@k5I=OEQN2pUw>a&exAU5>yX*gNWj?6Sb3M{p
zWWPDnpUHD{p9k1)iI;9$I_K`$`CCsL$!a_e-eY2z+Guw>H@>G#r_FNa0g>LaJ9pQ*
zi3Y0&ul#)Sq)){qhu0bjLZ1$vSy)-Wt~!q?^w8=MFJG6$>ls-w<}(7O9OwddAx`xg
z-delr#fm#W(!akm->_k8Xrlqsi;PL?N-JCg0-p4^trV5uD5)<v7ju8z$$F#r$4@c5
zz7}<2g@~;AUi(jbOn&-)Yp6E-$hpPnmaL}iHMM64LO7khH@7iO5wL&pxZ(AhS#rJI
zkJiXuH9l@2z0KrNUd73h2WJoJwK^@mJ-;pc_K#Nv8_#~a^YHNh6B#1rvY$ol^-RwM
zSvmb*`z!8WxBi35!&i-dyMJQ8&t&(rNhouT?Z(X_-l226f8Lw<?EJbbYkpW9IKN*6
z+`I)fag!xv)$bRde|B=R{#@JD4mXz05|rQn=G+pGe_!X!5zs83d6fTdevcbxi@`I)
zYs<g(h^N_GJG^_s(=qAMWlbI}-g`-!R?qmQotPKS(C4qt`S;>)m*(U*vEAY4=5GGX
zFQ%My{PDT@^$Y4!Rk!V4UB(wIX_l{d`|urwy9-^F+kz{$F!Sfl47vA5qW7KT@A+mg
z7dUT9e))~XvO{-4(%y;TRX=@JdzAD9w0+vVF#Afn@!ONJ)+^cDW?kLVFgZ(Q?dAo`
zPOj`<^Gvmc723fAb@MhZU-|uBv{CW1somnD9J~D_C;r=Pv3d8^_M4?fYI;i_AHVhA
z<EYD)!pCe;p2l+3HzukJYAh{J>|f!vbK<5+{?GmSR=q0|Q%Y<~sZ_K`JXoV`D!0P=
zcAQqAbKJV)qL<V=|8_E@vCnZ^+!ET6!s=D}=Iq1I%7Pq6J6(eQt=atBM9Ni!pY^iT
z%leg1XT{yo2+B&Tkth+*$qOk7f#ip_=GO0b*~Q}CO6i0s_=xwoCEHKCp!I8NpLF%Q
zm7VY3t!!rB*7MV^>^DzC(4>OC&i$gii?m$bvua)6?>QQwaKy=r<%-J#xp_)c*3S4V
zJmdK0sMK_!oDi2Ak9DSeU6Xo5w19tSE00VNXUY2IYXf;i|D4V+IXnHLMylb*M}`f8
zlP=f32yxxHL(x#WZ%21?CU>OTgDuN1u3$_%CaAf0Tcw=N0;OGfABr!swscPtQtGeo
z>H|Sg;&;4y#$8@_uKoX4OT8JH4oMak+KIY4fD-?@qZ5-4J^efHTxH$@$Ab<R6{a(?
zIK4U5cyaa9?<MYzZth9UC$=u$l)gS}YM{;g7mhD>ZnaddQTHn6XxN@y9e4j;p3MR;
zwx(UzFK>I*Xth9uxhSdNP~ZExZi`JSy9!Qw=b5)mkSL#UDQ}PGk9igk+MoM=om8S`
z@N!k_mj2wkNm@(yod0pQ!`1cD6I(ytDB}s7pC0OS{hp}g!IMyXuIp3hW6SP^PcuT?
zias=gyUII3-DSg15j)a9KFSVX?<OhWCTO+n#7W_eXIqSZ%#^$6@i0D1s6g)g^QU|G
zj})h>sk_9+ugE&e{5_}U=TX`Fb$iQyU76K$)O4nI$BAb453iQI+4ksPbyLB_)xW>R
zUEc41E%xM{d!IhG|LERPbpA7Ej>YX87p^T_TvfR1>vOx0LcQ6aSpKbCrDS=xm;K8`
zIggq8zY4_qYmPT-SBP*2U(A^DYEJFbi)UvaIi0ra{M_ga^AiWv*%pWV@p$|F@lmBm
zOIKR$I$yME)1-;s-~R?EZFy<4{)$X@alhok9!cMK&kUqOHO;w#N<vDm<b}E(kL<VS
z6Ek`u+Uy`vSTbj}0FT0!ORpv?1$4YF`sTbLzNV^(Df83JD2AT2wKabpJ`&7#Zuqgr
z;t>Cv4yQfQ*`cA%?@nF)JMZ18)2CnGZGKYn$|Gd*tkb7A<Qtwi?kpX5$Y9yA+>PG#
z&-(KBC9PTaR$flzzQ)tHzut;h8!zXm5V`Q7O;EeVy8d6_otp3Ub)Q!}X!Kmz<0gA-
zb_kQChk$0E?6z97Q!&TxZx&{MboiwC^*xr~+Bsg>hejsuZNE3UZqD?tUygU_3ve9&
ze$;(R{hCa-m^)9b-xYWqQGty_EiQVz=iXlJO`8rJl3+W;vEcEV9}J9&r`~i~C9-(c
zzcg28D7?_AnjH}O(K_FB%^Az`6%+S=b#B{p^RbWL+*@Y9F6-^KS>xLy-}%^LOP+3w
zmsexO-XlV9{uJ_bzPfjAeu=%=`<t=z_sZP5^XK4+tF_gU&(H39egE09Pu1^Le))e{
z!uZGK(82a+LEhcJHGMc|SyTu5s9bW=+_7+4PVtuDB;({=5$nAj`NGf5U(9o2=LX}o
zGybSA{OQAa%Qv9W%_`*W!tN(;c7GR)-z2G%5^|}|e(jPeytBKwGTf$4)W2q`evn~d
zJh<pEhg7HM-d|3ykBhtg^)*+^+_paN$->OXS~^88ESmV&=Wf51`kUz!*X$8Fed_H`
z7B_|e8s2mDLuMXW&UgLSi%gciFT6?%!Zp^`yji$-cGppxwpCkN7fL)!`s{fs!$-*K
zU3v7jA3NVH+J3)b(;a{N9R{k;AF|(hecjf4!PaF_4L81K`>ypDS#yHP-fgiD!?b@E
zYAV}*dz3Focwu2Z&1O&LmyTWET|VgUai4olgn|2B#Z<Q>p|>xun+kr|zEdLl1p~X5
z)vE=N;lss?lD+=_dziG4Y2nfyhihxZ)Q>Jd@piG}$3K7a@4i?2mwM0d$8s&%&u@P&
zQ?~oz=+L)oO{!(T&5Pr`ZI{H(Y{>uSbL`%lMUn-r`RYusGTxl2-qjwd&(@V@Un0L;
zSp8auMuEsmsj#O3lB@mv7Z*hsW<EM6zt4V4nyI-)rkSYNiHt9A8p`5N%wnuPcjY=~
z!}hYXtCq_NubyRcze}-tkK!ZEJw0yy^4c}OdD$BuEbLmj^21)?cY<<8>n!=6+I+ik
zFVeU|+OW2fXYIL&dp=I$y-QbVgk}XfwM+Vg3zxu)fja{)7G8XC@aoT>TrCf|lqVm!
z^@2IJF>yajs{InBoVoiP|C_wv;Awa#lc1b+`-T6kE-u;5w})=ret1|lzD_JlI45U?
zOQkVC@1mp1ZU0#peZM>P^NPvgGbe~VW+^<C`MtG5qBkjD`CLkuok{wutn2)B=l0&)
z^~P4Q$8BNx_Ptt1tyUj+J%izk-8nOp39BE<KHdNJbKvZI_2TgX_7+Q`WXuG#tg^PR
z0*yR-dH20^ZZpZbc}dj4!dP!z?AZ>drBVt!t6uDlNja0YtL3jn_^-3u&htz^zue39
zxY~qgc}7n*bUCT)ye!Nye@cxV*V}(@)BjD+lD3`3cHr861CKj*Ud=qRbBV8AO4Y$n
zE_b-JFHX{TtNx&3W<2Mdzw4Kv)0*GqL?^3n`yKPk>8MKQwO3jnYfseu_}8rY`RJ-=
z%O<|BI9t5WI;Lm6twBED)S&E{p}tGmx`o#iPckTZV0YBbjq5sp<-W_E9#=IhmO;kv
zLFF9_x3ssH5`T-^#n!&h!jBg#l}P(}ztz#%a`i9I@4)Y$kJ(S{+S1m2_H3TimKlvZ
zEv!^zJ<{$jJFxZjbNR*zi?+w{mvS*oO7q+HsX_Sjgk;9Gok`a-{&njgSh29H#ZESF
zMfpsz;Ny%6TYukqBki{Mv&-T@t;tMB?#=b-U;1NLVopq!)7*}Kp?7Lq1pe%~6Y6hO
z9lZAA=|kr6%54)l9X`+NIQVh8|NM1lqh{HcZ1}U<Q*_(1vgTPKpbB=bGN>=$di+dy
ze6E%@x0nE%ysYmhmn|BXCn&C6a>D%g%uDjcow8~6Q&06=>SSa-n_6wgBb{Y%I9jbY
zpk=$Re7%G5D(Ty6UOF~u>s$|bZL}u!%<qeDUv68Jd2_!%i&Iq4-_~cd8@i&7%c(Ul
zy!*VVAYnttR*4B+?<MR^k{l;Ft$yL0%<{ETqSs2ydLQc^?;kG$GL}y8Zr1h`D*2YQ
zpz83ir;ES)W@pd%bU^Xyn;m&wO>?{Zv_PF05Z>@1!qqjP!QjV>6T*u>uK&FBz{9gV
z<p%sNKF-?~$$vjw_t5>%%8)jh1*Q`(^Y8}Q@O;+UAhRcZ?x9~^(kia5rz5ABdH=h9
zQ95&N%8K*LFRtLs{XRGKzITu6o`OF+<k^-fRXv@PVlrzN!-2_JwVN)!c=+}80=xcu
zR}L?__~Ib*>-qK9>Q^nXbPe~qSQzK@T)KCai0oBmchI1?ZPAZerZqo4*8XN<Y&q!e
z-v5Mis+a5i$MuPaMdRGJBpiIbzNMba?d}~DkI)S{cjWs7EmX`Bize8;H<Ma=_u}43
zb60lGG__kbtGv6oLFV;5?!y@+ccX4*Y<WJ}uE(wQ{lt@(3S>m2CG}Gr6PCW%q2SpV
z04o7XS6?Ws*`8-9UstheTUg@;*+Bo(ujXlZB|0o!l$G-A*PT+!Sv-gD%j+H5cgc3I
z+mxn=bxRZ~Yi@^qKbmmVGi>4IjFML=n~zLv-}ifa{Ga%T_arYLGLo9g(Eser1h>UP
z^`Bm8OsJCV{rB8FJ^t0!Y!^W>-ulU`jZ+srUi6{YEwrl-(pOpWsj*e}>sPK8#jPG}
zPLbQC%~ypyVZ8K3BaDMPuG;cXU5F6t?HKmQO+TI4BC}<b)C1Q1ZmjoPeDS>dR!{aG
z_m}7EzbI`DNSr+L^4|Da+b?S92bf4LWzmxE-DiI2u~Om6#Dq!bF4b;Mn{ceLyMJd}
zgZD*2?U#B7B;XZvR#HvPy%!gkOG{btwQPR$cy3qsW|6B7Go;J}ju}|33OTZMyC=Jx
z!D}{K;eS1gUW)JiSH51#EBf5SUFpAqCmw#;vSi=p-cRp0EnCzi%6})hUhLb9yv2ci
zw^C>NNc`I4p(Nikzc;&XQ_f>;{m9cN?ksol>`)3l_^sD%w*RFwn$o@hOpfinC-FRh
zGo@GS*o8u`a7j=C0gXh3cJ<Y(sjT_^?e^y5eXaa0_qvQq=FAt6w|jY1%W72!@9Lr>
zpA_nJkA<r8oXpdB<NraH)ljRBMLpohB&TmJ%`2*&{kml;WvaJ$=iYgrDkp~A_6wcT
zot|Ph;ZJ9B^!7RVS)1PJ)IHbTeR0JcmBPPPn*Se3ckrKmYMg$DA=2uZHS3`nPmW1`
zEIh~}I(5-vJ}WJ&RY_vp!omj+6|4J|2!aZM=SPnJe7;3t@nWy5FJqggTzugqGFe*U
z$?GY>4}!fa18k1k+nzYft}Od+sqazOcT*Ye-D>>%$KTTI$+{^kA}nUyx&86&^>6tu
zi5!aqa}t~+dk?Knv41n)y88F^_$U08^EN4dKfWqtiM;Q-YiHL_=?<CO0?pLNPo6v}
zUH|LlpOcdX*$#c!xiR=cVdRy<1&bD+`l7M#W7f;>_e1<<9tn_H+vd_MY@DEasD1sO
z<<%1G;@>asNiSbMr^#Xehs+DJY*;w{O7sdn&f8`CmqYIMx0@RO#kbX;(>a%Y{>yP8
zHxs_2!6E-8R|g3_US9J0S#Ve1s&h}>z$vHb@soFVyN~tly>Uw_QlZDjD$R}aqNdfV
z23rrdKZlony0z5%TEE8j!caqVsjz1`b@eIB=kWCl`(06!<@q$Taj!w^bFbqH0*l2H
zHkD;Qn`d9AFZc1=D!KmX{J`CAi?0Yte*5iy-E-M||G1?m#Wn}*_I*9`)~x;aw*UI2
z%ql(eOiJ5?wxGZ2YrVX^8opS?{@WS2G^pf?qdRD{TC@Bfr&yd-vDzmG2~ELgay1^o
zc~{B;bb?+O+r*ZBc-6|?XXeemI%a>-QZ?h`r^5X$_4f`-f4b@WWMgSFTigEqA7ccQ
zb!8@2O}S#weA8I$kMz9TpE<vW<?T!II4|=34tr|of49XMw_o^kE`HwmHcq$C;@cUA
z1tPc4$J+nj@o=f470ZgE?82g?A3v7ASOKc~KvO(C@t5E2EkFI_<n(j%_R2OE1O`2M
z=yfr$^8D|AZ{uqVZ|<JOKTYEA`vognEz@`CE$+TNvs>8TUCH%_{+=h@7awsSbYuOc
zI(weitohfx?#*xJ4!+aF?ixQKZQ1Kh(`H)Dt2ey({F_c`i0{h{tdT3%{JI~u^qz4*
zq{EWCt6=rO@t5E4@2`D!Mq6Cps<EJ~X3vTn42Q0CgmHv+^__nI^4;DAHHR#$bt;n=
z)=KW3_)~wMz`3oBDc7Cn6u$qm^5On(rp&)Q^dDK7ye?*clei#kj>k)d)E5^&YUC}_
z{rzp1f8))b43k&7F+QF33KQoGdTC9ISQ7LwrKkAthJ_(aQ**7<u5Q_}V?o3GMT@<5
z2C~bF%7(IW%U3Yy?5TP=iKpdWms`o6(v!kkuI{_UWH;wdVE)74D&sSgf0{wavG9J`
zg6^F+?&KV|sd%}*aZB${Q_1fB={dqPK0IrTe>$tN*1G2JZ2OvizED99P-*{zY26W}
zC-3gpeUn?R652H3m$3D=+2%{OuIj2%;4fWuaYfF)Tb*a;Yh7LQLxE{w+3HoGahK8y
zfu_$dx|c6o($M;lDe=R_LO-YHAsnHndJCNXO>n%u|7X$tH#4WKT_v`ZsZKh+ZsLZb
z<SNcXoP}jux2nwOmJT|alyPC-jSa$Y7jKww*KhNa)90hJR~@}+_Ux(EpRNomQ}GA)
zeg=7;zUKe0@VdsbxjqcHp8u`r&JftTZEIe@m)oD`-#;=fs_n}u^}conS-r(Q;-6Mr
z&M1jow*BG?FVV=e#%_zXT-`z0FIi#f3ybyc{d={;TDV&dx*z{ASv{ny&&AGU-O1f$
zKR3C`UVHm&)22&?_cyV9D?ZF=S!!c`gyX(a`Q3g`vrnQ&Ds8ellMXfV%&}{ks*xgn
z%9HiKkMPC^@jSn;K3~&d{5EcxZ!7D&b%DvVyfoxxH!s<%yzB?xnfcylKi6CqH2?nT
zR(Z|$-p3_Zk{>=ad&%I^%)qQAn#>)%yYzF=l1iV8flI;ZK95J7qq)CN@?_%17O#ti
z&-;@#tXe-+8JeF~@5$BE7ruPv<(ZQAoxRV0E_T0bz$Vgp-9c8Up(I&)iOb&!tg^zQ
z=T0y8Z=V%@<lL3|qF?(Wjq?&xYVZC!c>d=5<Ce!nI4iZ+oLzhF#_H$itqZTXHZNP`
zF@5FkRB@KA_RKR_G#ADg-S>SMxU_4HnCj8ynndr5f$XxOpypgxA6H9aMxlh;Vy&xv
z`TLCiO=jADW7$6iF_o~}W&i)JW|(PT^Zp*!ypJcU74A8(_<j0SvE}fhrsr%1ugyg5
z`#IQmIfs9L>nr_sV{Y_W3#Ho4pmi<DvrQE<YrmFn2@8Mw>#6!jrj9mtm&$amxN6Ji
z580d8n6*ONRtmIfgBoO0K@Iywi<uH7yms&Hbqm#gw|DZgv%bo0`Eozc9ZPiHnf^2O
z<cage=KD;Jh+L>)=-I=TU_E2kfxD|u&VBbaMLHr|;#hK4-yG&+PhN1VuF=1u=@%My
zYT2xRTfScI*LYp&@*$BY_|s1fuU5-`n~eGVF?Y9%tCW=lZ#;Q+dzJOeywdrtXB=_@
z&u*)W30;`|jIBTC&H>G9cGd@GY;~I(vTEr`&dZM!wlrjQd0h-#dIz)uheP08XMefI
zu?7Rvk7i6xS3m8ZeBIVM;r0vvZ)azer8wIa*P5tG8SJij#B!wc;f+8Z?-w7AbZnBH
zwCBCvqUSm#f|YM-f`vDi<>dJ(3Ou^H+Lu*&uJ!%PbFJ@ouaDgswB3fg-G9-;+cok!
z%k0F?-Cy&x-tR+SD*Mk3GZUZmZwr+&dbmY;eN>dsrP`-gP9{B4I_fW#B)Q7v-g*vp
z*@nu`zm?AlB!_q}oh6u{5CW<PK$&E5)sqtrFXA^hufMHa>Es&a@KAbvlhOqdmKQ9d
zFB|y1?WCV>e15IpzTi#5-Hf$X9@;Ngsmmos#+_G}G*XGyzq0e(m8;KeD%K}|o^0*i
z+G00hlXH9F)|VSR+Si|rdUdwtANP_chl0IDl&ya3dbRTSfv>;bJay+Xo1}HHK&|86
zrh56Q$5w3#iQ`D_-6-;JUC`Oier~;&puqxgVIwMgnB~w42lsRHO4EbZG)>4VeJ>}%
zthr<E+VzXSh|G#^F>^h3udMH<-yO5xjnz_NPdgNjctl^Ez5ZfnR{Z`~AKU%qZ|Doj
zhEKKsVR`)DGAD^=j`6A)Trr}1{v^%#wrYXY%r~E;pIV#TkGZrizTRx^(xkZ;)?NKO
z@7Sa(7n0X_E%ov=*k=T;8bD!{{03a!MT$uEt~&7J&F}YS+o#|E`aa;a!Tc|s{%u(@
z6^A<%beBCk_q<<*Pc-vEM5bQ;>Gt<?txHavoe=VGTg{h!k2SBp%)I6`pWTvo`S<tv
zF>}2YOKvZhw~UIb+<j<!cxw888I80AhKjO3!7D>ndVajTt5kTY&x#i-nn8^k*^&^2
zH%cWjiyS0Wx9-!G@3~{0dupL+<?(Gfd0JXG%!{qQH?+$6>?pi3q0EuhUCix)(^khI
z$;FSaY|PE;KmPGgiLrE~VD_(XTwjHD6bZU;CYG<!k^bJE@h0=U<&q~S+V&{kcB|d<
zZsxy*RjJqcrEYZIZ(X!KE?@8V<#myLM|VwOIhf!iWnOP^DOMt6Wk~mAp@jVgVCR90
zvXT%59`Bcqrc$AiGq(TSD_GFMp;&P^N5abD3g3f8%|QmcmV~%UFtbfPn!n$XaYB+5
zbEB#EC0~=K-wRl;oORtWzxwIIt=T@CSFE_Z|DTSUbI4NNk~KONPgN(b&!{=d8>$s`
zYL%b&(MPN`Z>LOJv-9AQ$IrgsSM7V0<J@f9Eq_>I`N2%rpN*BpJ067k+ej^XwIXQc
z#f+o~6A3%3RiHI7p`bBfu9nPB&R08`KEL_-R{WGNo1D_Rt<1lrg2k?EFj{{0^NxZ)
zKib6OIYL#IIHgwBJxcZrb6GL@(+gAas|6pnS%h7hthuhm&o(aP;OfIJivu5=%1zXo
zl^ay>S+X<m$1iQ&YVAs{w)sU94RW5^l-%!Izh6V%UhI|fgbjxJ(<_gzYSrBGQjEXe
z`1{G@hwj8*3@p7Z(c6@D@KOl4@eEG$x(aio<@3XRm>xFWX5-*BT3hqQQOA5`zu^kE
z0w%q_vL_3^UHvM~w()^(<}JsUEhcNWKK~xS^T99C$R$!0-&H?}TAvDV6m;+I?uc74
z$ENUZG4q;@&ViM-^AGS{*|@u-a<<zZ-EF>y67I36?qhjXXY(ZD40pQDg<7tx+0(RF
zTCZmc4n9?GBkp1Lo~P6%_~D*Xruf2}ob~f>PnHf{b@OAPL4?6l#DK-0{X021%MP||
zS~OGo`CY%0!tBA%wzk?itbZF{cWvwRlm}iG-_FluRSI&LEH~wP_nz&4PoL+Ukg?sN
zYhi}7pP8Of(g#_QzuTG8{@Xn=jj<~}_WS6hw1+Lx$tJ%JDU^5epAuaxt8v6Ikn^A7
z?ujqIt>3pGed@dj_n#s+(i}nV2s-P{p(g+uSIpYJ%IjiaYQu&7i$rCU7yo*`e3En3
z4)?9Sio3cxA0OV?WBPaAGDD$8AG`TYid~BG$1m<l->xazb#6{lY2RnB$@%A2I!*T7
zUw@6~lI#oR-0MoMFPzF3XRc^;ZZ2E&smj*%)q;p8DIFL0&YM&I-RrY_*1Y51+YTOJ
ze|AohVe!&UMj`u@QjeX|oGik`+})=Ynw3<eBeY-<c&yOtVql}estbn3R=sY;a{K06
z1-&f4|3gOTw7gM=qRIOgO}Ead{%83A>)WyCn;)I$?A^IKVG?Lz!$c-c!IKU$@~x(C
z9K7x1UF8=aSL2!e@RQQy{?fxU4!+S*jl4HwdcpqHR@ZOooo#BGaeU6owO>^n9wtQO
z{k(hfZQAkAON&0u4_MLhIzWTff4<w|v<aU=Qd?y@A1X85n=#SIdB@|~`l4@{y8E=Q
zE?Uy^vaqnsx7b4yJh{+yA#iDsLJx;|TYq2oWTu#3yRC1|a#+l??Q{G4)j{GiclVr}
z*IZt4H_ATx;nkOC?QLA{p0rx5u_sQ#F-7J5jcdB$=jMHN4%7YpU3A~KqKq}Q4X?j*
zu(1SJUJa|wzwV!W<e0a^#}mhD_{-MDPV@Yq^4mmpufV0ZZ~xBhc;95>wj*EP@pDq4
z&~4GeVht(lfRCG2`bY)KsEhrwexdMGxmlrj%A&<yQzyP*arz&W7gExbly}9^eX3WZ
zLBNX{atR791qxGb`AZgBxP3i&p5fuwZxN4jl9_YoE6!LYuDav!&(|wA80xSe`*E^z
zyNun*3W4oMm0It#2I%*S`{nIE95uOWZiOFDk;~z!U(efDSNyfoyCLt($(~%zr;wue
zu_$}>4v7!N{hF6<YwrJfEMv<Gg%pP5`SaY(ML+B2P2YQSzFPDy&)KI>eLFiVF{Z3Z
ze`?X<EVr6H^&BDKrEHM7G=VZZt7UA~T>{l-%Cw`z`{c8)znpl^M_%)-?m{2UkK4a=
z`d?ov=DtgQ^ZWhob8?OZn1uB9N!S`@Fdh=|_x;zh`$*T!RqShuX7BTI*k1H1Mau5u
zpOXC3e0|;N9ztEhk01Z!IyANCpUCZ?6>FY!UsPE1bgI^)J2!t-Nj2DB`p*?t{qw`G
ztuf2@D!sbF9<cuGnFWqhgqD_WJviO#VxZ~j$qnF{ri+0W1DC$4QJ6D*LW0QclpP8m
zkHz1M>-uuPMr84xXxpDoGILJ86F#aS?_A3#^QbMw<k!v}htC<_?@}+9NR!$=_4T^V
z0ecRanzUSe@gYDp;8gRY;04NswqKqu(A*U*t3OSeZN;li(*$SxP1&<|ih7c9n!!&0
zzq%3q>47R=GR&7QJ3jkmU5C@sAKQ!{zMRXEud(IJ?e!}!hv|Ez=51CiSKV2k`uN|C
zKmSf#_5U7V66C6Bwd$FggaXgLk_+He9L6Rax{8ls;r2yyrJt*-c*tmIE4{c8vu*j^
zndTBXw^#H#zuoY7_WC<t4d*FI^!~GSd>2#u)3yB6p_N@lPA3zEYK$bqm5&M3i@Zu!
zDoEmKZtcl1@mjs=$0;XX`9sqlRk0T{RY=^v5wE$Or(tUE-?<-Mk8f)+?+|smH?8+@
zi%WHl*WL9~Zp$q4<-4|$M{?Kq_GufRCpynJn!8aeG-ttLEmgw_poOK-0=1NZW3jlb
zuja9SrKY|!8@B$m;7E+OUeNCoaC!NyovmGSUhbOG<7RwBHp6pksrt1El?lI$T_3(@
zda~nt`n8M8FRsX3QljoDkr=17kC|7ySjKH`(iVlks~2v1?ELh><*t(w3wOWsy3=~6
zQ|qJR86KP6(-Y1gPFPaZ@#>q4d+01fsoq3T(@V=-%W9Pfs8=%c?%$>ummL#V%`LCI
zP_uMG=-hc~Lep0oZaNdD^t(UDWY=DmDHk<LZ2~4ZTK|&X+Z`g^&U=*oYVBN!+ds^u
zQZ@Q&kNiyx)Hq%H@yALF2LC12IzgRH0^I#d$BW*~wv<&6;a<K+x6Vmth3BTa>*wuv
zOm|#+XMM@SUA7kkw_0c>y2Z!@sX+!T++|BbGzHvvWIg9K>|<KJc7Dx^gN-#?7qdpP
zzVq`?dMRVuwYvKIjw?l8CQ`hj+WcI3RpmR%zuBfA_ivq~#=A6$_j0ZfbM&rY84Hh2
zjk@P+0}@4(+E@-xb68NTdTntY!(yfOuPc((3T`i#PrNAE_4-ARXrq9jo4-SnM!oDa
zE&q4-j<Trb^L76WyY>A#*FvwQcV^tQ6_om-59+IcN50*sG9^A=tbFl+Bio^^=f8+&
zHlOo<(sStcZu8ln=DvNYBG9CIjVV}(xiRC)mvj>??k&u+A8S|6G3q>F{rt<^mQWFi
zaNCb75=?&G)=!cHWuaE9-<`6zk1DXU^9O$rS>JNgNhY<T*k=o~?$+@0^YgiDCtP@u
zc=u%Yt-q)Jk9>^JvCHgFx2a9||L>-;r{k7;hQ?=J+GX^aiVJ@ZT6t$am!{P(cSn$G
zA$Tg&L*2lrphusqC*L{6)uZuu=gMb~PEL;SbyDDacJuFT{nPJX=Gk87`n7qQ;Kl=g
zZKmIDy7(e|{&wpZ9@`wxPAXBj(9Cf3tT~UYj%4pXU8&wnNm|bg6`GzM4bJ)h$@ups
z=FiW&W@KFu?-mz0SJ<k^CiPlpabVyw_NgN7dJQVIK1nkYO7stlhrIDxdPZV1!-Al@
zGgIu$Z~pnWJ4t>=nC$Z-zghR_xw=mUjVXd>-IyN!xy{BAEF^ru-o8u3JSjj^jB|U<
z54przzFRvB-bl2~zgFBYl2dTu*0=ThAJjcMeK(pZO?0waMGWWX>fXxL9(E!h&bz<)
z{cZieg7X@auB%J+%0*39mzwNVJayAWjTN57D@7zUV$4iEBlyy#KISIIOyE5%@^<k%
z9-bmT-xQBEUQ18C{wk8@_a{4FOXosc==NvoN19U{r+{`pECN^bObhE>O$E;R`+VuI
z7j!)SOLWskjkgOn%)c!yyvor3jQl5?nvC)(mcilEufO(`TO_0*-K%$+r&RLj;rmO%
zFH8U2BPf`VEOCDMMGfBh*}uL`>UDFk*OKmCcdF1wnk%s7662?f_c+(Qn{Uc&RHEOo
z_i#?>W*s-#gMURQs~t1rSrJkabAA1ZNAbT;&RuHt`bF5Pk5fD2G+~ouWvjIWjxm_)
zy?!VDN~x)DAy?87`wtmc53%y~Oa2M;+W)_;{ebIn=jHq|8?tI2%~OyUZp)KWx%U3c
zLFTd>#p$|p?2Defc;@^2`MG22ZeMB}bMDT5Zu3bYxZ~Z?wV~`UeW&)iwezVxxqEj0
z@>8epbe~-C-NEtO!UvTF2Wx_N-TC|aytw~7h2!(RZ<!}cJ=ytgC*#{~hbz0kU1TnP
z9&snHf3d>Xx~IzgV1F!I)xTSGzgU?4UFX~)nJAHNNEr$4Wv_6MNPRJ5Vop~J<JD{Z
z_9BUGIVBA&_jZ)*I(o6Y;$1-UH|Fot`sH6YY`>N2J^lXOx#??n{LlNWbNrz2N#j4#
zo9}+j-*+uVXPepf`v*3%oq5cq==NGO``7o(wX2Hq{i;<aw(%((krG)pwb#vkPwurH
z5}z0~{0yXQFKhM5HXVNw@#p-n&s}>BJd#({Zkl-d@#^}S$3k9pf!fy>M7yP`)!414
z`%7>q7YA)D$ok`&d@s;#Y0{o)^8R-9nl+C@k2|kYJ$WqL4cdeTmHQ47mL)2jS|=QK
z<R#b}UTyg2zq#Q_N%?v;)^*SB?q1_1^*aC7x|+O1(XS@ow*@RRZOY(u=J?~i)^|<t
zgfAO@U!O0tZ`rcYsai{C=yh0kCmUw$dj35=b@9dd$2K^K@GjkS@x_LPkE$AaZ}3=o
zcphDl*0EV5P}uMFbiT&Olj4hcql1`R{_?GlKfWO3^uO9=DjBlxnzY{8-TZ$4ET5tN
z)ULK-Vdlqtk%78z=UEu*o$F6qAtGA}u3SOmlN^U9@Gri|!0lK3pv6-p=Jxx{%?(rR
zPX&~HI51meS<#g*KQ^DaC0s3Wk^9Pyb2nI(y4)7@uKw)u>(-A?-Je$6`}tWqPU=yd
zzv_g9+V53XmYQr`%Q;d_qJI6|{_w~5k_Jvs)12S!$A2zUJEj?KC)JS_IJHZ@VAfvF
zw#e^q7<L!xEqapIbuW=iJNB~af#(YE+(S1%+*`2p#R^DLfdp?`Q18Wz2G_Oz-=<cU
z?}!Zea%?rr{hP1b--%S;@hYBQapcxyp+y<%gDf)_J$}QwevgXPg^=a?LNiw-rj}`l
zEt=t})n=XjF{e4hWY?`#8oy?&X4%p=rRJMve_3nJ&a9+U^%~!$vS#0Qt34yktTdJD
zcRbslAK!Oo9w~V3SNH1d`YD&*@8kS0(!)3D`N_N;r+3JQp7rf`&+rvg)k5d5S6$u_
z*l3_?_(Ig_@x|wM-~RmCyp_#u(r#hheNnq_?NfidSn1hS-RM^qzhA}qce>48d-bY`
z?XB>2H9!7c%HPLS?IhKEZpO23QyYJ|EDp3X;4Blb%(?x-U$T6OrEt2e*Q}q;Y!A7T
z<%|y8oSLO~`?4O_q?#K$tfo8E{Jm|S5oE~zdq30f_&4D{erZ4NmwW2xHu1KvRE&Lw
z!rse1XQuW3?YB_vxR`PGlTO)V^}BypWH~NkJjCD$nIr_0AO8m(P{}_kCY)BvZz9}g
zBz5%sWxK43io3T00;?UOe*Un3Q=L?)B;7mh-HCng^^UV9JW^tk`{Lnt|NoAUCu@zD
zM<4b4xZ-@=#M<|B`_2~LVhKCi=w>V|Q6PIaBu6SqQ}ol-U3F}lKR<8R%6)jw@cu`q
zFuPw9o?aHt+rG*xRX=!k#reK2l{1gF-#7TXC~Obcvmo86Q~wyR^YiDHG`R8Evnbf_
z{r}bG2TfMbw=U_J7`y!9iz6Rv?v;Ez!nyt83N2kt#SE4epu_^jKk7x!>Qp8t<}7%8
z=^dlF)L(}u+FmL3$$J#fS3hA~SG{b1t>IBy1~(I_So00*x1O05D6-u&Q`lwQeCwJU
z{~jEjtbVdr0MyspaeSkt+v2T~-fvEyyLR1FR5Z-*pYi(RkBf}lC%Bj#oz{PExnRlh
z?eXt_y<|6%lRS0m_1(wQ%+{<5$^K>Q`%UfW^Sk^1lxTm;KeN{`?To+q|83vT&MK_<
zd+XY(RkxPTY_s=leW;kNGp*mXqGQjr?EjyyJYDW!Ahow{?~Ak7Wz>Uo{rq^Ou7eU9
zbk)i!hK2D*8LZM&*mtFhI0<|57Zj~wS#&4PXjzo&x!uVdGfYmg|Cz!qqh0>j<k_j2
z#@}+E1}#~5@Y&=mNBVN_sYvzilI(AKGVQy2*m7N+zu#W>>hDYN>PXaJx|7jWx80+w
zZ`Gmeac#$cyxex*bNQE>zp8{iZ=GCmb9;F0Ij*|Q9kZD-o}8=wWO(g^A_sS0&YA80
za_e@y*VF3dIkib>o=Wers*d|w$1<ikCLMnnGV`QifMN)An@C7Wh(b?MNsLU*;=q-&
z%4HW{{8uZZof%wGES1^#?ov$hJFklwQ}*AOliaem+TgfG;erd#Ic*>Lbg1@NEcQrL
zY{<_KYgqbX#odMM&(7`qS?P85zLi<EZR#yk>7wwq%C58Tdo4mE3pehZndy+sl~umt
zQ8?F`lP!q{S08q;`z*33X2sWwrdg4bqKq6ZEL;z6%rbdpe5kIh=8sPMqenWfrsp)R
zK+R@w!&&)EuieGMzzvHzE}jf<TdaJ)aE*@SU(IGKzM|ra_A2S#ppF9lxXa7c?Uvs2
z@%Wu_bO~qL-jkc`uix<a{QTgQO6#B5MK=PNm;M8nV@d1sU#rXC+oEQ*_0`Arw+lR`
z?{KvEf9vn-^Jh3WFI+tTvP$}_oA!1W4u-T{O#Q{WWAbe|;U127jX9YGQx00Ton1d?
z_eRnEt#6Jx*o7=gp7Z-8(^Ng5UN_-}1AH7Ykl+P1v5!kkWJ*lAXlSY_*5jrds_(V=
z1)u(fT~AM&Jvf{x_jba?6&Jg9?@mrmPGy^QrMkF4{p+zmj^`t~J9oSg`2*h0W5|&6
zr)$N|$oFf%&pxxbB>&ydx8kqbzf?9Qn&htAvE2H=F+29)XPckp&s*fqSN#8+{P7#n
zL1%LezAapM?oeBf>-!bE7tX!U`6TyNkK6lor=ym+EnaA1|4`mx0c0isM0z!D_<XU@
z(dmMAOU0K?hZ8U6Ru|q2?$7<7^yODN`;GTYHlM!p!EE6}i^yGv=czxexyIdmVp@YG
z|MT_PXHMH%)XOEDoZG{+>%8bb&|FsNls5(?I~jA5_Zfem@uQ-8UGw9*H}#q?t*y>v
z8yja$Pc4%EF8=%96v^msZ%ccWlT5tiHOsH*cy51J@@37uRT{@#+xX{k=;lPs3^sem
z@5c2~&9wLRox}M;*|k4g3e9`m{O3j7UA{b7J2Y$3N&z-!(D)-{Zl$Y_;bGGem;9r0
z8fmO|GQKSS?pm=}ar5Eorh<3<-z?9`+PQSJelK3hqj92iCdjG2yEqTGe6zmJ_a<GY
z;q<>Bcf-t{{M)xI|4+?j!B^F1{s|g8Yw@U=Bq)A&uBw0i^UcQ{H=kdawP(M^mxsUk
zpRa#@E;)L8$MlfR7I%3hgWAv3J&^nDe0*DunWWjb37ng_^tW%@bT84NE2Mjpkg{h3
z#F18@((o07fYebTbG^568A1;(SKZ9mve0f$?%jp2mi^!S;cB8+{K1Juix(*`<a>8Y
zPRw_$>D9hdavKGXwY0UJfAlclis93(r>AXPB3dQgw;U5WDgETT=jng7+VA#${(sY&
z`?<xsHQn#!r$)>d0bNUU%fNW^=05YDGMU9WCl!p1jZdl=AD1}(+V|D(lj@bXUz$s8
zbvH4#3f>;{>GiyKavq`opWUhUi+FCqpmN;tOSeAf^klxNpX@>}E;*&PDV^csl8Z0a
z-%c_4<&{-`z2Q_6lhfkG7cbt)C^50x#l>*Q$l*BSRM&iyU*2JhFTPn?z>&gIcX9b|
zk>(4U-|xnjU(1{&VG=1Rd$#v&{Dtd(w%=Fz!Pwdx)BZDmuic+N#n1MBj9T;N;WMXx
z2d|rp_fL5t{wV$0m-n+ThqUqeM;=wV-{>k|d%%iI?sHdS;lb*B<J~8IE!myde_ZO}
z-VpI@2K#x7YMgdnVObn#>$<u1WD&1cwZfMLi!WY$@ggsD@#4k}KQ3<kF<ISYny~$b
z9{nFPBL4H*KR=UJUc9rXZ`HPA9!3lccklmcBWvl@pq@KZa;mMy#JeKA^Cz2GN<}B0
zd-7{d`ut0qnGR{@1T>m&j<3)wm8omLWm+#cTPllvsgiK#bOpuc`7<|2^Cm6mahqD}
z^*g&Jah-gh^}F98Gx>Y_+}t5yrI6!a@+SI=Lq}wWpTZNrjc@&46-mmr&#lz5<lU0$
zx9|PCH!mU>oS7<SAMXn^w-BysId$QQ<=>C)j{0d#k!KdYF*M}p;pF(-tNiVUVycOj
zf8Z^aElTOLn5E4(bjbIFO)@j%QQgG(>b6ztr8UpzH~!_A?Ko$Ne#s-*?Q*v^DyOD%
zZPNSm!S>wg*QZJo&7@ixHcz{F@kK_SiItRWZy(#CYwpJ%`Ok~^^>Tj^)5Bj2oo~Hc
zqBs3w;U(MhQ{Aj;Xa233I6cnf+ppFC|EQmvFL|Nxk?i&tE-vNQ=GMB+di3vya@aS8
zt5Y_yvuimw>0O@VC}^^HljtX(b;T>|rF#GUs0~^-#g<2~$#b7<-M^bc(o27|wtsr@
zGBV-yF~P&z{pOkcKKgvY9i4<XudY7*app&Q2{Z;B-9a&!n^mw<viFnppT3)$#rA#o
zJNGwMZ}H;~+~;C1?UfdrWjw!j)r01qeUE}}>My*cem(h;bou44Pj)f~wtqKsk}8rk
zGuV-xW^-|u<JBas4(-;yj64<pl)!IlcgjA`um1MOa2cPKpLxIZ;cK?1r<oe|S!hYh
ztq2P>RBSjtaU<tlqrxVuke%mP-|ua9;*iXnX&~1uxs2Df;ds<KJJGeAEsz*~kx^2z
zRfMB@@r<YIir5a#dSoW`^m^4huahjwJ$0{`zfbxzufBfz={pt=zePVew&m0Bd~P<U
z2kjoVd`vGhTUGYH^tbUcR-erz>9_B{+{?_Wg1Cl&dgsp4=W}kp>15C?i@Uo!yf540
ztx6T+k~gZ?k83#voRZUacmG;4=We(7^I3{}9-LUue)HG-z10VIrc^zgwQsMW;`eni
zmQSt-Pxfb2xY{fwC*8)+tke9ieSPNX!V_2bZ}Mgjn7{Mli;NNzb1B(aR))k)r+TE>
zPiAb1IrX%tch?gq$6Lo9ma=;H9X@B5{P@JfA7x29Icp6!sOvrIH@qIVv^Hbsl>c0w
z1|4ZCzc*UEYs)sj!kZencHY@7Gm2Ikr*BYyx8P&g0`8TQ*H%x{_g+`LXl<8(jIq{&
z$A8N2C$-*mvT>bk&2Rg6ifgR>pWN?xA$DaKJW?2hjyTL?(wh{#e(I7?p7vS4UwLy(
z_2J*<%Do~x;UmMsix->0nTlODwv{naa>3&Uulo+uLwCkF``ZTA&iG=Y)RbDuRXeHP
z`INTa&)n<to#KQ3-rijE^V9nMOH@PGEKT^n_v_b^oMjPtxnCK~F5dO^s+Lo5DP5u)
z>^s{s^wiGv`+rT}RPHAva{bHO%PZboUC+XLcvp(EoVWdJzO1bCt@3+TUtwP=ey;lS
z)+d_J_WTm!Gwf(Qu}XH*nTJ~0QlR{FwilEp8bKw`j7jP-dg3#mSwBB>%qR7QruvpA
z7T&u`U4Jk=JQh=1>6fH(Pxj}!g=q?B+!p;>HP3$1bGb5!!h<_!AMaHS>Tk|y(P#7i
zmLA*_p>^ytOHpxLo#A@E%3o~{OW$~=IiHig@S@JXW`^twU*B_j|1wQ>)z7!d3HfpP
zP1FvDaMyDzfdXAi-2K*M%P7mN_W3zwrk2p7_&JeR|1IoWCwE--d-EwDP#F#?0NmV}
z6WbRg&ws?=H2t*clO?Az`Rx_vNtXY;s%v@Wjrcs)V-|euJl%}1p6&bg>EPMfNuTeD
z#@ElhGkKz=MQ`buy2rt1suu_DzP&xox2W*O%jE*M52!t>3%r-GGt{>FNq$7E$K_}1
z_ZO{*NLx~ndvWVU!C5iK_1*8Tx>2om{h@PA0Y~G7%_5=eeSaK3QL6T|@3P-i>Gqf(
zvGV*}X<DEH6c*>aEo=Mxj!v<8ShRD(Gd|hYnUUvh?@oFwaJXUL^%H^l`{v!+@@Dh9
zHK%pcGQZ~;&#TG#7oDH+EWpmBesf9GmI+6{I%g&K7QRfMzp3-3^#`F>x2-aj{1zIf
zY>F$tmRYG+dS>eMx3Qt;=l!VUv;Us2X0pUfCgQ%r)b;z)`=2aJFxmCuF@N$esru8s
zo9ER}d(xAbK6ja@n)J?)V;s{<e!FP92Du%-C&~&+rJ!tOHA@;?wyt@^=rsMbQsUHE
zatGJy{C>RK`qd=vrUMe!UUH;v>3=M+WFC{NSiOBw%LV(hyk7h=Wxr0I-uI)&*CerT
z=c}T%n|BmG;Sf97asJ}eU+dTXw=MDT(|!2y`1}2fB`?i6S^0d=mp?7D^F2BzTXJ(<
zy<GWdiFMx9M>>btzQ1b>x&H0-YTx?TYxh27OJfRjTzK<OO)Jj{n}@IFR~HJbEBi8a
zx~S+sN!j0FC5*SNHudy9a{~o8$ngT#M0`aSo_;FSY<h(!Yt`D4Q?=#me>~IP6Tz2z
z-|x1HaKo08zI|_$3d3(@l(@tOUAt{mC(~UWzV1Y2fuTx~{M`9b4_z)iUMPFJQ`P5f
zkAcQxNxg=HHfgL2FC2>dbfWv5^1nuB&0_)w1+IkHYb7_HasKrE-`4uqzN*=EHzb!I
zQ8{DHpuNbdO|(y;TUL(OIjenMp;w^e+?^YD9d5jECj(JOFh6vV?%fr0H1LDZU;g_i
z=Nm7VJkwNu&!_J{=bQ?G>ocDi+GJkil{xTB-+Ow;bQOE9hhpV_1GG>6b@V!ub7NQb
z!9NTkC3DQmqU0=_w#=yFTFEnE_9oS+e}@dq6}K1Me--+0X|9}o*&$u?O`Kv!52XFD
zOi!~Bxwopv?%f>o=^MHZ?=F9xVR1p=km8!N!EgPu-Htnk9%X`740ke0O8zb`cWqs@
znekympPX{Z&Y05l`HHc8`<N2=@@{ebQ!Nviw^waX;~j%M$?CJBU%EGS%vI~&pLf&f
z)1l(Yx^n{rgp_t?roJ%^-^5>iuJ-BC!t1fVhvYtVW^=dAVLW^#!0N01pV=RO*dGn~
z99OOCw<^H+`M<U{&F}Xo-&!T;QsrpgFFE(G?}1}%lO+NsCmw3L@42S1;`^7VCncw3
z9ygWWpSI{mRBB1i+D94oa`97K(n0OI=&LVYyt?8rWA7;j4r`6dLr;qi+OsT9Ue+Xg
z`e3iL`4!&T|IW92c-UL@erK;&DQ`=EvYIogckj1VA*WUEPTj=0*7|pe?zy^u`in2R
z%U$8R;nuXr?Pbz;@f~@mk8rN8`g-KNnoP>0x7$x>wQ(N)@$2QWC!3Bg`k)@(dV#(E
zlCRfvwceFEha9*3y&n-#a!k0tY3rYh59e>Xxbfz%l~)=sfYPUxlx*x=DUQ=jvcJQ&
z{Ii{K`suUtX}qq1H=NF^*UMNII5<{5VgGde&GUJl@BH0WyICw1z8rN|p5DK9zfN>l
zzxSbx67KFB>oQpPi)D7&{9wM@)8M$o{t&<9$<w}J)8l>KtNzZHGBsMxdhUnxdhWsx
zG256_4mCfi650Rfee>x%H+G-?XfId)r~kO@^o3_y+}w*nZO)85omho45oS`QJH7T~
zl(S4W**X1alyIVe%4K1}7f!pCe+r!ZyRp6VY}x@oj)G&4`}3r1yVl+~bEf81VeTWT
zZ`anR6h1A#pV7*>OV&7j!=ZZPePXx5GPOn5pR4?6+4d{oo<p#eL2A${rQeO*4s|x0
z>g@}~Z!h;hoGLOqfW>No;eX8-H}@Vl#zQ@<!jOWUAKb!oWp7Ds=-V19>g@L;nzw9c
zjHHRf8NUOT59MQL%{X}CP|6?P>(46nwB*ZXEpq&t-j;RdyY;P0Hv^(4=jbin9I~-4
zSbh)xXMZX8z@Hp({-t$?(yF)~w>C&>OS|*&8wv>tot)O7_;@<=<HU=c4t;xm{Mm3W
zW|4^Zn$&;hGq&f)d#!k~)1+IdIdGAd-Zm>)RViuN-{D*w+!~7)Lt7xbqC`1<hlHrC
zF5ell?FpyCha0C}yeQJG_^!(+B;%T{rdgx-+1B)#c>9ly(uI7&`MWK5t~=7PHdt+W
zk6SZq#-D_){=X+hkHof3v^TBqD!3NPA0VF@wCu2xTbF#>(nO!Ybqjg8-bL=4v$i;{
z%CTFk?c;_QOBh9)FUNj<#<bCgQ^<V2+gzbFp5^!4{B>@A*O;GM!nLPqLhi;78(-ZB
z;S~|sRwyY8YtK)W<=7nlb3t;cYR2_#sTBoN=lo&%+~9fV)M0zet@;N#S6Z@|MA`D^
z-gZ-xZxGz}?4?xf)z9v#Kc2q1G^LNdwso6Nh|AU<rOOjlPrT%4Nl+8GsDJ*e{=X;5
zTf83KO*L61RsQ#CSN8+QYV|i>e#~9-!yJ^^{(n&D^$qySHzo4n4&{|%HhF8?5|^20
zu2j9vd|B3V>#M!FT3-(Ft~Tv;TYP-F%S`FsKDXmVa-h7-(vlnXl&Qt-_#-WGx!DO3
zug|Sg+?p$AZf25l%0rl6!Y6Etvq7HXP5#B=4P1`;$r~68maZsaJ#svSyY<zQSJu2G
z>g-aP4Ut-AQoMC$U+wGq4K*d3ttL*oFP+8qC`I|@`pF_(Yo(H=m%YEHRi#`qchl8_
zcSO~mzkk_pcjwA^F}adAit#gxz!f>T*C@r|%`N*o)FEkUc$(t$BPOP~+pZa2WG+k(
zRJwofSJk_h{CW4*Y<?5B#bD*Og-bNO|DHJ591v4xIGN9Xle~ava;Lv=Tgl|2hz`A*
zURwPZ&L$r>2$HbpewqLGf?`H+qO05D%1w_qGN?`#h<Wm0?&sgm_UeuQgzRVk^=-WC
zU{|MeVrS{6yX6V1mG6oMUwax~*Vn17*=KT7Nm>24b*!P)H?2s8lI^P?UC8N;8+<No
z%+F+6c=4jEz52OnJ2o6JTYJf+YhLps^`CiXu1?RM7-^mNZt8>Me`|wYFMb--$$h+J
zTI>70izjqW5SlpaX0xcM<HVTsWBp<QFa0Viipm-v&6yq_6Ma{{(_gdI^QZU4RxiPl
zRP{2+p9ks|9l5D*vpf6Wo(bzVF3i)IXS*_8QPbP=*<<fh*I#{ox^Y?l{AK4}yb8X!
z^!Uf)&({krvxDZK5=oA3dD-7n)C8ntV=v3qJ-E;(>s}i$kH7mw-i&%NGn0;g$1c|0
z-f4W!B;I<#{6F@c{rsOBvwwe2UDt1E^2?x~(fa-F>i@g8%4B(NU-vQW)6-S~-sbEr
zLN!U#N`AB44T|PplP~bTRpszk=d8r*Dbs9|bFzxBvQBroD17_e8};os7F_GP@pav&
zI-#p8o+Y-}u~~2Bt9bpL>FSx~^8@bG-?DM5UE)1`1Lyo3%k&Ok^>>)Dvj^Oe2X#YB
zOa!*o@vbxCoh9wP?!_Z(_S-&B4R!v%;{IcnIcZ7b<TZPk`q&B^LzN8w^(}rPDs*Da
z+*v$N#km$Plv+92pnCbEUy9Ar>ffcLGE9AL&ROu)amK+66Sf}TWH&=b4W>p;LxrbX
z7f&o|74Um`uIXIOFHg3&w|?$9u(PVLao2{97pKe{zfY4m#w=~NfO+!473%`)#07*e
ziAa4@H<=_V)wA(`XML)ITFcs+6yI8_b+1k(vpFqZ%nmLM_^ozD$#Z1R4k`6hkV#Q6
zu@Wm^S;_CG{JsCAc@a~>@?&*@ati_<ImWBb2|J*9qHDsv6?a;9Z1a)O_meKZ`ZP*$
zo$SL7y<pWt>FZbW-{s#?WU@@)`QDFO&lVlfy|?fIdv3eW-<AJ2XvzobF|f#%zI1*1
z@u5=MtG%rgZlBPd_I+9k->;m<{7n-tPPzEv%HlG|PZ>)c!{<9S{OnbB-|+ukEBB#~
z*T4LnDf%Y5xGvwb_R963tlXG&jiI8suC?&CUWq6}%gxm_4I57Mxb^m}TT;lq$K>_R
z<&z|9A89Q5@6s${H^1j6W0B8O(KUx399lHb;oOX3_Ag4?E-`BS_qTP;x_5~G-q|`O
z)t%?7-eq!5Dp5Jr5%jR-4Ew1J5%GYD>FF9Q=8`{GL~h@($aq>`uuJ$0zrYC|eFod^
z-CnG8?^MVk7J1dri*llV{@w1`E_br+#+FN_vtAiJoz7wQapK0=c3v_WtRFtAzRdVl
z6IiG#WR|LXd2_eRAwF$LQ#H@TYS$*_#LA+_4E=&)sgkl6(|1fxd(=10>FBb{+d0LA
zxa>bY`uy=*#IKvnGxSYz`K&)*nRblrPN{Ws<(wwD{WguCI2>n5h^#+#wl(7*(>abG
zrdO^#@YX!wpxP{{qAlolf2Cc9PUv?3`ECmA^4Z@$+Nb>wI%D(o;O`@K3RboA9_3mH
z#EL7+*VYGcAO1JTZ{h!l<}BCtyN1PW68h?Av^O#@jS}u(681s0B`wuyww6h*skE@)
zim5wd?57&AOUc@ThheHNTy%(FdvW94NnyRk%1L~uIA_UyX*J~zF1WKV`K^TYngVBj
zE~mDNy%RVWetohd{8q-63y<>Tgadt5p7r#o>nUBmcH+#89yi08IuB$yxF*f!+-z~=
z(4Qk8FP}e|e$am7jlia)Rqv-ywXgdxdq7!qg1@@JvmSMM<_}MfPyVvuVuZqd!;5pf
zT=|?Pv8>(maq64MjWPBzD`txXhMzr_kb6!+Sm^)Ft_dJl@6|pvivd;>zQ|C}sVjMt
ztzcrl?fqUm*{YKXC1)8I2`-%^Ay7PHYqB3d|5R7`J=2RN{J%fydZ4|-rMzo;LY+>!
z$$TlVLM30lqUq<iCTcXb-PC&WnCZ-;DfTZbst&yUBhYX++a~j5`-$xyXSZ*uUG~Lo
z()XWwnrrMCEDy>4lDoU`mC;g{**}hd@^!f1y<Q+*p0CMRK)LnLWV7(6K{+yU;>;?W
z(od{B|9Mre$*s>n9v4rWc>yvac=6)hRcwdKoQ@xKQw}el8vDDeQA?70W96TSpFb|o
z2><{1`<Z^mkTn@j{6}>p=dGJkc114g>!Zbt6S8hSv53m_yjZ_tjs3g#JFkn+d?C8_
z)lKKw37tFoMbtvfY7eG{PB=f;??FV$;o1=0=@~~WN<YoLcqN`e_t4YH8NQF^+pTn!
z-zPuc<NQ<Y<?APF1RB=~q}}LM5LUC<$n6x~!@ud%?))3_KMikm>HYl@zh(i8lJ294
z!rxq6pFDWIiv2`JNO$4RU)&tV(;<Z>xMjz7=-T=y>E2y^OWTqjEZpz^XMf`IIS1q?
z=k2caeINHb?CSsY|8@$wPx<fn?t64;*&F8<$D{9jUA)2K&mH5f=aLU^P(1ll`_{LJ
z7RATTnQT2D4ayw0T=e4ZmMHIAb}c|E@*$%}YxCin!t3)3m=1d$I(0m*cxhNnq>$aD
zP4jL!O7iwbJN!(_DEso^-Q9)SGoB0auej+gSFu-Z{-z(3`=37W@=2}9vT^z<J9&q@
z@6P{nDaUSPOflZ%p_W)9@QLka3zMYKtDnwi4@*_1F59v&O<;33kJzN7Ce<}M#T!)4
z{%qU97AnSoXkMFGZPOC?_WFy1#R<2?lBa&S_gXyn`D^%f-|n4}?jAFL9$EZ&-QF&q
z11W!+_c$!SQyu=vLO5@a-}jrZv$KO%DQ~~RBfP0ox^`(@_xA(3Vumpny<%9H<#KPu
ztc?CMZTgjYSDL5qeDk@U-EwtFw8QQHRu{v6I!yc*P$>C!aj{TY)Zb$L1==%boWI?D
zs7+x`&*cUF5%2%M5x;awF>~?^&ZSC>n%_hO9zDJl^6r0Mq;cm056Rw7!fuzOMAl_{
zRnDupeKzON?P)LmKgk!K?bg3Y&}wG$rn(mbKSehh{|^bzidi>nRT(RIbR9O}QOun9
zP0L$BCPSe_)$3CHr+&@vcUFr0P>r>}^sC2R{@BimvwuvzU*oDQzx_~8vhTjnW)6k9
z_wDXXS$(zm%F*ZT$&;=xxA>ZQz~RUo;ryMBwdDy85$-jQ`J{DRT(Y|EXS`i(=+DWx
zQ9|{;N8YKOspmbszSLiOv%UD;oLKH>`7)Msf+r-LW1X_Xn!EEAPqg04Yo(#<=lv+y
z_BoZIZnwC;*QKo!GQTfsJ?QJcN&26|m)1|pPFlYw@+-|dn_R@d;fl`uu%<`T)wx^Z
z0y--W`8CS)%rcT<6;CzURe9#c96sk?Rml>I^&=eOC-moY?>JrmQg52Skdg8yg`?9i
zyty9o>4?89R~@9D0=FE~*bi-bdW@0H>9M?8Z+Psvv#;kopWj>lpe%CZn?%;krw-1{
z<sa_EDZlpJ^Hpsvd(4$P;<?kJB&&)<*~9n0=qOe-Ugj;_+);P<yq&YQ_P$?D%@?ki
z|NFJN*e>-P_xVR0i^Lq)E}3KV(pR)i=hutoHv&r~Hyf>}T)&^IkzLIBQ&udq#Jwkf
zE=oO^DbbV9B+jgsD0DcT@tgJm=cBvqY9GloIrr>IxyCCqLHMiW8xg%_J#I6vCC^=J
z+3t7q2)|^Kachl&@8J~{?P@RkTs6-t>)V*y^|j=M_&(SWc{lX#hCllsPrGPyb+@;>
z&|GL1-__I6%A9y}LGpjUe3MsY0ZVKi3AgaxNK^Sf^XHGnOqTyRx|PpaXFq=vxhdpe
zw5pv^a>xdmLnlsrK7WmiM<H{m=B~%j;xzdj!{_{emc9S~H)%eT%Y|)czE1HhzjNrp
zq79DPhyAQGAL*J4JzZXJl)P--dDZzfcTNh)7N%4>$;-q}<T<A()bx>6J>`I(Nc{z^
zoxh&XKT%`9qi}JJ#cZu7)_M%B6V4p_!{Ya@<4>c+<11XoE3BWNNlSg)u`4D#^yroN
z922gRlNlwae-v8IKiZ=m{e17oRUh;vdM{m_xyR$4_TEy<w@nh<Q+`j3YwFW+^4q4T
zobzhBh}<droK-QkUMw7-ng-N|jb(FMWpi<2Gyl3*Nmg1;SJ!RLy3+c5(JkHokBsxy
zzdRCsceVPqE}=(E!q?{3eVVmz@6{{Y*X{a0zdL<S(~gC=t3viYF-$Z_UDLbw)21Ii
zm*w`nzpyPgC-p>tw#l2!ciGo2`#;&^v6UlF&R8o(=z0$WNAbD(zgOq@KUDn?RdTj^
zn(kC(Req_+t%slN&U-$8&h)ZtLH;E!Ynfb)nq#hBJ2^RJmevo=9R?+dN+MGh%@>xM
z!rguEs?E1mE`={<D<3-@zomiee?cOr$=1?KEScGso|AUEl+IuD`|sV1E#-@MY+q%U
zKH0!;+pm+#2`ZP{jHH$>wagUXlKqgWjluMylweVw<&=064t+<<n7g~h8>bcRV>Er3
zt{lJFZE;Dj+G)^0t~sQ?&z$&s(c;PKU5gIPzWlN==5KKS%J26tceTsbzI44a?^vAX
zj_jVDe;!>q_w|1L>a{acOp=}?_rI9Gd48?d*5{Yr-3_>R!{p_+=tq;CI(Pj{Ghdq_
zU>K$l`uJbgH|Nt_-5Iqk45zG@oD45N+1lash4GbDBO}Yk%JqA7R=8bF;j~=6#96jc
zpepGrlj;9yOF0tL>;Hsrl9B&t@O;IRIZ+obNC-b&{G^=m17|32zUaxMU->aH%Q@yN
z+WItqYUiDFjiFXE%|IvVOOxC2m8|(IqrQA>KPCF4y=}t^wZxLlgwSRBD<827`tr2Z
zaNLX7H_c>g)`3k4(sDaO_V=sEOX#1if8Col|MjYMA_8f;kk(;|iPbD=@UXF|-#m>b
zr^bb6Hwn(%_jlLUKF&{`D-Upp^iOk@-{UQ=x=(-q+dG<z>%XR}asPT`l)}#C_3`+(
z%;4AOY)rS_zB4`kN#7if{LF@rm8t@UeWD>=SM0+KIv3jN*KU~}mmth%cvA6Lp!nS5
z=iK)?XMNu9)035E^UuG>C-`;uz54L?%b%Q8T6ri*C^d}pK#GgV7RQI>!A#=4TW>sn
z@b~cXwdVED_v~Z{?fN)lhw~fOGcN>Ljf{7tDtT)yY-BgmpL@V%doYi%5Z}QI3)nt5
z>Hc1`yT@(ks)j80{Yw?@b8pmB|7)=PqQ;w33r`sItk1gYZ!40lapFp;TI$tlJANE!
z`Qp0%&%fvsGq3x}ueq@OW)bhIRX<jGPhY0p+YOql08Oeqb6cGJnt9>sWgIoBF)Om}
z%#}9{le`ioyCf*H?(QDRxJzCyma2I7`hJ;sYy*orL-oTvxuCNL6Zr407Yq2Zs6t!J
z^b+%R-WTFx>2^OQv<*~d$!!q7_A-8|IZtut%5Fv#6RozIr~{{`E4lp7>a0_pH1l7@
z9G3rQbX@({i-cdXm(qE;bk6^8vrme-Ke4Di@@ucd+{vd(d4d)m`}s{LUM=ZJ)a0pe
zwl2A?{^jGT8){!~7!@8`;jPD0ouuv@t~E))DK%mWtA>{0{R1HlERhp;t=e+&1@re$
ztl6tVr(O?T;;CpR)%q(c4mM0zQX<OM60s^}g%SIqM%M@0kCmRta=LcS2|E^B%({1$
zkGZH?0b^s)#S@m>wr{zup7Us(R6@r|Vex4fzNtC-&lYl9e4XRxHorLn@-p`WC42R1
zzQ29)YnGk;>kSfT5;RWP?|k_`_qtvfU+#UrWykCmm25m$_3UKg@_7*ltR0+JZaKS9
z{Uxu?!=U^6E7?9S3vpK4;C`YdCu-8kiWm8}+Er>>{|SF{IJf(kdZpNx75=%Oe{4Lt
zfc2l|WYM>kYgo?-e%$}y?)Jha#gFrC_)Ejr{rHysR>5|HK0|j#c4FbN$NisJujw;o
z|N8duH_v6KNhWNc{h#cpI5EM5JI;E4M$i6_R?T6Yq3^j0*2SI%*Q%g`V_h<v)2g0}
z8+UOuTrmCAR6O&}<88BV+MF?-EOmEB_Bx#h4cS%SgSwx6*zA|h#lguo<L{lzAH!-Q
znLG~U6o#>AXK_7!W~XXDDSrKeO1Y0yn`dodx^!K<PoGV$_^9ee&aBhDm8X_vd=afP
z|E)WTam|s4mxphw`8TP&6bqZIvPb1}sE75{U7W)I>b^u?manzg67Xnhlg$Zs+h?av
zZwV^Uyz2bKbJ_wGYsp?C7b)%P7~{LEG)o0J=T>;8c3n6c#b)v3m9j$4e<N^{SPnGm
z1?mzOC)aQ9DRb%F`RLNm{5@XL%8V~8vb+>I`8};nChGnFbDt~!M4S=F-3W6X1(t~)
zd9D~9Y@P1&%H_!ArSrPEIV`v&3KFGa4<9z(*H(J9*KKhCdy)LiuT5?bj1Q>fE!C(t
zTzK(+XGY}z!{rlB?g@`i`k}SI>G`9-kwsJLzg@fj{QhKfnfanpE>HPeW{6GR_9xBY
zo6D5G%AiY0&bhuFTrofX?GBKP=loi{Z9{`Y<cS39DIwp2+!ilXyIZIorL=ASk(<Ws
z-Yv~BSu?IZep<M77IVqe62nt*dmKR1cC(~=`}CL-R}{G&FAL;|H3@pu-_&6Iahmjm
zixZAAO+Dz!+q_D0$0WH!cWb!MADu9d?SsmXC31J}T-Nbwf3@kn-P5ES_E&Fkdi>dz
z-2Nx(%B7QAC;t9!-uv-#J!6XkmvN&;T}SVX3m;rcwesYw+p;wxwiZ9!WA*x_`p={l
zso{+iHkeyX`N;7}_)xLwhix6Pd-rwQ)!0AZ{3GndhsoR*xW4rDYd`U4&)-vDSL`R^
zvGj9mUsz7U7u6#kYMCad#NFaI|H!bM$bUL`W$U>b{bs3vi%Y}BS3Q||0n+l_9U9Aa
zNXYH@!L?Z?ub%lQ{Y_$-^?mw#rDe0~tseBtG=6ecVeWjzRdfBU)!#X~d)THZwSBRe
zGK*P~^+`{}i3_SHGLq)0KVo0(u)p>FK2aMRRjo@k9MUSiZk9&H8E+a6X}ZhEec4^4
z^mV0JfS#SgEF0#%pVjgutXc&4R&G7=CH+a(uGYybd$hhpn5OIfvuKx|U=bgrl759t
zv+oy^&f9BWXP9Iid7c}rHd%D%s^k1M(l2d~?QMJ9F#S(dVEH#mPn8F=JEM8tEpSNw
zcgLP%vZT}BF9wfK9zVs<9>cs^Yr(-aso;vKw+~bzHE#HNabxO9VZB?Lg8nZiJQ0)0
zVtO^<_k@z5-Hdf5jY`Wd{%M<9zlYg($qTuznv9>Jij0~I{Dp##O|n)E5TBwU**M8c
z;kEd!80TMmdfcAx|2fM*qF!oZ?!Tgm-vY~jX@1;wr>f=J1NkJQcr6v{p11{?mTMB0
z75S*G-V&)MF4*$3AhP}Pqvai+Z+6{~uCrM1vgCZ%Q$-h*>W`-XY-cgpT)5yMUh=Q<
zqKej;nqQo2GG+v;u4&4PxaHn?d_pAO+>K8go!8A;mAudqUgb*3M$2==vK?yj@rnp6
zR{ODh_T42j+4+w>2|6frWZ7mu;dLiOxACbw&|ciOS1f+RCi!cpW(mDDl=D`W7I^GF
zMRIM&$C8f``<KKSl|OM{;$30#^5j>Ml84Xi>SnInQL#GR{yUGuQ4=-Y9UQ3%ap(Aa
zjyQb%qPBg~KmYi3`$8&MQ*AUATYl-ao)5IQI>FoVKTDN0jVqt!tKiJ$|GG`{auPQA
zS9^VY=01Tne{W;b8FQ{VvkNYNJ$}nf=lkL-&EEww?=lKK4c0{&=Hp^N#3(BIbM<6~
zhYrk%dV7<;EET`F@VJJ!`4``>M-}g$STo<cbc%_HgorU`txd)>ZtKPK5<e~~U39xx
zZh}bZ0&YdWI0apubLVzWVefdj{M|Fv%uCyLWnS?xTj<{U(nvCdN!PM+#%q7+-gC1~
z{&QFp7V~ko+FKE3xry844yK5%?O7jiW4``um90B0CohY6Xgl+bq<`<U)iV2^oM(Je
zaN*?2Y=;#+^LHda<JnfUZb{q8;1By%*EGqS-uh{)vT9zu|BwAW`sy*K8ngo?K|SI<
zvo?0k?}*uZyZsk@9QK741BdfebE~4iNA=Hcjb&Y%e=ND*XV=?jZa-iDTJ36W<KnxK
z@7U&NHviWw+cT}~{j^=qu9qIl&01S=lI2j$-(Y^3Kan|E6ZkD#txIPVy!!ini<|yy
z%S}I?GiFW*=J&f`C^0APhxEh%>&qWJPrrUOzg|g1@A1dXjFc(ebxt#u7iS$kv4O=^
z@7IG^ouCU}UTpTQjSUR041dagc)9)8#_FGijTv^w+#`K9%FEd|ZT#_^;lu3Zua!?%
zOnhQ>Dnn%Pxee>yn=w6z?}|@d6+dOh<QX2~`@ZwBIn|uER(U%Adq7E4fvCOJu3w=g
zEVsb(Bj7o^sj?iW=Sz1>aEP`XI3c{G<*m!@xlV0*D+C_!+Gd_&Xeql8@nnwYblHiV
zC(}8l9#@xqeRlG`{1Gn8I-Ul`v^&w0nFZ}#(<beTJl?40E#)|Eo9&y#7vHWVGRrVA
zKWGnn$*srZ(GVBFet+UQw`LQEtQ-1259}7b;r(v^qt*Hm>Q#l`Hv2E-Q(c;u|JSP}
zBeT5Yj8Vx+PFIbqLEkv;oWHU0=k$v&v{$a@x@5Ru#j(Ju$e)KUpXrR@{PcIKQITI!
z{U-)X{UxiypBq_8arE|qYCiCYqC!r1iHShbcCBoeT{7IeYuz~$pXDCBov)N-xa{Zx
zkqOgo314J;)%<aTn~F=L^}mEw2j}jJ`uF0m_o~D@XE*P7bASFb8|(1Z)$cZj$FCD*
z`*uM6m-j@mV!PH1_M6*}9Fx}i<GpkL@!j+Pr@e2uDkC+)bNP!WyWeN%a$oqle!o|_
zHfK?d!_(#eUe0IvZrrAR|N4QnKL(0Rzkhgl*ZTRnhtjUcl>Z*6smze}^XvWe?}dBg
zoaKiXi&{+g=b5kL+*VY4cBk=|x;1W#cZ;1#um3gS@p_i7?F!SD2v=_T5WsA(DgD)2
zhXvdVTlsoTthTv^hM&r~f+$a!6OS)U&K0~LsMvYo-HK~xb+&&hd3te$<)1gklk$Fh
z+OqF*W?o`#V&na}`p(nI`<H*&cH^z{#=4FQMNL07!ynO4_NX`n{!$cQESkWx_~L_G
zLgJfScRxEHtmJx5yrbmswGUw>IV-)*4BR@?_O(|A)+u*vKebx;5_k6((bvicCW;1m
zX%z`gI6S>8&bO@jmqd%V+%yp{m880P3J;y_ixv1c`Q6v7@i@A;%7|lX#9V8q4KD)@
z_Ld$l%3FF|^pEr2BZt}Q74{XyOuCbLduNQ>@mZ(z_U=wu6{oj&@$S%G@RUj8h7Vei
ziv!<n4or|@ow>KV<h9Sz5Be#(6Lv2DUAjd2iPYV>&Z#K|0(HDg*2){ruudpT*x~*1
zw${5g{`WsyOGTVQ7Kn6C+}6I*?L+59-d!S2ZM%!&%!=l0+9vu^?WBkQLBsu;M}pK9
z&sOu4IEr+1&B#*7Wb+qa;UIorYjU-oMyyt(&aO|U4c|<!i`yw|=oM9Yo!0M@qwJoR
zexW;G+{$?J(*1ciCuNyDl~xMmGY#5%>Wu2K{j3+Zubk%B6S_&d_tol4BI`aceRPG7
z+t9qM;;P)&sVCzg9g!EHg&m-dNOnN#(F?*(qIYdCJnFZbz?ghW(b-N$quQh_E6#fs
z&x;lN3$HIZC?wh9w)=xl&4;U>+GRb8>ioAqzT@`%OkcD5&0V#(t|VwU87~YgGRsOb
z*D@DO*<0{mcct+4Bg=OEJ780|(k8Q_qotX@cgZ<XE*br&izZL&&v|^};h|4`T2-Br
z6PmZ4$m$n$+9$f_c26zaRDOjeFQ@yrto`*+A)WK#3tPX3^V2LYP78eEQ2Q<Mj>(@m
z1$L=TwvV>O{Z*TEH)Be^LVUie|BDR0#mN(;d$-ktR=|S1xbxzRAN{Yoy6#;4*-)^c
z!6168z4^JCPll$&%TngFzTd}tD{<bz8De*5nEY^TSo8SO%IfTQdv0>gUK+rn;?1ji
z$x-X0u9--v*5Ot2>^F(dHFz<tM`V*z(vB+D;H{NsG}c%*^rq-PS~bsB!Pe@_Cl>F5
zk2{);d^&V_l{;RuUpKhWVX{j5{{Avv^{Z>5R*Jmmf2OLv|7X{fKU11cG4Gyo?JK*}
zm&5;D<h?c@Es<d|;!->!%73EqZ<CdktMl)TX+P^CcP;t%JO5{f#JQ9?LhKi>6m#aM
zC`_>Z$@WRnsPe?@1?3A?CY6O)w*1kW_~|{P<5i|z`CqldHi^s>%gWOIR|HyXw8feW
z)Ov*!R(IEGDV&K&?eDwF%8+QiNZD>0lVaY%-~}Dx8W&mxwlB=f2r7Hb7Ry_G!>lP~
zrF7~87rFkEp01twyr#^>e6u}!S^l^1zEWN)Jk?c=XX_*$VQ~+E==nJ(owqpVHEEo9
zbIv;;J>a92{;G|f1s4w~`QMxU^T^_i87B9I<l9-6bFj#LzF%W|bG0VB?34S`*mDxj
zZp!_n5))^!z{GY|dtt=cPbF(oRc|k1K5ozQK=xL}#8`WuN0DoOFMR!JGRrXofy@l8
zYvx_?jGJQG+$2q1PKAp<IC6%~=!rX{i))MHKm7|kzhpO^4)uF+WB*_1!WEF;-HtOg
zY}m82&?9YEc72IU_{2x*zWUpqrkHT^d74%x{aL}dp~9?Zqu$IP!uAr^GUHt|nG~L`
zoT0_`zwedt>X&jp8(VJuG0|Sp^3nPBwv(+v-3y=X`=s=GrRByqtdWWW2Q6K_n>Uz;
zsd@%6@ja9Y*>q)(>fA+-mL?pEjJU+c9v>gA{3ASqW4;30>_2V}&3c-D&dP<|(ic>=
zs63V)GF|^y;-{&L9$l)~llsS^WBN&lHDQ)>^%(Sc_gkMhBRtn2tmJE)q2?)mNzG)%
zlh-{z`-e5$JGSqs;o_eMolXktg<BRrZaBsFLdw)iO7`yBtdbH*+5dsDk({eUqf3hv
z&O|2b?JRhG@%JZN@98QR1<iy*6qX-h)9nb!aq2rQnY!@U{*-HGn-=b1`lwZRs&A(8
zk{_%wSKeB$UARU&ua7TOP2#J+h}H>%Z3i5sTVhXNIyir)sfy9b)a>8i9Qj*rd^KD+
zY2wd`JP9mU6V}=|7cz)CX~!P?QMrkKKWoA|<A=vy2kq9}*Uz4QBu=A2=J7IyxM}7y
zACx9aPZ!^><P+19;`#2XxK5^w*JQ2xyx*2=m%PTC+*mYGkzJ_J;!F3ZZ43T={It{{
z+aZKK{0wuv(3{p5f~t+e8Bemq?)`aSWW~2i$8nJ{xF71~9$v|i_)M$5WX)QwI0c!)
zYngZ6$zQGi_MtpNzAWfz+Lsmf{}{O2=f+H}x^`#!Jn?x)o1-sqOis>eGCcICY5Tni
z3%P$ydUVLykU{NL!Y5r%)+WXyN;lg-U6=z}!1r>=+*KK=DOY+6_%2wT{x@sIo&9;S
zHt(0;>AS$Rs@)~_%H0qDn4e43d8O%C{A&8?;HYCa|KoWs@7?9e+Tu6g6iPT>b?x#F
z<=Of!ZjZ<79b$?Zr{z5PkGUAyGSvn<t^W7AsC3?{wOaA57r--=QnIm6nOdIq_nEr#
zv|M?_fB*X2FH@}Zz1Ll@|IQn5u=d-I)%yOnt&;XHjW^G)GupcH-ImGQ<a5tNGkaug
zyqNK2zLAux`V!;fgVy;>r5Bh^^*6oT?l)`3=P<X!X>U4@w6Lw1>KCzLqlG)4_F1u4
z@@!fnkIM=_EdG-`@!5=<%5}|>es&^f**~3sAgCoW|NpVoXW7r1-<@!VpS|V<57#lS
zg?F+S-uYuByGics{2Lq>t)<>~%AMeLbiVfc@O4pU6~A_tS6A4lcT2^jP6Ne`EojAd
zpet|7)APNiQ(bvmHqWc^S^3VwO6|J%zRzkm9A3-*m|k`2$n16DWq&rkyL-u@;uL4r
zhvahxI*UGBFy|;s`lPAgX=lc>Qnv8h%StxcSf2E*1A-qP#YKMTUl%y5^srL%luHbq
zZ@l02IQL{2Onu<bzO2nG^M2?PX5|Gwb*s{6T=S|beC=mHlkd#O>+y5<DvQqy>^&}{
zmFB^u`<3;8sfo(D!$lEoMwcw#K4h=hXrgZHv*PZQRH5lsu0Q)4&wf;!e){V2MT^Q;
z_2fclNM2+mm;5<?;MA!dtBS*aE`Ge=5t~!X!N1wpG{hd|FZgj}u|>U-(7EcTN3R4Q
ziz{5o_TS)de`CQ;p=04!+mBwH9;0B;AbPXWg3-oi!zq?ziyt#i>t*e9_q#cL2gh2T
z_ZLc;e_a&P<d*r95IKE{xOA@;v%#0Srvj&4Jow|s8G%!lZi%8Fr0rQ)oW<wFUVNc&
zl3Cg;;hodtcO9S4ohrInGG`IvCzk}H)a29N0a>bwU!!8aJp64X>wi(cN+6nPirUeW
zZ=M$I{N>mnscmhw3)U%_%E+-f?C0X-Lgt4*ve)0*n_##7E)TETb@ls&r`Jbs-*E0k
z<SWg^=j_?n_WMTsTyDmDIOEID^iui$WZ#JUCX4zyT{i7uJhV{#Uwrkx13~#>vA5Q0
z8_D)gf3i*8u#=@M)ga?Wf92^Ix5az6DD{W!+^}HzQQkQwPY=b;QL=Gesp4RrDdS^s
zDWEFj_cw!@6Xng@E~TxPU&wDBHS_p|V=G;a*d!xk?3aY?TlwQ@OMz1y>n$Vk^PZJl
za!WX_&+%w;W}R~SsZ!-41`!<@*;r8Z4_Y>&$CzjxQu=ZMsA2Hv)BP9scILdie@%Zc
z$Lqjr(rkPksSdmijqD#8)nn>S8yPEF)Rx-c325Mzaz7qlUdkvQx#h(QLH8xPu5VM<
z_f&~@{^Ux$&U`X2`K|%m^ECV4Q_gj~b2n?ga%;)fe!F1a^i#4W_p;Zoh@bM$-(b=L
zK9h&KkB>9uoK#`^5HwM7m)TSQ3&E!ZUr0Ue+)|kI<K#S-pC<)P>NRIgVz=@9wjjiP
z-OR(MtftQA40_nUXZ4?pT2G61vV}3_$VP#D16m_xB#^ek$laYW@uGC^J739OArA(v
zg7<x)JlZQco$o$XHb}GNc3XT#U=g=({fmEZu7~}3;lb2$kKOlms?MR0t;J{CQm)Lc
zeAVMFpEiqcZoo3l!Zw!VnTBB#88sFMo)dLa5IJ_B>cIXby6S==F1`l!H`d5<&s{x9
z!?<hCk82wGf&6+BuabomCmGAvPr2dnuWV;bZb<X00~>@iLBkQC^|z87r$uG6yYFOt
zY5x9Cd-28HdH#~UUQ=fk95&s!&f@RE-^XH0cV003|1s6X%TBR4<8yp<r1sOm%kp&&
zV$*%TEZv>1xVJ^9BarLwge{JXemvaCwf|yw_or!vdVNP&FNz%Ze7pb6=67F;7u`~w
z{CB6^2kFHZCp_@q(5@Gn$lt@n)N7J*>15}H@->S8WLix2zd7&piY0rdw+Pp^^qn#1
zRE~tJt-Gfh_sk8ng0vYlrl+|ud7`@i19|1e7hCi9&x~molh9w1I_2BNC%ZU4%*gum
zcDu%|2@W61s$<_8tm$~TN~bd8@s(32iqEyIemUFsT<E##pRT=^UNY`Kc<c{jq~=@Y
z?sLl~`khG*TBLM#{-*zld<HLXEvmGic_ct(k9<Z(LTkgmwBip>1-nY0U-|uhA!Fzj
zu6;_zpv98Sf4*N({5eakerL?OeF6#3j9?ja=S7Dbzg}3Z*wI*U>+kmk`kKD`dLLw6
zVST>t*T?F%Yijokv!nORd=Nb%TYXgZ?T2fILMLNn@@3bw{wja5{+P$E-2caK``e!D
zvZ*-X=a8qW&9v9g|HxBU&;GMwi<Ev}um7K$bLUWn-0ThczOO1Qn$&vTUY=1|?Ekqs
zdEE|^Hiw`$hVwXQHZIoRDNrolr1bsTb?42GDs3Z{yN1O?{Q(stqDLCt+(GLkK-<8Q
zA39iYuy{?Gx#7fQ^|twir(SfQ_g__iG@dCWHR?>w8^K+M*T4OgjP0vnUdTNuHaec+
zh9v)ELoLr;hcDHa@-|QRYB-R=ZfRKAGV%Gm&WZf9Gwy~6CI7p%;^bbz(v@F5x8Kp2
zT6A>!{Pv?Cug7RE4m`#*`NfGYHolGRfd%ug*auAL;P|WOAhze)^!k7Kd``{UpOgay
z{%lM>R>I<zF?p@t^wl9*4ynIE`vyS$SkQQUrox%Hr~Q4-{yCbBJCdeO3a~r&gsDfj
z>b>j<uZ2Hf|N5S*sXo7s%XTvNy&BoTKELoMmkYz=+74$K9okr^P*AR{Z`iVP$?J9%
zlVyB|R1?oQ7iz3sGOK9nO%Lzf&DWK8`=uNc+0wuFPm+th>mT(+js{Y)ryp(e6b^o8
zr^9wsNLi9e?t}29Qx9$TFHlm8jcaheFtOYH>Xok3PqlWg%JWwM?HPjfMpr8+=+u{(
zoD<Dy;xbk2{&;^&@yprk4;p+iX)<}8&6e2fy!pk8?sLikf=_cV?#|!N!pdm5G_R%o
zjAeM;-=`mp{du<;ewunvpZ&?~s`GO{E|gluuJPEA@A(0{5VnOH`Ni=SX8%<g8-IM%
zV3;6t;>y)L2_uWX)|ji0+1JgCyC#@Ee`3u1lGnZ#rxLWK-ng+YjnSGn-^XTJ<ch_o
zpGt*fIb?vEpP)TC%!!gkj~_IhIMO;%bJ~o;)hd6dWp&;$%FAJFR}JdVblVd*;j70b
zcYp3p(m^w}m{z=e(8l{`@2+%yp-YEr9&CDdH^^=At1Uf(BF&Nk6MU`H&ohZ<zPw{n
z^y8lB>8CGe)ofT9St=qLXzjoAci)tVU4J(Fr<!y{Nr<JIbp7ULk&qWyHRtmk<AiTL
z^>!+k7aUskW9P-EMOQ<nS_|xozM7h6Vs%UTxI@IB7Zy7d;w8;njqYpMSntS8&Jx}w
z^P0QhuFW)NCi`rOY03?X9}k$cD(+HPkofQ96j@15&&IyQqo(%XlhSj{Cij^N=kIG=
z=y)ys?}yk|F(;<(`thUj!uHx@CC}szZUZeJX*~RgHSXW8RPOVxQog0VPTP#6j>>E3
zEV6nPbH++6e^K)8DW{)4>D(s@Ue^xFLm4F|0^97Z(mduBn5M3Al2_jNhNCd+B9E%N
zsLH;OU-BDRt{DDq-{|!!z*w#_K)7v*9YbTZx?hC-j<nlTP6{M&cq}<MX`*G5SaD1G
zokH$=T0VCkK9>~x_}G!*$&A^@d%RvxSU%4qqusB4<(XUi_67<rzgIoI%7S}Ef{D~|
zo36iN`#z_AI+PIAYx-*K>7dlEKE3Ia)wx#M=`CJ-8q|*4p7qe-g%@+;<m48;1fFs+
zp%2I7tEYx-N|DQxv}R*jG*h^)`GSP9%IU_^j_!Y+W{ndy&HcWX3GL#LRNL);Jf=)A
zDyc?qii4B#1_M<$rb&PPen^~muKpvd@4IUO#sW`nNAI6hxbKRfg2@)^d9LbNr|)Y>
z_Bw4?S-MVs`;43CZ8)>MM6T9br}Gx>j0xn`VBp|(1(iLJy!=0q`F{XoZ%k$51=rgu
z$))vwzVE**zi0i;dHyNpSDdbFYo2Ys^q0ZL#)<LV#Z`YMKRKN8`sJ~Qr8<{%w4QFb
z*~C1Rb$(68AO2!L1EV)5LlmcU6j?lM%YMw@CX@H%+sd5&kcpEwuG{s0(mMInT}#gI
zDi+gwGo#{sYDvk?RktNLdZBxI?qrml;cdCOT9_g6>IAiSUa>5kLia96to?VY+mP4D
znq7ZlgZrx8Z44J5wWOOAXo<*WORkB3G3Uw?IjLJ0<<4Dv7_g<`lzQ6ThPp^SPGbqa
zzDp-|W@sNhRPw5}e6!y_mg9=Sb^%M>esI{ks61&s(ylZ);F6Ml;<wAaN^u`b7_+}$
zy>6a2%d**Z`p%0_vldH5+*~?$!uc1F-G{w>&yF2x*dV-MvFM?i%gsJt4!WwyGn8sn
z3*6Q37Qe`*x%gu3>hR4|+dThyzGD8|cw^%O-ouaTzrFKRRlV?&GsAE@d-lmSuGjSU
z%Zq;JsLuFSrQrX>t1Ry4+v`u_RLn2x-0D~$eeE%eu$bi4$?TaqCR(18_qdd9{B*!1
zbedUX=0>?xtBtz%6Q^Iin7a7lw}lp<y7)y#UWueEH~XPa&)u|J7H$1-{K)Ke>R)8U
zn*MsYGdv9XJM+Vhc+2Xoe~Q01{apEkGw9{f3K?C|i1Un+_ZHWhSX?%6m?6lK%DXG^
z#)Jyt$z3^CTXLnN;v-Zx$aVIY`otS3yIxA^6Vwm*C%wc^O+wN|<(>b_dX27#iwXS3
zuV1QHc+K9{u&bv}@A`u>7VxUD7cY#gq-4374}Ee!esHd}Khw9ve_b24FDqYvcz5|>
z*OXJr$2tEqIH`S^u~j*+_FwjTf!*SJ45$D79lT3V@Y*EH>J|0%QoVJ561h0i?SEf+
zXuE%dr|lds?kf%oou7Z|PxaiN8@zl&`r!qyzU;YwbvkoVjQWa`sp_T<OOJg{IHu2_
zyUl#1a=~8)1BOhctn)@zyJBjl|C(xd5w<g8bxFg9Ra(iVS|w}VuGwc)Ap5w6LFgr)
z&jrry6%$sumus9`WKk(}-r=*#zxgNCmlc2e_d_{_dDS*~TamYmSN@&&Y=f@ozt(Ai
zpO_;L3Yz@CYIL{V?8Lkkl_yntIL%`=XaBPi5IHU-<rV(_it<;N6;p3I&6w8UqT?x<
zt-`tC-4x*-6TQWYS4*s_XZ4w}6|pI&Bu8E0O~{Lg=*Vs5i%Qa%?7er_I%z395P5Dc
zaLaGCipREn+uH2>O&pRWf=;-<aanxvh4c60$J0Mv`1aO8>QrKpY`vdYr?8J6*S(hd
zIT{Ia%w1~)l+NG(sHtMf6@O7wRL(=nZrVI=`=1h9KRjsT)w%T3bCE**g=eP<AI;!8
zmGa2QYFF2WRhyX?LKk&O$)4@iWjS=KX~OzH7dOf@3WNwNw6gEno_y`h$?`k1?(l9G
zZTodatxHRy|BT@+^~D!i^Y=*2Z!HV{d1}p%PoJMyahy_`G&e#|WQ*qFix;+VF22;P
zb>{J>AIsNdIBBqIoPMG3xISuPvhOFx^+sYVCg;sHn74xGO>U3a(qO&f#l3FaOYJ~y
z;};ouCgz|m{A;f6+_6z5+AZ^C3Pb*>*zL=&J-w^6T<qWO+FMt)*8X<zI_O<|>+km#
z+f1%hrhwWRP3uAo<0=wrnXT9Sd8WN~Nz?U>35l=U7CKM*XCf2kwpcTk@4=FOkspss
zN|(={bK>Lgkm>E3FLwQ_E!1ue3H;x|6;i|6x6Jd}Q_+WF&Md6{bE?kIJ#<b;clzlU
z8H+EPEr)GtfE+O3*V4B%*`%vcolD|y-H9qCjeiLV{1e~S_k4en+!d4%k@uuBoz-LU
z&&k_-t~DOsVBDnmcDnm!M)yorH#;8}=WQ;l8mta6+}u_DuxZL^?xrPYk}tU}mfv^Y
z^f9CJ?~J0kD-S8N^DVhzFWJ)ehP}FOSB%^7PpfYU-(r1!rWex5NmUaOC`%A6-u`OB
zs-Ouh>vv1#1V7t-WJ~-s9k+eWi^cZ-U-zw%A<=l-yE)eCc8BIXpFcIn;_pQE=H1Ie
zELx8qZ~b}d*sjD`XD9E>SR~}Ocz2oVQ3n<4t&=W&m}w?e`^;0aS13oqS0c{)g3bDg
zODe9|FJsA!Q2pKLt2h1hi->KZIY=}9idS!5DEz=V)!Bc|g063BIcHSGjV3LRwEm^y
z9$#{A{_E*+CSUjMcJ=ityby7BPk4M6|Dg&wF`arD%cki*mola_U;24-%15=&jUIgp
z^1I^ql)m%Ue_|pvHC@y5%gVnyqrRmJuUE30HDfc&si#Gfvb@lJj4xgo2~6X);^NpG
z=3bz@Z4TFEWrJAdV#~~|ci!i@Ikp<TYAT+&W3jiey1$9@g1)t{KFE~*yLoH*zZDl>
zH1fVST`n%px2UAzla6Bin>c3~o9O5J|78``-fgJUX=+{h*OL3BfJmE3RN>B;XKvEH
z-_FOUIYD-|<e8XDaoiS>y~%hcdvey&i;k@8^QA16{?GGylv&Zw=YNR#@kE<n-k!2C
zKi^)L(w}ls!*;$*e426L!Nv!Ray%v{Ek4BX(2DQGHPQImi8a?wt>2$gc=|`-PvQUn
z=I`D8Axru9Z;O5ZL(MtAuG<X-AseSGi@US1Yj-y9_veT2&8z$*eX2xCg}L(ip7U~6
zl1$Z8uJ0`0H@$<y>ez2ryK+bO7aXz+l}lRs8VdSmx%kZ~>fifw@nW^zGc=8U`rD<g
z^9ldBTL0w~j*AzqCOynJsd%>e;y)kW**8m%F5NbBei}!w$%@HrTYr9DGJoaY6~9<M
zXI35XU(TJy*Q?g?O2T39>ho__uD-h4%GB=9?jx?>>L<<aSde_^Ws`u_BR8<ku55==
z_TP8i$mNuIA@{Sd``U{$pYEIEE?2N@@jDatt*<jGiWl53iQF7#k`eMb^Na4%_*%oe
zXLl`Mzx3v;^u^P~L`@Bj>4?61(fuVlzo~wrtIGw$!gmf(KV6up#IUf-(TeSH%{v(h
zR`X{zHTCt`t0lI*pKCt%{gteFVINA;gEgK$De18ee(dn{*oUX?#u*{!C9N2XX2$z-
zW`zcHPq3O3Anj<$)zq=z@tP?%`U*#SF9?EM?~&&yF*}ckO^M~9&4obrkFx96Ou3n5
zzQ%f~9Cv(0Sa}~GUsgf)zn!U9gI=$_FzYGndE2EgjdnR6Fc$yn`g&gMvz%YL+K-<7
zKd+;tbmv9w8)#JIv9xs0={s3B@yz14yS^NHma91PZA9wPX{rBSzRYNNzWV2L{kv<9
zGyR@5E9?5d#fzC%|NF7k)_Cv!rLNDNUsU<m&b=nIHed7SpUd06gxuZs_081J_Hk1?
zIIQx%ob5icK)K{dFN-YW!$q0j93?(fi?u{g`~7)-mCv!u!8Nnq8-2aow0!=Bi%rqt
z`rGy7D*nsP4Ky@-x^(KXN&0rYbGIsW85ebQoCw>KfAW~BI<K&k`yGkaYeFR~EruTM
zcQxHBceX8YY2I~i&z-;d`zMw?-YU8MUd4mG+rREukT!u&)^<|W->VP5zu)tu##eRi
zpQp!v{ph_~|7Y9#v)4=NGp=6BIDewC?^{QQ5D!P}Q$;H$_ZJ@7oK|{L0+YTwuE_fL
zFSz~0?6(U}MSYik^Xkt3chS+)e)`?n`Nik9xS%<IUQ3^gOJ`kYUS4zG1wkt(_d6W2
z=Q)1;J*RrS?3spB|MI<yc{@MaZZ);y4Cv>`lJj{veSYe_(%F%}K8IYG*l{A&b2+2a
ziw^09$|Wi<EYcN9q!oI~cCX)+^IGcjkq1c}RziZtX=(F|cYw@(;jzOoN#K~8Y;#@y
z;ZCvD(w!a8<XRxsdR(~JaA9&KYs*E;t_cg21uv@IzvIONa*)RbK`SW%y$^fXoMtWE
zX?kH|hlI(lOwWiJ0wBL~$S!>RrrAKCVCsGO*(E&lo-GKxRdz0GnoPRt3lEo0ww85K
zE+s8}VEaEQaD<+@RQUOe+=4CA>olug?(CXhmvM9F--^(seY;oO-f_?DcH4sFBZ7t*
zAzNneUI5DAAlDr?He+YHEV@N>b)FBWw29a5^?SCwxxHTPXLzKgnT?I%)6m`D=ARJf
z<TMuwj5ygC86;l<P3}dUPVGt4`erlRO-Ty<@#nJe<HutEe?>=I7j4SE{;&4I-R+y+
z?JT}+x%!Tc+m5$yrbbWuIX7SVg@=n{<AvwNdPNVQ$-86;hl50SNe{2UyPeNI?Qxf%
z^8J%s{f#$2P0}_`Ej+H9mYwl=+l15p_jXlPK9k)p^XJ3fUq5=^zFZm0`tw)*%kcTH
zAGicOmnl(EnwY=sQ13fXWSa{q^b|SfUo13i3^?<7=G^(N`gY;}{%$Y2yRqxj#D8|#
z7xRDI*x2}O+q_w?CY`sxTY2(l@SO_R^1_LE*?0F|e(JCD``PJ<^X7GKxc=ir$G_;$
z=i>v;TE6gb`DnLYt)-6zR6zDPH5j<P*l|Pc;GL4#dhhPHH}@Z0cTQQAefM`UUfFls
z^uArYo~fMi<NLckKWuCrR&3wm_u^Ul)cWsdmoOYZw#6Xg=V$(?#xs>4?!BpgKgEoD
ze!bcjrG|qthk7qe)VQcG{OgL^cSrXoQ1n(AIqYb7x#NLZy_n7Kkek=zGdS0Mnl4`~
zUzzZmHT^c*;gV-hPh|ehUHki9RjkeJx_eTer^zw-?0?EuTkRgU%<!Rud;87XnQ#BE
z`T3haR{rh#`-KNBmq+z}`EGXQ^|Q7mF0acA<Q?5#cuYxgcwzN|L$(l-JOs|!$=cR^
zYLWYS`}ZyH+?Bigr%j8PZSTM5*zx0TZdKCKpXS$`*%fb=?Zx?TJ43|#f;kCC`|r;@
zZ&8yF|KrQ_zwh^@)_I*{{yy(Z=fMlBmOgvk6P<tMisapu=^P6MH%3p@*yOm_=$=d~
zD2ui9T@W;%H&KY=#^IJ=ug=e3l3RA`?Ow5ag+a~d^zcN-<f0_!q#FO&wO?<{oAz%_
zt2K9Z^}2m`9!|b(eEGP$dujAN;r<A5(^5Bn$yZ4qwe_>kr$39`-q~UL|KHt-b4^R0
zoN!2Yf2YhpkKy54^VcO@cUQU|{cv3HsCVh9$|WurCTdtX3phdQzPu$I4llOdU|hJJ
zy*KK%#ql<_;Pv}|)vu{|*?P-j)$6M8=gv9y<-I%gPV>rJuj*#?w}1HIWK{T@?7U04
zo0gVMjyhx9?ABi0=kHU=yJdU!<W)P3w;1_7zcTyvU){4(370n|M+a-T?ti;)d)(z;
zirXwxS!6q(^;BLEGzUB2WJ7@*Q%muzo5yaN@9Z`H-B`VBU-gzJ6Yfd9e0z4!=dfbe
z-L}7HsVxov^)#JNezl;H?9G|G-hTL3J4-){SL$lhlC2*!WVXG#wXo6fsJ`v`LepzX
zOMW_OPw3Tj{QF|%@*COutHrb&yNi!B_qlNHt29*13jx<(Of7OJW-EO8wcz5O<8qf;
zBs5<iV1Msd8_v$~N;mhPPSwN6V%5LTUiVL%`YOr!kXm~`@7lO!dl#hD`oFH*=D1i&
z;_<r$-221CO@l-B-~LyA?@D9K)%w4Mdv=}L5b)dktf#~|K}Ywln?ir@3Cos%qT5PH
zp-0nv*^!m1ap!U#&v{p{f7Si^i_y1~qyBv2{%@aQV(u=!`_tz+4m*?zJ~V$n^RUHL
z-!}biz|<Edg(V3I$6KGj>iWH=oz3+6mx$C>yCtvs<JT&hOiKK?T0iqZ=H0f^-RpO_
zgm)}Z&RepCmCvbcHMk1k6wqU`s*-KFW_E7dmXO=gkEWetxDq{!W%K7r+-n>c-#VE&
z?cbb_%Raw8e*Adp^M(EP8_b%r7M_0-aCKqR#J`7T87`i=!tCIy&#WP_S9D~Inc6w5
zoZP*>WnW)$-uEN8WN7KTU|1w@>5z;`mc9PIU8lA^-~6lp{+XY`yA<cdiQ3mxCtY}9
z>euYX>U5UxYA*Y|>f2BGLbccah-{CDINjj&x@&E9+04T{#q#^?|7^c>Yr)OCtK=7I
zyRgV=N*E~2Is1qc)Y#yVEnLi)s3E|ipE^t9Nvc59ZHu#&AI0acero!5@0x#~%jeoJ
z)P7cJpRLtXd*Ow#zg11q%kcTLC#!$k|F>;t(p>e#weKybR2{xLOJ~(dlV7PNo85Y{
z?0Sz)o+WyE(s{dWwz)HE|KFXoYF@ZVDkFm+zg19+LQCI{Ku7l%9nzXi0=sm@9AA9h
zX>`rZZ}Z{HRWIkCy}kY2jt4TY{cbM^oOu3WvUIcOuJk3#-H-F{y0I`z|LZO7{;AV_
zeJWqJ9R8y&ca_(LMfT**DLZyDDnb&2lY19Ki=oePR^yD2_4}5&b!LCsvEMxIszcz}
zwwYD?*S*%XD?aw1WO4ka_q$KO5x=@=UTyoUz74Xg`gXgOerkDB{^D}~seOOFqJ2t_
z?e)7<{{O$L%bT#JM|M7!$!qDedC?)wDd1-5AW^t2cTVZ+>$`TwH@lUF?0t9r#LSm&
zJ!L8BGe5uMo?m_HU&f>P`(LlUc+l}}z*SKtr56^{o84?Tdq7)|EF8&G`|in`RPDTZ
z?B=|ARj+=ZU2yU2$^X1kxf_EEQe*xF_sd$A1iXJ$x&Kz_f4{$Fw*QuwFSq8J-@#$U
z<n)3=_U2kHSxy1BtrE-&xAtyczU<c1%8yU)&zCS+wVqed^sKA2^=;!zY`b@zxwU|A
znf=S{uje@2UE|L3)l^WhWX|i!>RYm}EM$p#0I7z9zBovTm!INUw;);L!P))Ol<pr}
zS^TQK&(BV2#olGib7h4S^?fI1-V>Yjea`vG3QDu)&zPwEbtgZxd7+#)$5kN8(LMge
z<7T(}b;(P%htJu}_q|x}`NH3A{qoxdEUXL)mOM#tKD4Y^e$VvE>$$hjM;lk~mj=1T
z9#LN2WLL~HQ7DNQVe7T~wLsED>*CIuHyb`pm)EZUyYj)!<!3&Aad8pJwK^xyu~0d$
zrSHs%#=a6Mg_b_e!n*HLJzdhqdAm>YNUe>{miwcuw8+)zxXOP0i|@Ca?*DKY)VKzf
ziyR9VSHE;^?ptXdbN6<DzQDG3_fpph2wr@&Ai3y3!-d)lf>uH$M|wBQf{bN6cxHEQ
z{AQcq=c0}C_Dr+i`LBPkwL`8n2b0FDXx7Xv?Rm+P(Vp+ayfQT;%onda6!EROzN7Zd
zxiw2-m)8j_O3r<8qW6V{LXD5ryk!gJ>SmWsQhB@J{(ix}>$Rub`kdTLT-;0EurIt7
zalou(ippJvM7ul}_dFN(=DzENj~{OGb6LfxXzn%XnzDfGML{q!WIR-p?%P=NLc>#a
zZ{OjvSI!{yC10XKUpsd6Idt?*VrhBN(Fa054A!zMS_w&6c?G#1f5D<?z9_jK<Q|Te
zI}sZ*LSATi9{;%XR3=ENM#&lWmZgjfF9cqC{Lkj2RiAwAc@>aTbULIrGbUy_>{!1e
zaFU(F41U>*6Q#jU;rP9~dA@o}-=rx_iFP1=xVV>miTb+1CwSTE`6YY`B353jUfx)5
zS7HLP;6(3>3g(uR7YrSiYAsxxaxvpt4oJA8&*`|!e`co=8`ee+Sye`m8zVt(jNo)C
zY3Z8O(l_Z@sDg`o$rCq_6?f!X?qsa@34G+{`FUA#%L@&#_;HX5g*E;!G;V57<^hM2
zpzK9M#zWWaGH1;*SJ<<=rB6tJ&y&}V7wY<}jEA;g`**iU)aqT~#T6jgMat%jl&uym
zo}>_SfAY?Yj(b!%WtUo-F)3OtQntD^@o?`ehD1i$#sDF6ug@lO%5|Ztwjc+UJOzjO
z^UQ)0Jr5^$&A2|n)sK#?=LI=}wdJYq%Z7sMo-Z`cUY@XA!HP@v{aJ8o5U`5Vk<#@9
zsejhtZ(Y{f_q7mYdBcZwFDo)llUpXW^vy~>Gs8d><S4uE*`Xy*jvcPf-d=V2t(d|Z
zFCp_RTMkG(#9C_c9}0O9QG95!N=XP$Gy^}#>WhN1R~em3wuCR!@O-hNO5oZqLD|>f
zgreZ$t}sQVgvANudKdQ+mP6{Lk1y#+t@RYL%IXuaf`kK8qN?n4G1GQ+PbYWRJ6U0R
zc`okYc#KtWIiAXNXq8H*^kb2|hKg22Aa`pYKiq$9U3K`nMVtFnIAxE2WpV+hY!~;E
zGmQrF0%9tjPRAvF&1~;u1G#RepzLmkj=tw<7gwmfTwlftcFPmDg~{R^7eCrWnnX=e
zS(vQ(e8<J?&=ME-tGhSKwA|UjuyBd~+w|)4IhVI>V=1uMUFG$rcuw9gPU~&LFJ1>v
zFFpNq)uT4HwgfBFnoItF4zrzGUXiw>Tk6lp^=9X^N<=`>xajdG1sC_}>MEX*e-$pA
zeLUmC*Afx14<0KEypj^w7N;_4$(&ht_cANTE?9iw;sRxmuDoYa^5%0(8T~e8giM-p
zSK9%SxjOppNH8VZl<eW>Q1#5*+<MzQkzaPFASi)}vOoM<TVnog?P=jjDxk!BrW2H9
zCOdZYId23R68L$snlUIyzf4xPVp6n{i&B`PqWb0j@BMF2KkeiLh0(=8hZ%QDuI+BP
z@RZXtD9raj%fkzSFJ?S<D-jV`H??o^Y2isrN}J%NLSgZmuL~ou*R8DzelvBV%F->}
zLVePp6mqdoCa*@W<>Rw@^=`M~Nh+qdUvF*ey94$^m0Zig3mdm*n5cUOnQ?$Kwd_to
zj*A}y-c0rMo}?osYLy07>(J5Hp0(a5Y|@f2NTz);gVQN*4wrzMs%MteB4=o1E1X&K
zIApcBXV9c2vG=!4%$o-;K|tAm_GPAJPVNe4{3kUS2tm`>qQ{mTk7f0j)VVI_Q1yg{
z>WSVL60C^|B{EUd)q^If<gR}v1B!!1i!T&P3M_j3;*(3zq$LU`cLcuB$a6XVok`KE
zPtSjes%O@tM^5hGJmh%%spE;>VBI(sP0vZc(j8YwF9c`pe{2Ga7K?YPXmYnW-?j_Z
zFY)1!y)J0A=y8&Q%kh0%LD9l==&dDF@<MQ|FH$zo%iH}fY3si?OQuV8xh|fxWJ(;f
z6S%x_F9{K8*(i6Uqpw}GF#uBD-s$MOvqFP|dEw&-9jU1*PffP?F8g%>oE$C+a$GEA
zbMg!ds#W6HDJa|8SH;0``Q;2ACs0!K{JK=ut1^n|#s!cJ7fXx$gudfZ)%`-AL2k9X
zt*3n2q9|d-B`fUY&Kf1oaq%K3IoNR=UZ@OCxXM;}?{>ZWnI|e&vIXRYV9thuiD7Tu
zO2D;9EaRby4vVYX^l!&s`S-lg+*{rAlIRw2Iq>sjpm&pi>~n7gp6y)bUXvQYNvXB(
zIisSLTz2Q}{75UWNpqBXnBO$-202V~p|ZfD#~WWyYnQk3n#A-q^(`o2ySOiW{LAq~
zujUhHch5@!vo=ndZwM+eLB$qRB9m;p=tunvRb@{+CT-&v=|N<F^Z4EGg37CGWshH4
z!&Lf0104OJn$q6#UbBIe72B+=(~bMWrY@PX?3dMpg^SmRUIaO!P@v7}c(QIud*7rf
zmlke$ZsrXs?E@WtaK5Z~rL}qC;w5Wh=1F)*#)H!7iC(5d{LaU}N0?|egQ~?l8K4LW
ze9fR}&X?*Q`9i~!Q$c6<$|->$#T|W2hg_`W8UkKuXfED&*Kg^OWKg-3=i;9G?|SL;
zy}rROEUvY6q+AFLlH+*1P}xcfRD!Y``ulIXZK#qJ+iYDaQ7bR6EUmYq_uv_Vr=@SB
zpMyrplqpw!hzUT-RxXbF8`u3-DcMt8>BJ_hs#>bytM&PUpe!#ap))C3z5C9b!y&7h
zT9Q#-FZO%~I0><~yuU90+HJb}lu7GDRlmN?TlICmm!Q=mNWcg?bo40;c)id_y)yl6
z%<FF7`gU;r-_iGC$Ior|?X?uN^LQ>4u39U;zojq8DYg2|uASFBUUYzqffK#Y6?)qH
z&X+Jbom{YZ%9WUGuRAAtU+mcD=w5O~RH3J(Z@XBp*9#3*)2U_aOm#t?c5%;RaVq(9
zt90JoN$W$GPT@0^1~)lgWQT$(mXb;*C->B+A`ef=f&*Mo_F~~*g(t^0n#G;mZ_g>a
zbl;n2QLRuHI?V8N?{-s_ED5=_=wg(<slC^}Fjx0HlNTL*v;V*U{@w85r4k#ag(@W>
zLLAReEA*IigA3Whr>>3?{IZYlmK_Za6|&M=x^tQ~3%F2w(a|@5owkDnkL>$zV!d8Q
zFILPsc1bS#EDt1rr9dv+k`V&ZvoWn1oa!$M$~Fqf@~1xE`{VcImOiT~cTYK<=!JyO
zYj#DeT{eoIY_h>pb}}3np_Rfq{+2ry%nMZ(CI>B#I&Wp?2~quG$IpLx7o3hyc3nK_
zN%qwxeOu?Pd;233(#~@^UM;{@tt)%+<GR)Jk|wqEY5Hz;Vg1qhvIANz7JmMFdirwL
zf{s2$u`=hIcJcrDJSSZ!)bhPkI)4f{vNTF;*c10ONMHOI{oRP;@z;kco@}zmSsgq2
zUVs8$L?BMws;_kW0?wU*lP(z6RVvLa1EuW~y)QUgURYc&(|mc<+1=CW_`;n38RtO7
zrLq+l$Nd{xcPhM?6s^33tnOX=bphlTkggd_P9=L@dvQIy5ICvi)vntfTkE1gY4p~_
e=Drs{#MjqvI<bHL(n$;q3=E#GelF{r5}E+BlB2)?

diff --git a/frontend/editor/public/og_images/split-by-chapters.png b/frontend/editor/public/og_images/split-by-chapters.png
deleted file mode 100644
index 26db04b4cf2b202913c8d8a97deceab490ad6d51..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 58098
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H+@8o-U3d6^w80G^XEu
zE_eLn@BSE#?_ougvxHoPJTBeg&Rn(N;+^Wd(gHa;3d!A@mzFtAH=dO;d)dONO=+2&
zuRX$eHI=x%Zf|Q!%iXngl8WoOl~yk;pMQVDE+KJ2=j`XIYQ_(>40a#>JiWZwy`G=J
zXzSL^Gkxlcjb&b`cusQUI3R!S(Au>Mo|BYhS{MvM!pn_k>%Muz;yFp=p#n?8!e76B
z#=JZGE^mTJ;v^m?28-(#CY(EzWG4^OE1}4+ske9g@#EdCP7_o-*%DhAPMDeM`uXkC
z6>C=UG~!TZIZ)v3ZN=@Kwh$yehvCPjt)-b+tF~+xSMr&p(k#H>cI$TdvgO)Oi#iNE
zLFS(*Et%2!QO(ncgE3*t=Fjim<OHp3;h3y)Qh}vm<GOY1#l@bJVEm7lmtT&Qcmy#>
zZP)H_aWSVko|94pm<}wRH*f3HrvmAdR3uv%3U+S)KE3+8(-yE?g4n)_9|j&E+Z#A|
z!$M=<zOMfHqY&hNMFv5sHS6|WyT5<yHZhO~IUKfZE_i-(vjW&{N>f&@oGB?$v2~vu
zL~_pN0<+0C@7~~;1ahB()6849O2nRR-_`{3J7dR%=g0f+pGo7secKW24wsA->+<ZT
zS8v`e4bk6n&eUYd<_$B>vx8kGuuxx0I={bPoVyifVQyB`oH;eoI&4q{51&0N5u0|#
z3GALnCHr8Z2{q5{)~zsbXhMB+YOY11m=`ES1lDuUom-xseiout$+YUzljfZ}RXm$i
zJi7`6m=4@n84QY~k9<xHJ8s<FyK94hif7QAW&sAZbMs=O<M<}2Xr6QAV3=N2RTme@
zIZ5T{Oc1ZSx_)oHy$8q!hb@~w99``0I7y}1z=^>iBD8et`uyZlQx9-LVqjandi~e$
z`S!I^;J{J16}e+GC>%kSGt8VdYi46(`1$$lkYwnvY+ISx<dgY%Y!Lo|^y7U?H*eUm
zR~F)02ItaJ^UXJ}TU$F$TEfAu$Y2l>Z$JOE=;xmbo<S|m0-$7?Am%mck!%Zt!?ukd
zzx}BA`1LhZP9iTa4i>1OG>=H4U?28u*{bX7JN4VQrX|cb;}(8+bMDb%Y2(xJ{dX<x
z_wZkGe!25YMwOLEdz}CigYw(A+Ltd+Ewc2mk_bJuwEg=2-T(I2$6HiAS*=|EH+aeN
z{6GKgUs|l0;_Ya4r&)mEL}`gkOQgojlWTu!|IhJNzsXqmG(Oiq@2|uXXL}CDhKuLU
zfm1k(=kK^6z5AB-bMiJYzqqC@AMUkOLH3s;2SZP3>D$jbQ$n=F(*ISP&5dIZ`(<Mv
zs5#A%gCWMIIIT2M(c@P8q$lnDc0TUc8NdH!uT}JH5;>{B!l1Tm_k0~)R?qjF=Ihl>
zKDYM!p;Je;J9cFWFo7cV+O+A1tv!Mglas&5*Vo6hJ<Rxe|C6-7a}G$W-v49wDlJSW
z{;U6^|MQx*PZeY81?_9e@7_$^cv@8Q{Jn&bjv#guC13T1rYj3?xT=4<{8{G76fHip
zuG|2JC4M|A-+#;0<kwpYO=F$pYgW1c`Bz<WyPL6Q51&<@{ru)LCr?deXzNCfrW@wd
zoy$HwF7gc0kNRx+?{Umc;YV!S_wL>6JbT7IvyA7@VjqU*-+B0Z;>CUc-u$`jIQ#p*
zEt%zMej6`lh@9zd7628h7Y<$LmrrtOQYh<uc)0!W{QvFj(mr2jUx<lyt!3T0|LKSH
z|B~xm7cSf!d|~_E#hbI^4*2g27B`SNt+nO!#IND`6JPQ^baXv?f4+q2`y0Z^mEU@;
zzt8khOT1&vp~%3%z~JP%=*@x!=KXSsF-;1O&nz}xUa{feAJ@;j@9$lFxlsI2Q-kZ3
z8Ff46Uz=;M{o?k#x<v;r9p~7e$(?zw;E($<Py1&xcr;huoM!rTD*xK-ygP?3-x6?Q
zU|?_vXz4o28ohnnmFvkRO$y0=C!g{5ZF9V}e@dqKL068)_J6Pc{Q7zo*QaxTHl*E1
z&bzDf;`X{uyPUNtQ?K^_5Ij_@8ooB$sHm%@%3QGp<jyS{wr>2`f05mB!W_%{R(`CH
z?SGfg?7Jy4WwOAf;x=>T?~{2qaVNgp6IoU>>)pG(?7Nb8Rx59j-j*HqZ%6LKPYY5T
zXV>2m5R#i6QL*aD)z@iy#}!X|d7e&NVCgXJ(V9QO&NXkkXL?&%@BSfpXx6Rc*G$X3
z-v4iO;9z86U}#)4(W|?;`Sz??20@N)qAt%@mrdYRJMD6QUEIRp0&%CiEUB575`zv3
zwi;YLpZ;fmb$xw(+(XO%tl6IJH)d>`;PUb0X0~sOC%Q%L%l`F7ROjg4y=|(i%_6Re
z&)MU!{<Ct6h;PWARL6pdHIlq?w!t7f8)}sTdqRpl^lTRexp=EMT|cy0%GbTv_?R}w
zaRrmk=N!^Dc2B#nE%$%%<4)^`mj7SaC6AwA-pQdD`^}=haPh?*supu%I+Q1;>*?7Q
zce;K!A-$7Zap~^m?aNd>O~1df_XwWyg=@Z3hS6;QxtH_r%WgGQ+4SO!YyXWvHYW}S
z28NcZ%GU0qg+ZQ+oYn<v8||6;bKkwA`|NnyMUBd5=uSE5!EK$%&duWJ)}@>?;al^|
z-0Y>z#o|s?-l1`Po(k@YD#w0yA3yqf$881U(29STOrLS+bQ?%2KCyq})KM`3oU(r(
zT@*3%%Y>L|izdl`4t(kxGWpZS;t<vH`SI~9bvparWi1WVtalXPczD%TaoIjQD<gNs
zCHI7W&Alzb`NW+=I)2Zm+50+na~YkPv3b*9=k~Mg9EvUAw09sg!)1}i$|nnayn^dj
zW~EN+Uo~OoFKOQ6wIO+B>4!pBosP=QXXkw&BhAt%FzMFR^i%`)XG$$wTF>YkPJB{l
z!=0GrW|w*C#)55iW?}c1$$U3aT%x-E%DzX>)-O%vUlq5nD%ohZ<*FZhe^1?iPj~gI
zmC9S&z&=Wj`Q{m1&&hT3!6yH-SNVUQ_<kunJzMPITi>V`JN&M3Fe%zBnr3?UZ!h18
zSdPnTzI)0|T95SCEAre*Iy|c*cHzeU`PZa--Hhhk{mp-44d*Q>s|tbS`1_C5zfNEG
zXVRL}v-Un=f1S?v@}YzGx1%Zs;spwdQ!D2#{PLaabhpoG9f_cVx6fpsE!SQ9{&V;F
z_4mcxW<NSJXZNdsPloTDJoufX=GUHBXBM7+M>5Fay77<2<+{0Fc3;@GV%qW<TYt1a
zzUf->y6yI<so&lwz7x7!HF4dxMZ2bPy^@ZPh`;py=~Zyh);F!(?_8v*``hPp*fXC1
zal_zxz6B?)tNW-FU7s!a^mVnZ<;@FMS=k)~esd)r>(P8a-+uApLUE_8a>vV^DYbrr
zPXB*quUVUUYmMk$Hs;{Z9~XbT-P(99^&j^&9<dke{}`=Wd360><{8cBxg*kJ9d_^8
zaQ<tn>oNYkgvGu-@|&Ja{W5j8fZGwZ$m;>ud9Qhf1nqnOvQ#K-T5aUXX)pIh-hR+$
zd-3qz)Jr`_Rpwut`-?NG<8>rBJqOnZ3VnRA$$!?b(_aEbCoK8sx5VYmz3-N{&c6?<
z+BH$~n<7U`LCqY#n6p0ni-ivP|EtV;dur96m>|3591Bn8Z2QTOnDIn$S)1#e7kkwv
zpVV~P@u+=m>|NXY|78yCIka3r=<M0|&shH)`Ir5w?>Ya@-YcKx{nZWL7whJ0ZQ}vX
z&;b)O3T{4E-1%n3tNPP+-6xL6Fc<~-|KLbc^HtJ)(=4X+n7ide+7Y|Y8CGI8R>iN1
zPWZX~oTJoo<^SDf(^Ovi8JM0~<U4yRTk}Cpryobny&v-}zx2Ownn0BQmz#4ORTH<(
z$(U<cF8X~piy{jH!-I3y`&6_uZ!W*ur?2NGbh+{nvxPzGsk>{|?CY0LWaVfn*rHNV
z>vXwxvF+X4?WQSJ=R}=mJ=?TWeoI!NN9x0sLSl+FKVB5RQIvJu%d$56g`oAXiK<)9
z727zS*s`x+k$_RR&C6f=Kk-Yfd+_qJ+cS%$siJ1t9(gY{9jm@f)RO>(c^<FSU*D8F
z{t_3|md^XOQg)8n+BF+4T)EG0?x4^jbMa@@{*@Z?hhN^iZePAj;L@{cW?z-f;>?$P
zYWio@Ensvpes^x{;eDqy$`w-@zfHQirPw|*v>-y~>yGE{9GUm$UfcHV;L80ii)Wf;
z>+Ck2cfvYzb6c6l*1TJcAn!kHT)AJO^Twu&@|z!b7o426;M*DhVC!0|Edq@KMT*ti
z>Yu+3{}R{8rTDfmDcJrR%Uh8yflGPjAvt@OE??YQaPX7DuIg#!m!7d1Z@H@x?EHDr
zHP+R2x9py5+W#e<3uJ-92Df_FCI0U`8rN@EufM>#Ic@5ETW(z!g_gsGiOB)+`TBbU
zcQ|=$+*zyfalxWvo8H{~?DonkgST^naO;F^r3;Vo`$*1rlGtH4!<)I^C06bC&ayY1
zji6FQz;CgA+HvvzMET2=hk`xl*zR^)Zyx<E(oKNlq5A(lvf`iFKbI?}DDrT2Z+#hc
z|4ejj^!Jw2f^#%lzDs78GAiB?5=xA9v%YV@dS&B<T@J#c{2=!}nAQ7l#!CBsH8-V&
z*36ThpH<dvF;Eb2Qu2KD^^4Kx=L!{yI#$IKQ;&;8J-zYe)7EURhm%63&!laB&GB&C
z1P_jdyBQf6GQO}s(lwJ}-PO>rOWJ$^Z-+W};;ki}XHBn$yfJgSarv_K<h|mDwzS&k
zbMG$u%(s@WR8#Se@VN}>76GRdTnr2if0F{&_+;&T%<a>!>>kpkXfC`&H~!zAEh3*9
zDi#QcvFN<Y&0gwNF688O@FaIk)WfrJpPbX)ojkWLPh9X&i?XDE6R6SBFj4xiXixHX
z|AI5sH_i!PIP`0ikp{~nOQ#CUl<@r*Gu9VN-rK+4y8M`H%LF08>1U2|vd`CDGOy+D
z-@kt1PC?e7dV+yLhFj`yqs+B)!V1a;A3{sF-mYe1QoO?ce#7I=Thh{5U0geEDNLL{
z+xok8JJ-UKDT~s+)Lj-YymCn1tYypgatDr?;I_esTQB;T{qqQ^$oRsZ;e9oLZ$96a
z52d+lr9r0sdHX@JdTy(n<CAqwE|p<yrPe9)_inkq_39P7dmCa8U*u$NE|dKIOQA)C
zW1%%OIDD0kD3{M;Sf~_O77$PzE4w6Vhk}4paD4pZ_1oQ2n^Si!&YWEPlBq(#N$u%W
z{{JPjGr8SMoT`2ZIK6o3B=PF$(L-?z3=A@D7n^(kWxRU7;*_ZL-$sj>QywqpbUON|
zX>D}0l+*$-=Ozb^URzuLFVo#po3|$?PfAs?vYzjB;>pp|=IxXEYoE#=P-?mIgVD*O
zQJ{$R6$b-@Q_dH5A(2mpHP<d2y0%P>gN;d1#>fBk?pwyo-BO#UZ_Bs*bF==%6+b~I
zwX^xrW$*0|JZcGHP;3$C<Jlv~&>$Oc#Jc;o`h}IpFI6&SEV=aP!Gmq$`U@mG+PM>N
zZ(eTNy7;D(n*Q@Ex2B$1Iai~_hfie*pL$FAd)o#9Ck{)+fKnC)29saRl6G1(hmZHT
zsadbSShBB{`=*0UAjjEf&rWf@)AF!6VKMFJ*$^vbd#4$(1-F(xn|e=syN>a<uRrx8
zk~as{e-&#HaMH;6wuuQG&?{yhx7cr-Fh9mG>c-VeOivwb+&O&Rk`J$)y?E2XOH*9t
zuAk-iJj=<W^P=3=$jFjsN-Y9TFP=HbG9Ca`BHjTfY<6ChztHjKLn+fktx(UBlJe};
zx2sv16irIX?Dkb8hL}|-$4u7vIp^Hb<pR${=RMYFQUBz3Yt54DiY+p&6PC>C7O4Bk
z+amCagP~xfTRp>tIUDxwOH+thyKl|aO9eM$moha9Y_qHU^daS9#`X!F|G&hSD9vmA
z@Fa4t@7dj@&+kn*b@{pe?KNlg?f4a+XtZ#;8?E7XQvUz#>Z><z7Kyj2v?MBB{Qu$8
zCKZtb(u@T^SMJy7oRPfPo?%PT%-a2p3Wsjr*4--5C@|@6?A_h7cXNe3OA*zXcYaPs
zy5bUbhTK=|m3JqcdQ)?|+gty|dS?zxu7?}fIK6JtJ@{}M`^xH1F&mst$gWVnBFM1N
z^cS;2Wal|yKE+$tzgHD)TDbc*ZwynTz&GjM>CR<AAE(+X%H)3dw{c6)%lOODb5vVG
zO-s$bDr^522|jGJ+chN2UMi5|?=pR(nLYxCviJW<yFBf-eTjkTOLZ<A2abh(0qzVx
za=(OIyi1+Wuw>=bzTcOcW_V7{Te@7Dm+fH}3zOoT+WTQ!ax_DW#1GwnwAKAe(W>%A
z0+*Ov_h)ji{i>{@Q|9sX*xcW1POF`dxpVh&a%9=(vX#E`EB|bfbMn~xFZbS@1-jMp
zAy;fx=WE%7I`IoQaU5saBlwEr!i)TZ<KjEy3wR=huk`)1Yo2j(vM2X%mKCiWEgxd<
zF8;Fq&x)Si0&#bxCq4MeDQX?gp}G3{+YOmjz4~#6rdvz>GpC*3_2zkQqH|wZU~Kl~
z^o(ZTSt?%&6qo35-|^Ak^uWIU?3PGvg_Z#K70L|juD;-Bn3ewQ`Th0>53a0CZEaol
zuWq3R3zK3^-Q%iFF)pSttp@hr|NJU#xBICcx~oax(wZs0#xpm6IsRu+@%6lW7iG`S
zHcVf7c9!(^cYJpPmao10Y>M*6gvtx&_8RVXO3vIgG3S(V>xC+D`PXK0_w{(T)a`Yt
zmv!POZLwlHpY!Fp)@eJ&8|q@8zo|29xxAd)fm@Jc;mw$3)~DX^opR;S-sJy8f6nQU
zT}=YtzDa>vIvwog*YdfIXP&*r9<#mje8>C0x9krXw@z5*X`XYPr#!msP3OD!@6{Dk
z%JVrC|37eauTXxl_2T?&zrTzEr>mcHPWW)Q{Av1mC+=8d0jH>YK6{mBFzGo(Osg{a
z>m9FEpsBcIO1NE$T<qf$heTgTN8QemTl*_<?$=*I9E!rp@$zqFKHpumKl1*cRL3p-
z+BX$MZ-^Y)^gC2ft3_&J21nvMjw|3O<Zq~GEw=J+I1;%z>r0ifuZu!QbMcSO{|iJ8
zt$X%t&(F;-OW!$FSnIV#MrOso*mV5=?#cN-^dk;mWZT~2a^X_Iw>+`<Gckv*ICJDK
zds}OrtKxj&Y|1}T^Em?hsxIqDC_eF%_%P$@ssMMBUyE1n_h~f$#oSOe&Eg|Jm&)0>
z+`29@b3^uX#<YC!{mDFcz4_h~u^j8)@Y(&bOrBk)mb+<vY~9~;>+)WieZ0Kv?&LHb
zHRg>s6&iP~m~Q*PB=qYq-{P86AD6B+=bNef=ahZI)m?8dviCc1v~%BGq{zPTXY}Ng
zDiw+?R!*`D`<mE#|1ns+>pdrY&V74H=G|WD4`N3g6V?7kv}|~HXs64^^e<fDif7K-
zehyaH`@-VILYLq7+UL!Sd!<+L`rO{n)7Od4-RH5E_5I!TIT<yXe~&0kpK<ot_qX!%
z%=awF^}fG#%gjjrCX@ZS8*ff;(iB)Fa7Y@IGZ!|?#xtC7ea<;u(Ny6<WTqxtU&r0W
z_cylsa-4m(yYu52?U<Gge_Y(Y>C{&pUHGCrPx#+n_Zw--#zkGAWN-80#ia!o<r(HN
z*uIxiYwFo4ka>Fg_4~WqA1Wsux7inAG^gaRkZ4`mUH&iiJGc`wy@FQF?_Zodp<>bg
zCv4{O3psBXi|bw9JpG!jV&*LYa8l-yH~A%O$Kc|1q4Lnv6C6A>k*V{~eiwL>Tz<Xa
z?4z0Ygk)Mjgyn>6@;TDXtJY;_`mKcfg_`mfuIaZf=id|cJNs*^=gTdRGZyI?>ln@Z
zWishsq_E_4pZ84ypg^9-I{&m?<}3Zs-qiVX7#=kEa4{A~>el@IpvX4s#E;_S{b_$D
zP5b)R$4x=@?Aa545A8b4@%GN)y?c+(S!%y+d-;wn0`G)7B}{CXOOG`7G4%fX!P?-`
zD)Z{;sol}3?5ulNu0C8KEa_i$J8I@Lfpz@8PT#g{+wnS`Q8DJ{<88~PuYalAB<S=m
zLxv4hI=%4MiPGwv?%luQ$;*r{>ER3)R$i<;bd^)In|oVc?#lJ@pC7O}YHjl8aOKc0
z-hB6ya)ZFR8JmrCHy_9_3EKOcL-ESRcMh@(`x2RZ|7|hKyfpu`ov8YS7v~Q$IJ`AU
zjA6QT=-RPk8+-Ewp1iszaDBUD?FYWbdvQyaey#O=`#9VDy~y017C(3rK^=s-(#2fo
z0w(wO%l{8@<WOYZBlxO=UH0(NMHVwn;`A=B-0<eIB}2f2*UZ<21f*7Ov9Q>&c4g+4
z$I>h>&85z-kAHs3%wxK{c&9&Cp))i!pV{R9)?u-I)VG<vvhgu&4Bt9k1#}N)K8);L
zws@!HW3!Ykf3KV_ai6(2F{Z=+U!}F)u^gkFhke~ZiE4#%*y>CE%10hC2c0~y>3pMG
zz3{`jb=(YwL7XDq9T_P`mkymPfA3~`!EwU$?_Qt9&y~tbpNThlA1Zk(UrE4eh4P-j
z4R6G|lb239%=I&H>K_Z!U!T9~9pZ=%U|2A9@#mI?o9jcSxww~a-S)3h;ZCxd{qCxz
zDWBU!T5m+k%~&)g=FX;%Kew(fF<e(#EWq)wZeqs`_62<b?$PhujXAG8vGrW(5v;vg
zeFeAS3^6-~B^nnioj$azzB+yDt$TeJw|;XH2#$|04plvwnCd6CR_!UHmEhcUJ9l;Y
zy<Jt#+9=R<l*Llf{o79E4{j@zV||vmILWRSp2~dM&hRUH!|zGU!kkvzY39h!zvSec
zu70eTqe<bhm=idj|2&?ta(_kZn->m??S1|-J_t<lcX-aZUFj60(q7HI*owtbAg*PC
zHOT1yH)j3n{+E68`TX90YAY_j;Ah}pe&M=$NK3EV-QEoQ{n0O9x-~N<TeCO{$h8Q(
zda=ksR#`PE>f6aTKPLIlmHVTX@WYyg!C^-PPjiuXlA6C7xQENp^g*X3!2MsN)ujr(
zvV>RfJG=^W3T~=P{Vil>5NJOqoOiZSGx%Lv>et#oFUk&^u{a8FD9V+5@hDxw-63`3
zqpGK-f3UVuZ3t_|7j^~-c1|wIH7DO%TI5DWCN5mLUw*MIi=%)dr{WdCdlGpUK@IaF
z^`!0o*31kSR*HO3<#)7BX4@j*DA3}|k@?}Q;0onE7xN-?fBS@KUAp+9U!Q?N^4<%Z
zhmk60W`)*$TXQo->URgHqW}xIVCiGuWqeWSq~lBzN5$(a|HXWp+3)^u4hutrRPUjQ
zHWQXu7H55_+I+L;qkNM>M{=vcD~{40i5b7V15T7MpSCMD`1;(7fgwY&O2W#&LhIz`
zXA{MeI64$KlH?Uz%$;Ok?lJkge5z;g6s}tzRlBABCcZlVl##*3^FrmJ#TQvwuH4;W
zxXV$vNr9t9;8llhQ3l7?>zn*5*`)q*iZL8;oGB8-a%q}=eOy%6Lxm;<0VjW!R~AYW
znNQn2{-5>5{j}Z2+v*Glay`OMEp+Aqcb9m$1X&sdn9hf~|1w>?G-z#%oAQ#9{HL9b
zEB8;{XLm<aOoV}9!msbWZj7KZG&Hz*p<<JQoO;WapT|2|c8dobKhdc6zLRUG-&%`z
zi%&^se5#wI-xbTiz_5UQp7Y*4Z48=93tHD_Xa9E)U}+SHVlEX~WNzepFL=t9H^HVm
z-h5u-piw5l04fxG*-pr=So~Z-ODL6{)%5z+-rS5<1&*S1PgcFZ!rJ_z?|Eg1fRk*j
zgRJVLgQ@dPzD{2iHt$FFadEjbystD|7#M!LD!pUlDE(pr@81|~DScW}Ru;RvQeD;5
z`jtbMnWnAw|B&3f!CPjf_~)-*_@-{E>D8^J{_{+?)W1lm%&)KiKcW0@T-@Iup0&lF
ztruTB@$?P9ylvXO(@wRIyC3#BJWo1hap~4IKE)@F91nYIgjFXVIk}|s)WOvGXRgRM
zSQW7{2xw0&_-<9PSUo#2J6Krf(A6Y^8lNkvem~13jo+k2?66tkQhzta=w^-br!SSt
zcU8syh_B)8_f@gqQkNfIe!k%SESutw{nF*j=WA5l|JV5R&FX8p%O44L_IS&^<EU(X
zKEtT*#rnH#0$iaSk_-9_gI><xU8^P9Y`yP-m--6XD}oFLetf5w-f881_2ML?fAw8I
z{*Y>n%G}ty+0A8}tQ{^)+xzyd&g58uLlb9g3z$74&uF$Km*U~@e~e37Ri1!4)>jI9
zT)b7=pKMyvC>w9YUjDn}z$Sl&d=>_oP|Y3L5?2H>QZ{Xt@_l}Ly8+j7brqd!MLYaI
zx144&*N@%%u{(cS)V{iZmrTDscHmGy8)1|DZk6MV-RYdV$7TIE{w~v9QttaRZ>BH%
z?LFFm9=j{I2sl|Vfs#?`{3}oXo;c8_zcb?7N#y`{28OlU<<}-T${w`aIcLj;)k|69
z9<I4CIq&~_mCNFybN6Muc`f}XaQ(pr`#+t26l!nm*0_N?@xrsc)9hcpc%!v`74O9(
zky4LOhv(;TJ>1h!+N^)+Z+_L!Ur!?cP70OQG3~iFcN6!+$IHKd5n18;VzJD-Unh;*
zMJ_9aKAUm>OmuFo$usFBYXPS$yK_!0a~rJOcyxX*S-D>%y7%7?b_ZEThMmG!6XW8V
zTbNcn&fo}N>9uI_?&#=5@jvRO%JU_&jxU$luE}%r=kk~PcfRpFJf*PbWX`(>-UcsX
zN?LXJoy)#|nP71<kYi@XqDM1lotcwVrnu!!QCrx|D65BaFa6eW`ti$mb8KEne7t?J
z&;Os<7WQpf3#2W!iJtzlb>nn_OYT19S8qCLOq}qecRmNV!xooCQ$5+I*QOct{)^#c
zC}m-|u!yJEL&Qv|$HYmtogtqme6@b|*0ytg9#Zoc^19AkSl0RPm_*-)*Z((`i`~nO
zi5CC=Z{Do8M#jd)(t74^jAl&JOfm0t<~24ho+bJ$<z%9sadG{(C%1R{8;7a&JqdhN
ze7$b{+qu>5mwb}W`#+ykdoAxpP(;ny+~r0p?`zjEC(OLjF{#Mq)uVYYFHD`WWP7*D
z)j;88f1iE0F+INa^ELL+c?-h+dv=}5-n00@G;98AnaX0b&eVMSIsN_guS+HR#dkei
zr@sH+v-*3|eyip@d{#a0nZ~ZC_tNb&UU%!J3pEy;-WD76xh$|$Lg7jQbB}CXt?}K4
z4+j=5PQA+fu4YB=_IXpn?|r!Sb++*PL%YgOcKKV0ixmfd`B;6G&-R>qhL}L!jXir`
z&sMz?BO13aF2W^C`;WY!K-=_%i~VaBojSvF$&TG*N$s<~O<VjYFI;@G<R8cJw8r?)
zDK9c!L=@dj_0G=b<&Mr_$gjFmw|qzViP%Sy0RgvT@0NTIPVr{5zjHqJPRP<bfBj3C
z4EChD_s_jjbNu?fPxITSf9N~3=$*}6xh)r8KT?Qsyz<gfIgf*H_jHHJ=WlXPQ{(1%
zD6_V5>FwX?tS!g=Ysy+b^EKW!VRVXEy)3Wg-t7G^Cf>+@a7=&SpIvuPxB6DD?vt=~
zHP=uPxW+3hTrRv+{q{b&)%WLLbC8G=S2IsbnUbDX)u-S5x!C>Dx6D3$wa0FgU)F?$
zhNT4sT)1%Y!p1L~PKWVHeq#T)NQ7Uyd)m4(`30Q21D(V+1s~lkyL)H##=wV-asNGc
z9P8Im@yTk8FSorj?L(|kW5KUCtq#k63#~7)Kby>8V4T+|zr3i{@#W6xA_{keZ?89v
z_|d}R#A~;2nr_T4E#HO-3sz4vWleU;eq2^q->Im6FCyC9$VT9j<>kBHOTNEzza>~H
zmiX>Y?EHTYH=-^~+;aYu+wtkUY%bYJ%f#z#*y2C=<b{hVt4^L}JAWzaSnqRDt7);7
zOA`}Uv45@Rx4oMntsGl^JNe1PLk6AZVPB=!=)R5DQ~5ZlL0X4#<BIu;H=Eyy8FAkA
z@LPWF{e(QOV@JNpX}pg;zWMjFwbqf-Togi-G;VeZFF!Zar1sq<(d@mc8y4Npp7`BO
zReGc5y~DNt{dI2a3aG4j=ipJd=6;5Wjld<PPhY+rT)c?YskL(Jvsck_k~TGm{x!RE
zq$Rm}-*=T&`e~N;c=cWT3m4hvy*ct-u*HAl;g_E;8Z`AfeY~1&-p1l|DdXtpB@4N%
zIi)9ASmk|Mv&CO>Z^6Zldp2I2KmFTHfnS@|>p*_K!eydiul|xF9hB?}|9;JO@B4Fk
zgFz~@++m+f@+&ewC;6}9VwR2ftNUj8M{OOm;v*}`7m~3@TT&!~G*(RBAAU={Z|fAE
znK}v~*6j7UDsS9nJXOBk{cgX*os%ca`e^1^HmA9~$F510uHffyS+Hi>)UfaQTpagx
z-^JcreNNxOaHqqM<MQ=)K4(;~joeVNwED}1hsnR(8oK#4UR_wW*7|PU-zR;$q}}~z
ztXu5A^)=6&cE&@}@2$QbU*Nl3ZdQooD!(L$8BrxV*(EhA&z^i{c_91KJuByWHBgp1
zlHVxuaOT3r3zM(%n&-^0`1pQ5L;n+g=`T(P9;xzih}uT)$??7OYoW3_n^0d)tjOEI
z3vH8}%uP*hoHu55@K|zUfBDf@rBMc@&zSx*&C2DlKg9en`TYJ<&%e5GDm6NKy}Yv^
zWBc|~TMTUkn6^ZP{iu6-^P8edy3tMtj~{;AE7-p1OBkf|h<%YYurWAYa%jrUe~VnU
zUp}_Z_G@Cphi&Zhg1a{D3+^cUBmebFqt-r!kXbV$r_Q~qZ=UWD_s&4-Z){Y<WA4!U
z6IuU#)STTXXC7M0$}mZ@w6*V8?^W}=DG@Vvt>by}{^!PknO!W=cWi8*rm#s_YW-ug
zsxtn|-tQNnvTWj)DHji@v53~PW%73R{bQZ+RO7X&jljH(%ldwuNn?1}W7)lh$N9>M
z#tpmDI>a9EN=p=%DMo(IGt+cT`|tKCb1TCfKIWE`rMqH<KQ2*>H>pzKSzqGje$UhS
zmb&k~&r+A|^iO`5iJzqC><&sxB?r60Hk!=mSX@3^+u1#MzxDe&R>^K%8!oWf3N28$
zS;W#-!tt?kvI@K1^_9Ehv(z1OXKZg(6Zo_IP}@p2C&P#bC*$A$TzKj#)BXKL8S$?^
zz1zvGD86~is{i~&cWt~CSaxmUiN3O|LBQ*{(Q*AEi^<$AckgLkWwME7n$5T?%=un8
z=l(yRX1~5K{KNLpl}PS8zYZHXc<g%L?7vqcozF$3>~7oI=Y|4qO?|1o3+>M^u!%l-
z^uy@grDJOEJrnj{Ywc5;d~(Odka;s1->8PaXFHj4bCqfN{k_Epn?$a1+&u7#Ia{*g
zB=7zejTUxFXIcbrHs6~zefPfSV$WQ;TdvG*t@&TFotwX9kFZgW?Z-<3QjB{GC#Ti@
zI~pD(FUP^$oUr(qZ}*)LHhx9jj8!{3qRn2Ku2G+V`K)B#s^v?sJzy?TQwUl6;JWQS
z&Ff6t53@hK|AqY!$Bv1TIS2P{Ip5}1@AcazUD9e6C@Bc{B`L&opWJcr!p3j+s)O5G
z%{K6q&YbXIp}GEdKOI|+zp4}7DBay4H2ETvqMJotXk62G`^sN?ipwQaO{6(IpO#vu
z=iHa<mf`5M%3|bLUU_}9dwtFdHC2fht)F7lZy%UGZ+F4YYXu(<Gb}u|O}6^puMJUg
z?wi&zx<p$GeDckmKj%$<QE}Uo-I?<>Cl)R~nPOC8^7Z`Lyh;(15|ffO)n6{&*pzxK
zf2D-OxlH?$uG)J}y3en5)m&WPdit(vdeHNO{zfVSr{0_Fbl|YeI6E;}{m`EOD;f&U
z?()sccK3-_W_NPcVb-lIc`w2va&wa1s><s(LmxlBIC;wg^OMIGHeToz3wp0LJ2)gH
z@U~ZDL53qs=KMBL++Dcn^3F44M*544*1qQX6^{<=Ds3xBw>HbW`7mE$oulB~d20=y
ze^Kk!&NB66-*2$qsoiS6Y3d@!SxawkILEJR^Tk}6V`Y2EWP{6M9FY#+R$lw^_P^oe
ziOdVT(@nnnziDzd<~ck0@XP<3k9h1+uo1|*^4_-M@7(48D(?IYm>tH|!ouA9f=AX@
zZSun8)7f8Ce_m9YvvBdk#}Cx!+w7>@n;3UuW9jj{M`jU@Y*m3mw!wxHo()B9F<(!<
zjMAUsvbB}d+5G;FsqGfCe(mP_^X$u_A8)tcKWR2avwQXr_cbd$TyE(oEODAt+*Qe;
zy;M=4=;Qpn`>xy!33^Uj99BfHjFA8S<-^6tg+CYNeeZa>`r1o@hc0J>J0zZKZ%z*P
z>0D-h|2L1CNn`DYtL`q>1LSQCHt|YsGZC1UmU3jJ3Ky^D31dIw5|f!e$9i@3UtPNI
z&un8{vL)y0!`xdk_ctD{(ErF_xuHw&eQEvfo@vcL3O-CYyYS^^@q51`*ljx=b1m)_
z$xS-?Qm#q#?&1*6Ny<{;w<E)B517uMW0cIOdv34u#$SJ*v~F_fzI!C3MPEaok&7we
z73W1Cg)gj@l?(4~tbG^wPuN~!opU#%;>xKpEG>`EZHeT*|7U^Fb|2Z$eR*3PRs>$n
z-*D~1=81N~_x^;(*Z;0coXBT;bDi<_GpVlI7yqqZTKi;=SEbfM8(Ar{tVv}@YZ(JW
z;)JLF^;UenB(u2k_N*sC8csiImcP5moLDhc#s5oJ2TO$yDB&zzyz<GS?u0`uRp(Rg
z%&0065u0~o>*)jM?XT#>In0Q#DVDb=xpKGq$B9C<*!A^m;$PVKo#vXk;7I9~|Nq+M
zJ^%Gs>pB`Fst4>!y!`FJx{@M|i>KV@S3iwu5D@ve>%8|KVTBKG7iAf^iLKOSY*E}5
zmJqrs_9D~5dpo7sT)xy*EIOO5cjQvllDhi`cl18clRw^Cx$ax-FXjs?w&{z0@^!r6
z8kT?fdWZb6rIYRzy*K`IvpM8s($X83))x8HEBJ6)eLH!sizONClam)V8fgo^;?{R|
zcRoI4k@EBmpXGk@k0!O%H!^nxOkEJa>X6drEBmMG1V4&WtTxk7)8zTg-R*Je{FWJf
zk8Pf^GhJHpvY6ArjGx1l!_w~Q#(3dHb^NF2WHe6jc(ZJ+b>tj7hZS3*IX0}^-pl`X
zSMR~O3_oW%<Z8vP+-I_3^PbtZ-DPiArcbhRHr>rH@>avcr<a9eaky*Rvnv`8j-=el
zFq+9Dn_aZ&kn(&`oqYPm-ku)Lxz_cS9~KBEJc!tzDgASimUxN$>+IKVO%cAif1cfb
zU(g)l;8wLQ+5FW$m*7H?7X1znf5v0;-cQqB@MKw@mXPW(<_RhLZ`vqaS&&uuWXDQ@
z_42GUr(gH;W>S=I-{Z9?#k5rU!|#iaN|>G2U;lGqqOfSnwcpDRecpV2AIF_VAB-$F
z7V0X!tJ)#k7;u#B@5MK>=h_<|Ve@ybs{hmZCx~_C(%tfz?WGekHkdLgJ_<MTkqA2G
z4XTV!UNDSYb^1K7XW_Blw!Vo855wE}r5TU$POT99qWsEf2A{sb8YyQx|7L-lBkF12
znwEy}Cs`F8)16c4pYwmx)9f3Y^8Sj+y`CNO^Spga^E2J3gFiJldLLz9ey#BRKj)eh
zgXVt!>n$Iua|^V~kAKsP*wm%hB%sqHJFoqE?hUK-gF*i!KEygS<t<9G@8bM<*z>cq
zsC<@;O-;$uSzl$I=KSXSbNpWH50^=*1v2~V(>15RJ9R_Sa=&s;itRS(*)Q^XEN;zh
zo0-NVVXl+=eA~Ns@80PZ+&sYXe%7PB+6TOsL*Ivf{`+)x@7o<$)nh~7e_cN>_Ra-`
zIp=<VQfTR8k?kx<UTr1!YvVo>UMr{LcBiwxe5v{MZ1$qw;}Xm*$C>rjVpci2H}$z(
zC^X~x@?EZ^rLT6|-|P48>EEl5H#io-?HFOwvtCQ%?Sl7O1qvl9FFaUe&7c0VzSgPz
z!ow@V;`_t)Cc|S<d`>^PIJcZHo$`XuN~lC-(WJ~Tu_YJ3zgE?K$sx;L`+t7xp+Cpv
zxsOQ%GaXWS5wT5IHSKV3i*#qkm2JPQtoGgK*9sK2dgS)PLW0G7+UfYZkF5zk8^1PR
zFiG{k(W`nmW5odpkliki=LvHMXsvz0A-nK#fP`7(4g+&_iDaEXfn^TIvqYTiUU<B`
zJh6k1J@3sf6R$(P7bbemHoI$Ow#~p^Un1GZl;gVp@s)Gt+s)z77c5bkb>`=%MVF`b
zvB-MQHosr`<HO2U)`JqspA@bvU%aqsvN{LIE34cV?zy~R@iWKc4|Stw>DcHVb~+}Z
zpffXV^CCIf4>1>5WjW1-G&3)lB*kp?w0XfHd)of@&A*c;FBcbQP3~FC>GZS9bDR6c
zlfo_1oK`|_H=Oy`*SG#vcJ~71Jejv|YF0$qRzK@W=-DXNV326_E~MlW3phHeWqxb(
zo?@3Ze(3gM$7}KZ4Xr&JuQ=?evzn&U4Rx8S><5`jmb8g|7X+=|{r>x2{`cwlY3JsN
z_86+MJF$j-VqBsK4vrTQFHT<OvvNBA=2GFB)vsT^ULPM7CDdcc%g*6n^r@u_<jo~7
zYZe@+>$<}so4IKB?vqXjB`)VSd?+|@QkYBWj>nFPuL3O+B)DSOWh>qLcJakmz5KlW
zo|Z&%L%@7B8}@LG&IQVj?pm{!F|Az*vS@L5+|O5kzjGgxP`I-2ZeOq16qgGV7bs87
zEq0LdW06fgCB_|J|3dMg1anK4^hO<?1u9K_EV7w*w$4_VvVQ)8<l7fNKDipc|MQjL
zCPOw3(XehOy?31pl$ZLuTRqwRNvfr9$Hv^35}QBVO`k8?W9YDANu=Mr071bLl@}J0
zRiBPE_g&by_vMX0VQJg)>;M0J&YH|4u<Xvq36s@DTw0_#&BGQsFfy5zDVIEvwXAIm
z-2LrVe|)vC!7+x!EZI-7tm0c;SY$b^@=oz;UYPr?q^0k|M*Fmf%k%eXN+dTJv>uCz
zGg+mk^upsp;Sr;$8+_}ngi2&KytV)OrRLkU=tXmnNhrveoi){7dV9rUwid8a@3yTC
zJ>hae(45ce-2Lk6=XO6F47L@raXi)Dx+u|aUVw;TiOQXd1I29CR@ZV8lG~*hCLjF1
zUSI6F{VxxYvxG|4fFi1c!~D|53(_V%Q&m!SEPTl!yD(XiBTsAk{y%?;Cq6V}<Iwe9
zRkG7!>SNc%TuMqWJTCuKxV9kYf}oYt@gxaIUb$7)!+2<i$;%3zFPHXjQ&wu~3+X;|
zqr&s*y1bUY3xySzm)$;gEI~23VS{Oj&5M<ml}#NSRzW9?uD9EQ^W2ALXUpX+i?R|O
z4URE9Y~6CcbcddbQd6Iomi4z*2R<t&_d6DwO0y@oE>BcUp2_gABX#Yi4U0nN+Bmwj
zNN3J}{i5IDuYAdo-Yu`w?RVD~eLC}KQ9@6uc*`f=?Yr3YrBs!g`n0T`>~?M|T*r1^
z9Tdjp>Cct7-nwa=&XTP2TES;#pQwX}3yW-MiPH1q-zIZeoobO@_;_CYA0{y)HjeY_
zC+}4FyIMv`si|*spu&2)p9_>rTKXRE|9w}u{^w~SofIB{Qza%J{%z4zzbqduAt>m0
zTti1C&HfIkKyeAbZhSpnf7&#bWFCQaml*F)y|5tXQ;CX_(hG~E$j(b3@4cv4uv;2r
zRd{xP^6@Tj>lYp_Ez;k2lyT)W_w7+;H<#P_<&t>bZeN3AB25MDsecocSKZEB&8S!c
z3MS!slci3AopgNNjz?F2zZdT@3{{w-Q)_i?kwNVPM|UM9E2#?B!$16-S!8!co1W~8
zuYCHN-%dl~a#@2xt<||_&0lV|Nq2T+SUo?^F@+0MWZpQmY~9XhbC=H(>dCZlm|-W|
z-~LalKuOg+?CRpQL{l#9!p)~y&!#>4AND9q(%yMe#|o*|Pk)+0rH0zUL*?@;-3*Rh
zX%5JAkNUDGFv|RYmiD*kV{sO9`PHU>R-JuLzh1Mz!$op!%B+nyMObAQD)U=OxuyR8
z_I-YRT+R(cHV*YYUmQ9lUjN^I-^Xr7XOkx9Z%?zS{91t#&wowoFuJ-TSJPbqoVYHS
zNMDcr{&DsCE?)Cv42ezZ{t5f1_Wx`0x?K0sy)wA+f6Z*0|7oA@_<Fg_%$)!FgfWkm
zllzMqOx*UBk9iM9oMz`JkGfWVYhiHx9*6%4`_ukc-}66L$N42z%&qa?d@&(G*)Oqc
z|FD6b$anKwd{vcQ?Q7kM2PBwVj5HS{hyHrPnRSH!P3Znd@j3Rg-LX-<OmpMcd%2V-
zed%i3800v6fpT6;AM5d-?)mTU{C?kk<+y}Gh{N%hTm9x8s5AbUJ3m-5M~zD=@We@(
zDmRzSKObldoC;qM0?HT37YqO0ylwseVY|{%P>FTnW5kQx57l<kA3xWby3YT-^h02x
z?WK<?d`gR|L{3=?SUqx6E!>`^$+1pf?EmMF$CLgh^9bDfc5CJ5hl=-aJE%LmJT&k7
z!9B(1{c;snb2je_6FV~6Q$>A?-|{en0%gU9hcWM_UA)+;zfZuk*U&*?c}w5pb(gOl
zw_(vv-+lf`@FRJ(Dg0JK7v-)`WLj9W15^YYkvjK$dZdNDzK~RMLjb32`OPqE+aKYv
z597sJ+Bgf91$`@Cvnzs%yFgFt?KwM>Yh=Vu^>37)n)`coSyrU-DI1<uMd$wo`l<^%
zxhq)-ReWk`?z<2;zaY8t^|k6g8OyyJ6jF{$C`|DXmDQf<>STK=bWy;+xPV#b*m-m7
zelAcJ^nKPW5j(SoU3Q^ziOk(?ykgsmcm!50dYp3Z{Jqv{k#mm@l$suPRK76LW42ac
zfRXRXt|&IyLgkV>mv8<&aOKL(qpk-dxY;;DFMQ0HVJHx$|AuwplJn_@E==rb(~T5x
za=*hNTblP?zwV>Q+OltFBo|(nU~UnT{c!ip9<#LIJhi4K-4%VD3za9zP0fvts{)ma
z?q{WcKh>9Cdlgh~N=hX+6r4HB#*w|YI%dMGb!-VcCVI3Vvr+f_^w8}EhpcGHg4M52
z?*At$mX^jN(06OwKk<W8HCzhcem@r2)aSxp8*ck^fil09({UE78+ZS{`Fg#3sp>(q
z9}EvObk=RUr@6CHfcI0GWK*BZacBEwA=RLinrBn;@#txAu@oM5aSfNiBFA|uDla@t
z=JF>g2$tlen>!tU93J!WQSNrmV+;#jvR+g;T^H{SyO=QPER$1H-;!NbB6$MW9o=7W
z$oj{WUVY7PqaeZD@-jSb_2I_lk9U4vy~nj}(Sn<;^|m`&3zRkUj~pu6A!wDht#spu
z-gY^m9!96Nzx1oi58gYraYf-D?yHNgW+}JdVmsYf^ul4LwBM;W6VB{oyv^vnDJ5{m
zK>_oKO@}Lb5)Dkta-ZJ|Tz2>M;?lWyKW4d4x?lNksf+rzhyUhHy%(9eRpr5bwPP6q
zOeOrAPoK2+`!93Z=%h50Y~Z$=CRaSzteW~3EPlTA`YiuB459@Lhg>v|C;4sJ|MRn!
zTzzAG(Y=Z1PApk|_`IF!Y=QSut{RmuJGj<NTX<6Uf}phJiQl)f!~N$nNfa<R{Y#xC
z%-!<u|22gl+Y3)^-W~Tp{OKds<Hq50K2A52x2$=7=;v$G{js<9<=$_9&-=`K_eRq$
z2lpepofs8ZWPh?-6}_J5{^$Lk;<s-iH!!j*JegxZah}M|ql#zt3m#UQJpbm;TlU)G
zXYHRw)!hoeRkGsOyQAH**VmVC-SX$+#e0`;{@h=C?(grt%kQW*b|$}Ef9Atq7Dnb4
z2lsWk0=Ws71o%r@r1$%KbDy7A``Z4$rz7tJhL)LXlTXFOc+XLHweys)`tzA*y2gJk
zv2)c2?DH@8Gk@&o`cRku{_i|Fp`XIPnx~h){bJ$z>sw$=kAUJ1!=0ZJGejEu7Cde?
zI`hnzTkOud_3VlTZ5kXuFBPt}4QzAc^bMX_KY8B2?)uYy)2pOb^WWQ9@$liF#drJN
z>N-^Zo0uksXM6izl-kzbV%IRCoTJ3WTds1+eWM@k58N(HWai#p|1<UV)zu9wd=42J
zve$2{+0ho4{%@)EzbE&bb{-GYv3*)<F1M!Z)B9UnHU8h)`q}?u*3FhB+n%X?5|#9M
zG1bCe#*L$~PcK+XRH0aMr6`l^N5|tl-K`royuD>wz{IX#vZCq8j><!m_xw@5|G(J(
z{g3bVr=I^mx__0I(O;(@*DJrjWBzwHxGRt0AFqoetMbeFZ))G?w*BU`-IK5E!qM1Q
zDQ3*f6g;nwql86vI@h6h@Av2LFJxZf@r+qu)>-E13JPb;W-Ix9T-f?Ja%PIZ+CSUh
zSNiJDD*dtERr6BQ-;?>_{h!6n594#X)Ek*QCj9&OVw3903R_zzj*^(v%{rdmukBl3
zSX>fRyfCp_dit%mzhl>(n<jQa$&}wg<M`Y@$5nQ7xw6kc7Z93UpEtAq^D}{xiJ|A)
zPI1}(beDdx;&<eyh@gMVC%ZT==1{y)xc06Z_k^8S%9NR89gja<B$1k!t=%wj6T89_
zKlew5S(eR@t<@Jlk^edIgR%d+AJ5Nd{GXOKrzAgPg~tBcz7OwLow3i_VDYiv;`6Wk
z{qwq8{MN+Z4hna#bBPmv`~AfJgxa5VW&)pNrCd1<_U5%8P&lCI;ojnK{LGgxr~dpo
zx6RBzIg`&}Myi?p79Xj6t7#oI4j$ZIW!n#%CH%4%T~fg1BeVUlyz!~$XZt>_PpPf_
z$(Z)fP{zox>hJaVlcJwZTUW2%|EH%$ecy5Si|;p-d?`rU^FsX1%RuHsx1XPz=E20w
z@$;TjrvQ`eX_eho=NkJs65~vZk8~VvZLPmhyHCWzf<dv@TDJSGS)YQ=Vuh5RxqY|O
z{FJBv*lK1{a&PBi>;F^M|M`22_tTg6m-^m5nbz@Yy`B1b#lOjJ#|=XN6)PRyys)84
zVA6a0FK2{#6uu;8h$tSB?mB(>(zH`67f9XVuu{5UnEm9$VOQ6?nx~v(8YVEyhI5DY
zDSWYH$+ArTWa0YhH}htDm43#XKbOA?u6LPzd~*!D{r{F2$A|KtS4^rmw0E+<;IYs7
zy~p$OKX;0>Xzjmq@B95kDXFJCPAvjTx6`IH&0>;ubZ4=8)+brKWyzA|tGPcMVB}!;
zK5nD!FHptHvM_zd+&^`vPwP*JW<0sybMM`|E-@|*Jb!{eKX~Vsd-lMe$=#8g6!)v=
zr>KfwoBY1_Ur?cxRB88|b~iz%6$jE1FDSg=Fju-TahiGF9sNd!e1HBQjm!d@rstZq
z|7^VA>zI)sZsr<dQ*)WI<%!g<O&j|IA5V0z_xh(f*>OkhwJqC@xmDd<ASEzQ@2kPv
zQw3~_P8_0K*Bq<(OITzDU(B$tvq@BpeSG*JBS$2cM_HWn;$wjUU8jn#zy7}{Uw6R;
zsVl*bqJFnOf0O<+eOfT{p%YKi^X9C$YGhKSAeleUfn(v<MZV&v5B4rlZjuhS{hf1m
znQww3pTmhs(}g*lO9GD_SY`izievK`1)D#A&2!#o^ZLoSzq7ewWKz`^WUw=Do&$&C
zeCG=jvlb}7=(zC8bMm=2w_N|Tak96ob8J5QjPaD$hHKqS@&ZynS}uG}SpRfKwq&T-
z-}#*t%^#lp+WP6Ur?0=!>0>rkewQy~xLfaZF?<O!a^ZsDD{~VUD4P`tXw9*a)H(8y
z-|3pgg^d#~U&y$iDYZxc*W>H)C0n;mP;WWbup#fh+**YtWxBG4Z=T=D@pWGO+pc1I
zjp(Fhvn}`R0r^pJx@K;qOb4q~Qy<6L`ma|%v-7FQsuVCd@s-4+N^2?H`To!P?b)+k
z8>dygJ$1*bwu`alOSJC%-y4@LyqJ7?y3wE0kBYziFR;i7;ZU5CZYV6UDqoXH_MzL7
zrM#Dy$J^CdbSgA53luF#UU&7-OXHSB2h06(X8+^*xnr))HKFedFJ24#l<8n5kT>6Q
z?b?NomoI2A+udE1yWzA$Gq++(*v&PsOi#GExA0pv^{q%b*0U@5_yQ4`h7JFB+_g#k
zaq7jfljmb>>w5m);%r-ZaeG`k^Fy~@=f%9DPk9tnT6txrhPDYf9WCQJw1XW~*D8P7
z`z@+CS9eVlv%t4t$>j?J`<)GhS`Kn1>%G5~sKUWt|9`Ea^WySz^NYQim^qsL3=ipF
z5LA3p#=-WPKaWNBqoezV53g1R3vlx}{D`lVscCcDJ1ODGagM!y8@KJaaADy^-q#WB
zZtmH#QoT06MVL7%?>cc>DYazOoy;?N>)?Jtu*4-Zv$6dC-l}IjcZAk63p|@~_V2X0
zE7l7CY`7rauii4rL4MQM-(hE7>DwziFJ=k!G%%Spd1+=w$^Z8EC!H6+`drMac&9^v
z%hJ^@hgsIqeNVLLOrME2H|NLh%b6ooz~J;XRa$!eZ1q1?_KH0V7YMaf->+T0cjw6i
z3ol-7mXgZt|9@eH%7?2`FFFKHna!@K<SAj1b#&iyB;}Sx^|!aXtR&dl?Kvzj6{;>@
zc(Ebn`rqcJB`1pg^J~Al{$H%DAt>s+IGtBQYU#v<7cU4umTY%R-?J(=<I3~Y1Iw=`
zHZwcAxBLi8*sA02U7c}S;6+F8oE@xIdRrs5=|q(*U&uJ=;6r{Vy^=FqKQJZ+xC?kO
zElo%cRW-e|RQ9&HU)8VwjVk=Ta@JWdF1)y%zoBtL&1dthY!jZ|urPy$33W9hjeQ)2
zIlaA20o$i3?hx#kadclcEpn~({y&@E-ZHIVYq#dG6!H2uTm6Lc!S3koU;dUmWiC1J
z<GB9&J9#P`{eM2l{=Sgmy0dNJMegS>?I%1wE6h>i(y_3#Y<AU~#=Zs0FF35EjvRV@
zeWBDG$A$|@k_(QoD6T(0Y3JA5Q*YX3-->s6rRuuf{PwLy{G6H_pDet%$h3{GciNhC
zc`4p338}a5UMTQ;NIFPNYB1a(s5q}uHF4)j75A0L%y$Tuu*iPQyDGY9hr06Ozt4Pc
zwEbmhdGm3>;%J{ov(+^kx9$02!zy%DAvNgdoc<1GO%6-m-gl{TQhznAFE=a<+-L5u
za6xckL&|cI5aAaYDPWiGlIbg&zIyXg)<YM|7!JjBtEzqFc;b3|YgzQCdp3@HpV#N4
zR2LhwPI|NV@l5SKeiNTxcp>?1Vc??3T<68w5p8aN_q4kSzUY|H?by6vabRO#f%1zN
zla^?3-@f%g<{PuXs{ZNHlYc$qycreVFW=4hP_kb0=+qkfhubpsr7cao?roE*npB&y
zW$VI!56h<hKl#f`^25u=d$pS#+*^ut)4uLvmKA)#VO6v+`CErz=+B=CiFf!NPIULN
zhGnbVRXqOn8E2V5+>JekY%M9%kIsI#VEsc=lU?8EnzK7e{XO<YLQ0i;wT`*}hdQSY
z2ltjR&TFD-!T(nV$lT$uI@DXSeO2Pq9+}D=D^~2@Ed1=^e}<NtmmYCqWnCf7t1dV8
zDSBQJY}x<Mf8VF9iceudzqSSCIWLyHzq;!BYLx;hDOL`_7abPiIokz)7_wR&>Rq7R
z?r{80;Nk;LfB79w>|Jn#<<P;4hHGA*6%OqdKPK_=-rL)=m-)T2Ht||zSeEf+N_8_&
zxM~vfW4X!oE@9f8e7*B{r({Y<{r&rWU%37%el^De<wwz-C-|H$fTF#U)k>^Kwt5e^
z=KSY5ky+rEiuKgl2P;(;DJ;y-;pg<cy=<?Fv}f9-#+&lT_<HL;MuvA6IxqhE`}<ed
z1#5!uzj$b0_t&-dXWb^3s*;!d_Z|k_-`+Fn$-;~G-sNp|UM#=&Ji{S{>k9*09NeEw
zf0L!lZr;?lK>5y$gtapE|E@bM*uI>d%j*}jK%M}rp28QmuZJSeFq_|B@i5o7*HGb)
z=4nxDlV9g%e@Q*Y(|gaZdf9t(O?$RAk(<5ha{a@@k8fSQ+}rkvnQQ(o=eok5cl!Uo
zxL{yXb!Tf&<K-QdOpSdV`HE{5Kn2JJK~*Vkbsq(tKgHh}*%i)gj(Acud3lnxyuhy)
z!iOBcUDtPFOHOKcJN@U>!oVhz$8B!6Z#(<@cKlqBkXx8|Kl@AS#f$1)q4RZ?=v(hh
zl&#(W!r4({{i;(xj+_<t6an>@W}edOJiI&9(S3(tiOw98mq(tRO;EIDSoo}{a(mQ<
zLdJ#h;R10tmPkmgUGrg?_ZQPIsnY7U#ZOl(bYA@XUcI}UR3(GQJeIQZk_q#t{{P-o
zxBb(1=YK6eZP(u3^_AlfGP!j9NM^>B<G(o-ofarZWo}*4_8nYav&eR<`P*&Ip8l*~
z?IA<UotHE6w-zuaD*XE4cVTrr_ou1hhkwh<`_`Q@esf-5M8f{rB|hhNx0B1oH1{?M
zADh$PqVeIy`{X6p!#ls6T)4(D)OoSEe#M+c&$9U|`FoXE%ojP$zM5)ubc<3Zv+P5+
z3xXv&^Q=t4ZMpoNQrs73tM}->D0#u*^z=f;^SQTY&!4Z;eBp7)ge<ObX=4+w`oGT(
zw{P3?$LYt*&L?jdeDXiJKm6ZPAIDIsH`XRq@8x!8OnmsP)8P7kOHhyG^;@$phizdB
z;G`+MY0}Hf=ci9+_Fza9a&e4MD`Zggl;`y-yL2r)eo~>T@yeQW$5|SUI8MG_ZU5io
zp7Y{Q+Z`L-_sRS;NQ{3!@!z@9Q)@%M`YZF-{9!!2j>n-x;Kd2^_09>46kg0=$zzcf
zjCe8Aa`U?rf(D!lK23Z05|ei&Hz<8PxmcV-)=5)RDmR3uH!ZzN-XehQ;l1*ES=m`e
zNf}%2FR%ZyLV_=}Sj2hp>B)H+B8n_l(>xa$Dzr#Df~wCaQ~!UxK07<RQMJKfVYGgb
zz$<~{3j?hrE{nIMGuORx_$2jfPQmRh;XD#jy_MIlfB(jDcfQZJ*wCr}Ss6JdtF|~C
z_t>R;Imaxd7Stx|mDw>-n0x&^3r3@*795{-#e(95!c=Z(Jn!)-7npZn!gImGK-K?W
zt}RH)*rN3;UcmHc!Dkky4s+ShI%1D4*{zB=N<i+Ktoh|$_4RXe80Q4Zw7fd)JtOSq
z8n)~SViR2Yohvf(O8-upzkH9BU0FuSoyXI+<xh4zaj>P3`QhDeaa+IkGJ#uH?Jkyf
zaVU!Lo3GpSkxB6dhgDNw2Q&BdnP+D|JF~O&rO*!+0W|^HlhZpsFeF~^bX?&d+AXHh
z=Jr0PF461Fg%`6zzr3>lxBbWqu0!+ARZB0oSuWZl$K^DaNmkH_N0j@T&*aW$UT46`
z+2v#6!?(Mv6u1<8M685nOY$Eo*yRk4^=;vCQ_^ix)k4qAeOqd^=kTIWD)o;N<)xlh
zT;cDn^O(7uwZ&<MR-d<@pkj-cOJi0*upWz*+I~>96z;sbEBE6g>#tuIh&Y^>-&c1s
z&w^vI+y&kizJumQd)F>he3sl|pPoL|u3!Prp}qP0HTip&NpSS1uS@tLkaohe@|gM#
zLB%J<1`P(HFF4Gb`fi+XG~zC={Th0EYc_+Z!wF-4St(PS^>qp=v6fXTY%R~3Qm-^V
zG5ul*s*qmWo1FUkB{nqm##BZAcFQFG5*LovIZDi*gL)vfy3+KsZV@-?{#r#$J)^KC
z>i@bU><_DU_i}U8PKtFGhzsE9H46)!1}QXVFLGY&{$ia^SL23{3a2k*%uIQ{+Twzs
z;*?yo(^`+^?tr4EK>7G4m%?~Ax8J?e2SPtJPq5TecvAS8<*dK%^5FeXo@=$cF(=EZ
z+Plj0Pinfj@Zwrc&O^JW>s4;$@BO8E&Y#24y(OUW>ZDAw)u&RtDnae;5*FFbGJRcV
z&iENsH%^XG(Af|bI<283Ci7|WXP24#oELLH*KT*)zQ@3oO;L8n%E-B^oEOjKab9e9
z4{X{6se^8Nj|Z%}B-q$@;{>DZW>w8ohpt@{nIh~kV@3&&_2eJVIDeI0SgXIkVt=@y
ziB*1IQO1_f@9s{Kk<y+2cj7f^*}V*k`Bq9T*E*Rd|8j7j@(a`|Jbp(|c@;O;u3NW)
z<_9w<mRqr@$eH`Uur;}LD?r}bWY*-n=PzU=CwuYr{+sgj(m(yV7tS-RX;j=HsMzm(
z!f1A=smfhYeGTfUd~)lv2@3h*p00j@Rp8jfK07&c{|Pp~_<H3m*JNdUIrB0^R;u@>
zxQlPg(>LYqJXS1LN+D`DuQnH)xCE+29o;V&)?d*$bSQ6wfI?5O>YluL6TYxK{OJ*4
zXcA>w(&jdM6~9q~!4W>E+83Y}!xdxx5)-W*AOGLj%`SVg$)N91{*`05w(XT(mur9M
zhS}=sw+Xqow+XI!yE5_Xl_hyu=bju9zPqBn_dmPr!o|*aXWU$T{Ntrd{_pQI8#t`k
zd8k2BAncW_l&|l!cDMC0dA81r*XQ3`ks%$#y6^|Lle44y3y&$!zRoaRSZVI${=(xz
z;L<m7d;PdSMm}C0`HvxSo#=G+Z#uC${Js0CwiaF~sLU|Y{(O4+c`?4;ef9ejZwQ16
zgthWE3z$2(FVdMGJ~bUY9-E}BzPtSWWhaZL=>ZJ}mtW_qq&Hu<@|1I7c}B^X6KcG@
z>*9XOcJ0?py?Noqp`WYz-@QNY?#n7$s2sS@-c7*Cz3zp_j*0y;pV|5C_9r$^j^yBY
zD&y_0JY9WJZt1&IA!QlApPhSqtle$7@5a)MFD^k%uNG_b|32HqYb8{&<k12f6ECnc
zmM%y>I6-mx_WbS7FY`HMwDeu=+hemZF~dYD>imTlqJeAoX)|*yR4!3D9NNb0nOA-|
z(dk8p^g`v5oGphQ9$uTMs9@r7yhvNmKPFasszXKnd>fNpc^?|$^R^UZd^zy%S?oN8
z7aX!D9VQk8h$XCXbgu(VA}E*W%r<y<Yh5e{uYlIG3#Wyp+T7yfb}I4qcFD!&=WHv_
z*b*D@_Y+G|b03Q=@ANgzO<=da=#c&&W|w*C?cw%9DTR;~2i|Xf@af1r)ovB#z4d>q
zF0T;$&)-{j{L;%cJlXAT?fjvviCbU#b8wnJay#{<YHKyW`KR1akn5A5F7YhymvhZ-
z*x>o}*Pb>#{|s3vS<^?>pO-AW_}*(uo7?xbQ6Jwu_1128E7y-&@ax4YU;bX9l9s+H
zuk$qpoIqpH3za)HgXQL0x8Gz)e7rVSy5!zdPG0B5>cJ9HrC*+MHubS^a5LL+J8;M@
z1WmT^r9XVkEj~e7A!o%3P64-4{$4wak^niWUbiO;FBUGIAHSs}!$fHbI}^vrpCu|U
zBBZ`-w>S)*KVy--`)=#zG~1meockFM?b`J8(~+yDUCxVndS9_A3g$HTMgRJG&#>sl
zGdtT^KmLb4bl7w|Hr<m&_U4Jkz6*ibALY&;bM211v#a$H!@`)z6BnLx?sZ<Q>G|ox
zi>s>_RflJ0eEGGkH>~Ny&7GSKZMHnCiJrk>?sPo=&D{2Qk?`-w>g$7?c)#5<WlQ$#
znHA^rMoPH)&ED({+)bBQR$i*kzZ6&%s1w4-o%GYT>VEmXleUL<z0-NaXZg9(j^*LI
zxidq}YQE3;Y$F(~zU<GZ<ckOYeqE@j%lh+fZ?FG5bNhAcs%A{RIcLrd0lBCh_5OFn
zKj-!QSh8QX>7HcoE5XIeP`H>i;>N`bAKLiYoLuA1^*JBNFsZyNbu(kj>%t#@c5b@3
z;`qz!>)WPW)W~D6nlWGh-N(ZX6CSo4eQ{z_hqUwY9u2#)C42Yu_?Vt{ug>(m)3j4<
z#iuLoyD}zRoVau1?odhDnbNu!1likH@Jd_Fo^|iTK?jc55+e(NeYe$f?#&6Wt>qHn
zt6UuT^jG}Xy$6mzDo$U=`=7<1m3d+4k))Co*K;!_ZF{u+QF8m|@;rCdfWK?+tetJ0
z7ry7!+uHokOnv88ooZ3#_GNfDv)`U+74N<o(vq?e*l%TZEbsokzb^!f=kh6(6kM3H
zvEjp<=G;Xbf7i~kVU&55rQo($z2Dny@kaaq7w%p$G3jwD<Zo&$bgBPs`mV2W!qKFX
zE9+0Z49;55{-vy}Yx;Ec@9$Lq|G4`<qu}<mearpt&8W4hEs#&hT=c5q;>m-jT#mmu
z0fKi|t>Hg@Xx=ojW!ByeA9|Xbm)Wd%BQ2ZD#Ksu5R>0}(Oi3YuLz!tFQoUN{8hu9R
zy`NoHU{>rt`ocrhE_2ThmG|p)ZGC;$$L$G-OPsfTdwTvK=Nj{mvybZU+WnGyV$q(O
zZ#<J*VoSH~oh$oDTYuMXuCn(gg<1OI%OA_vURlr9`dUI36zHH(=-<6d?akfaOSVpx
zJa6UTk^20F#0x8tN$L}f6{UNZEe~8A$PyxPI-KphlBZ@qQ?~ZHpB>dT>u;n^Ihs_`
zvY*>-5vxh<(M^jEvu8K2Kg{D65cB5G`ODLE-&X$$sba0Vc(rxvd%4$PMSoUE#D&GB
zecZTs(VkPst*Z}L{W#8`b6CB<Kib0n>-G7U!}U(z-L=y0i`&1x{Z4MYuisCqiDead
zB?d}?-4`cb4BYOwW7je{+h2QDcYB`y<**{2`Bbl2=MrwAt=6wsKG;#|wm5NN8E?yu
zBCR5u${!!<{K~$~i`}7Im|Z68b3SQf+wN7G8fo*Yul*{WdN1x`v7M~OAK`SBu2_Tb
zFAukG*|<63J735*6YqLc#=88*f+e^2E^*21k>qc=xMJRGo`O=lj~CsuUbZ{Cxr3dw
zc(L5vlH%&_)(p;vhus`9m`hwtHu&BP{$5rpld?FlM(59O5ko0chJRb9h?pNaI<30;
z>6_ca-%tA=G+wT0p2wk(vN59a_O?6TJ?*mGT1BV)%OCE$TjkYv;;;ALx6_+!cb~HH
zn?BEO=HKV<3kr5x7O&bRr=gj2OC^N$>GVb6>!Z54{$Kp_^Uu%Q44rdwVm|!c67o>{
zvx2d6RWH-!SLKGboP1k6&h+;5o$0lCapHwVft77m$g!7~_uASXTWHMYB>SS`=1sGl
zf~&jS78l=5+^H$uyDnZ`x;O97WQpEes{f82pIRM%^5%Z?yqD(>8ZZCdE7kbAJz;Y5
z@2T(ZGX3P&6WA27rut)H{)xcKqnDf3POAU$?OSWHM@fLWb%Sy1UGMT_=cBE~YFYiI
ziU&6=S#<1ZSGUi@#@dC+?p;R>i|;bdT=ZP{V$-Fs+r{pkirH>e^T;Cg^9uj;1;0gZ
zWTqVz`c&}aMh!<wiHuKPilLQ}m626dkJQxShfeoDKX>kaEWyz^!A8*NjBE5U&v^|O
zUp)R*bu;7370zg>-dT<H{_?g?YxXqNf877CDES&sSAAAv{(tA4R`U)VIOw}HePe`c
zJKr9~<A1M+d@kpZ{OI{-`sa5syDn5dFN^o@Pw7)#cz5!%XMf(_{vZ%l>Y^*if4xRw
zms?=bksS-vb}F_u%@YvmQu)<>Gty%QgHPG@>)WSKd!)T%>#`RbJ0{(mV|uq_;)gwp
zn}23Nvbx2Oq>_}pFA~OS9m$H!4<p^#8|KGFPOwP~SsW<)<NBpbQBk)f<ij66p1Zp~
z{!hNQ>Yu}|L4SlVxi+{s<~9FXZP0zx>-XE~=1*Q^=9tv8@7T6Q?8)rUPD}Ren<`^1
zWS7X38z-u_Kt!3lEYI9A@1%Y0|1SrbzgE>GS<RMP>M=!+oBy5p#<j~QGdS%Q;|GW2
zrv=K3AMf;>%(Z84{Ho#%NsjYOORpFi2{ZARTw1^i%KabQ7E8WdA+xI2?P4A0_rRm!
zY^T`-{zpYeo%WIzex$wb*AuxL;`?(nbNv3g&2Ftf#hQIOgSkaV?DexPC-b-PeZ1Sz
z`8cTV*S>=P^Q7wIzci(-ixoAx<ZHO(;PDkRgR9?}eU<*{u)@dS;p=_-7B&A)HHqE!
z<>un{FNzY%CbirTg^y4BTkBQJ+rslZ)%D2D_8z%)oGthC`rIBmxVb~&@z0ah#o1Z*
zEMn{BX<3%~{{_c<^MYFn+$V*@8y(cXCb}&?-gnAv@zwtZQmjb}Wx^|dO<`&|RkiwI
zd=k?lg(CiU{t@4@PrR9VV1IUV;9uhd42s=Hg(TEu57<|fdd2J5zg}2U?bL9X{pHG6
zC)j10eqDId`SQrE0}MO%XNbN2@b$_2ePQu#e-5$6el7jtH7j`1nVsFY7C02&Hx1q^
zRc?Oe@t#=@FTS74m~!;ai5DmCoVdG+&FMII@Ny>ZQj<G|0=ML?e(_lebXh4*IB)gp
zdd3#*nu9i`0*{g(Ectle`WCBj*Hp0w_cvd=w(XNqV|`^ipNh`^+=dVN3SO;_&7XGb
zcOMlB5Vxx{Sydmof4$@WrGJu?&%~Z+{9*UiPW3pSw|>B*P>tfVTB*KQ)?{k1?R)ih
z>V!8>FE4kn_?kB{Sbf`*=Yfj@k9g0hjF;4&9{M}Zb^q(l)5Ipo<>V9?S_q!&P^j+F
zPcr`%7ya+s+P_CH9m)_%QcEd;Koc>ms&n&V<)pG|by5_za9UOEw&1lBa59kE%EjAN
zd&utpo2%S6Gfckr-(TN&!LCqD`y*$EM&{R3`_j)Jso`Fhd#}GfH#b-Gsjp|}_S*H&
zWbJ0`NQyj>zWLAb9+@St<mJx&U8FNDmMeBjr}sXuUulK)+#hrqCUsprlNH?V?tOy8
ze53Q1bmNW9EtPxw<<<2fHRfuUoZ&E;d#QZKuX#3t8LL*jYs)d|Vor4{SvRZlabmK2
zTd%CD9{-Nn-(H{Jak=B<<BwBkoVU;J=~-aj+SB!~%$irhB>qebsHp7e`=;XNu3!HB
z)QgP2Z2x##%-oKjK9o^%;c0fL!WY?Rzjo~NV>)ywSe-HFloYGu<m>C+?bN@uh2!7W
z?f=F9uX`$QH)TgrWykO3&29A#z6|PVe1X+DUVev;B%gYp9az0ZOd#(1bNy3E8ym7T
z&R&h<Z&<vnVlLwb+cRf0Y%6tg?r2<nF#pB*IsMBnn9En}dGW4mhDqF;30w2FhDf`_
z25Kq>G5&wiHbXjOy{2_(lT_~^5tE`@DywZ=3qRW*Z!7u#@7m$pXKJJ%5tUN1#o5s6
zSKZH4-yk98g^i^bFPb^LNDozLnPq$_b@9aquek)gx)0w;zi(Cd=Hgl=7W+HCzB?bk
zXaD0JwN)lw{0F<{RoAT_L|v^ei(Jg;DhsygJ5<5;<9cN9-=Nc%%>SQI%nso$eBW19
zcQScn#EUa76$*2I9agM~JdpqD>&4CKN;mF)Suoe)LPe#$>ds52h1X7f^-7*AyQJ_=
z)6Pe`HI6To6phpGHCMLQI_22Bh);9wqC1bj*!Q??&uhD=q3iwV-4}b;1&<E>txlaR
z?U3V9P|v^f#S(cAN!gpq?H4Cry!b7tU*^7Rx74Oh5*)p&q_;5~VlYpC&6Jp$(7@8-
z;Bx=re2%WguczwI>aPFAA*Q$3U^e4F#WE&QkBWPHYW}_HJ?Xq9l{xb2;R(*VbrX(C
zy~}D3Z(4U^$@^&voeRw_>_2v1{HpO4Hb>uCG0QL9`n)Y{>qhk|ud8}Gvzo;+cJj!Y
zuG#PHv_QW0#Ns(QB66(%W)|P+?LNA8rh(Mai;<C?r{=wU&VIdfwePR8&QI<>9;?KU
zocX!s&f_cH>-2t|VJLBx*O@wf^Ww9O6LwC#2!a=*l1jcr@7ZCf{yd(s<++TE$XwHX
zO?Pr0XbZbE1T5$3lbu+{?RZwV;7~;CUky(u=9YTJ%?<V5#oynr{jl$o*#A|l40il*
zEL-N)P!}GYe1`wN=Eq;tIJXO*d2n!(^um&98>?7v=>*sR6co-Y3uQjiAsZ8PZv|h)
zQkDN7bWfFUiBM<N?dacOntFKBWB1)z*#YW%Y9Go}Io_Y3oOp4%+B)|i-K+fF*Jk+0
zNAMq(_&T}AE$qhRQ+Ge<_6ODfd${-QCf|$Z)w5>Z>gtwz`pm?wjd|+onspB(oh9}P
z^*GK~&5^UdzIT7_`dt={TiYf{$nK1u3Tpdb{P?Ti-cCbP@|Q!#HlBvQf5*(FL?<^2
z3G93EuJ1>Z9IKO8Th;1%<K^mqwwaXQpU0KIe%X<hzEh|6E%&z<`9EcSGqa+IaEoYG
zdGO`0Cxr{diYBtnmP;wLsE#cNi1swJ37k^@USq++9<v3{UDxujeAgMT&(ykayOHGI
zmp#W#uU_KUuG+b}W{>ak|DFtz*7be2vO_qoxX5=YE$Qse@8I~o;KG%A=gw_g<isPX
zG*zx_LEz?Pmu;1o`(&IvJ@x&Ar>FnCy}e{=hz3K_(w#cL-fc?!K6Q6ybEoa!*tdcl
zpw{(FX-V10u!D!%Q&V|bCNN&Oc>QQ5$B$DjXMes)&0l}Tbk?`$RcGS@YJZsX{+PbG
z-24Oo#m{f2mal29cUu2+*`{5yC!Vs6Qe&{c%yIhJuG)`#+OB)}Y}vZUXUY}3o*Ped
z{(L^SlzYZ0XLXeiJWDN)s4O@u<iTd`oAT)3<jwnK4f@@ytv|jKs*C#g^|+~NhLY}$
zy~^dMk5zMiyb)tux&G0gNUk{+rnPJViN+TfMV4OOz5iQCqIp+RY;6X|s|k{;r!}XU
zR?fJmb3$g0TI|WWr^T0w1+3bW8$ECP_KDpuzrU#d<+8|em4f;7VEK9*lgfT@N(QCo
zkBj^BbfUj~_?FA&RPBCT`&^%*o4m4!+v3u#%X-~(5AK%?eq8@oHU0d$PulZ(KNh|%
z&r2>zfAE37?8EwBaSk&KTvC#pb9(--5UiRf6Y!mVO0Io?PS}+*D?MZ#3OQ%8v+myZ
zxLD-)qy2N1N91WSNqi|g5vQgRs@ZD&_s~u0Lr(MUYJS|icxQK^;l=rx^S3{`BbmUn
zwxrY1TJyQ>@ALNs4LqvdtxuiK(APM|{qpMq%`Nc?GPZkOTwwh5iAlx#=SOSf`P-{I
zKW^CNxczx`ubbl`4^5N3(z_A`Ej?Z@+Tt(z@w>r;gZBKzdY2wQ?)R_#a<TfT54dCZ
z;>3%L0NLL^9(QcbzWw@@1jk!(S^b+Dl}a~m?K3)&IiX>Lm4yex!kMmz9=r^GH2vS4
z&DG&MuUr4w9sBW-=lKT@<c0JdX7d_eTsmFv0n-F~!Ho&??w?4sI^BFQOjaPZ<jIDw
zvyGQ6S^tCArO@0g>h1Q<kdlgUrll^nyi4uRu&<Jzz3Yp*)VaPU=@)^|Llu`WZn-&U
zPD`Ze#<iAv=gw%ltg~`qyKwLHFM$~{txLIL<4Zi4KL_k?zNz*!beGWLa<x3(zQq>S
zOZBUsh9q3S)>NaTXI(2)zr=0vmDO&WkA`gOWqfA4Ze38GaFBS2p#kRx9jgue>EaJ1
zpS{?_%<6O*)YLW6GB>i?B*AShB_+Y}Hc(tf=7aV=#@%k67c&~{O{Gj5n+{%9JO2Mu
z@V9q!pU#`!Sf48@s$ZpZ-2TPk59>eiaW$k)*Z;@<|JnJaM;&5pQeIwulo7jI!OdN4
z0pG^Q=cA&|H0qUjczrA>vEe_emk?Bcc76rNQCF!GeQ6<=r!TpAwUgORzr^`VT$1@O
zhZf$fI0mbbiJlsBxp-$v{GS}Q=-;x+SfwX>?G-0B#huyvW5?{vYT4`D_t~(iT{P@w
z=L%WPz0dEtWu~m?SAW$DhqgQrnEc_Yctp>0t@`8f+sodwOlW2}tlqQn&HbyX>F%;W
zz>R!WcjeBD6L)^xu{in4vEI48y*w>t%cad0wZ0DfDy3^t6(N<^xcB-05Baa2?3iEA
z@^5NoTvkW7D}(JT2{kT`up{;+^@lRq)Q_&bSUYP=k>#rTe~U%`Y~JV4e0{BZb5Ea+
zNz<YwX?!J)hnBEhSagr^nc=K;THC+93zL#+bbFD%=G)$1J5~v;?YzOlYBJ?tgUsL9
zh(nKB|4Te+KCy6%`@S&4g$@c0yt=16dDP@IHgs_nm(S2za-MmPP3F9oG~VDW=cysJ
zXWc(v<y4!0Lh(q)f-1uRfs3t^9;*L)G=){I*Dbo`;)@5TZy$A1NXY}WEuKtLKD{GC
zVtZ}%_rvXMY==Jg^<A*^bYna8dfmBg+Cow1GfK{Cz5MQUAfog{@2?jc590H~r%(OB
zZ`4?SzOkMmaEeT0{fBvs{|>$psr>#c|AN|9$7gP0I@*F}4F?UpV$}E?WLMR^s+~~Z
za4zW8s-{I^`>Kn7iA;Gj?@s=;KOc`2C~yVO+P7d*y4nG@_>~{Ovt})7X+0O(@}SZ0
zqqEnVq+J5Fj?0x2uXxrUc(_wZEZ}M0T^ILm$Aw!Su$e91-geVFc<%iB_04uZPb~#Y
zR+Z#*IdD5X*n6bqU0c;GFMXlUD=)54ySMo2WwnhHGDI()&*|xdK%K)2A9Jd!CnWlN
zcNaEZsF7rl{hPzy(zxzin6XspeBCvlmuT1*f8gIF^52T(-@^A_bpNfb>aJ%@cITD*
zH*vYriL+Mqrl8nN5tFxEGGon!`O1HeBraNGsmhsH!m-kM6^jP<=gddPU6dA0N^Z}L
zl>4W*D1DQvz5nJXD;)TCg)VK9V3{2B=EMDE$E}aH^D_yWK2|+-zAE6oFoWpc>^U4q
zJ-OEXomr5y?Sp6W<}Gp^9p`*9RoALMYM82Vck-@_7uJPyJ>TNfm9_BM3uUgJSL_R$
zMfBFp%nsvhlTUdl>nYK@DwTO!GN_pkishRevi`evslC1ZeaY6+4CaN57e21)ousbt
z@!N*2$2cCIR<a2A*?RKVkMP*mEu1^fDO4C_UhO)e|NJ)B{}lmwylEm^<g7Mry1qVm
z(uJk-=k|3KS#&R&x6G{E@g=9r$Gj^BG8#?){J-XTG&@u;&)Gb4VxRAY2|w@MD7TsR
zYw-eM(TN|=%h|G+9z9pwZoGV%s8&zGyNWoW9L=f1iIbgs-7=4^SF{N+e7MBb=2qj+
zJ!?&i&w6F5dKFwUx^>Bu^>o;li<c5ld_TsJ)F&ADJ4ra}7uS)aliRqmj-)*Nmt_1f
z^tFk?1sg-FO>HXRF0ql-yrNQH>#8q5A0Ovwd3O5LofoOfivt%by!I73v`E-x`8wWL
zNA{nam6dW<xmc<E|Gn)$wih@a*m2QfqU@>jS5J0rUZCUVULf+vOmlhSE`G<i8>%NV
zy?ap-e`e0jSL+*W6MVe(`ds+9g45*7XZ7#z0v`w8xTMe$+uI?rv^i2^+53RfDS}f9
zM06K$E)L8(wDJz$T7f2yrNIkMiY?Gsdt}1Av<Ue{PYT6%&Nf##AaHl>-159;hNV7E
zE&&IYO$}pOIiL4bt;c4EG=*ISQ)M%*URhUi?INSk3e7`Z&eNnp<9s{8t*wt=HYDb6
z+_1X4@dDcmjY;Y`8ufQwogN;mOn&yIo%QFT%S;d0YZ?BPmX%$*Vxp?5RA^WJf8Ud<
z+Ku&%kB=ur|DJwTHzlH{uQzaF)(3@WbDnt`Nv&PC$i8_-t1$1J7e8HA3d|Jah_1iu
zFRN2~)aYnS8<%gt$GyqMqCR4m1r}-KGVNKiZE3-*zzvg`6m4byBx@Kf?(mwOR(Ro(
zs*i7GihYuzL3`&zpVXNq5<eHM=5Ca?l)l#OwX(70KRe@}l8hG%V58B>ix(eX5f~{a
zx7XH|r=@unx1XQl;n>`tw>Qt;y!B4%qWzIf>#CjkyXv=Y<@$GU!n0?G^qG$LALVnK
zv^to9t2u0mquAod1>uaAKMVsuxHXDhS+BFwNN{mr)Uzyo?NA&0#+r;zEWv>noE9+6
zeJXs^JV!6}RIt>N!;Mq&S6*DPqMPZM$$Y&tZkL3=nwVuZX(#<!q8>ImJW%D0ei8G;
zUpu4Crp>cxOXy$rLZjrllC;3t6-$0z_Sp4k4L1iUGC<A3b~*D+=lbO4mVZpT|M@vj
zOY?Gt=>JhYhC+s1E8-K2?N;;fINW4xn{Oahd-Hbp`NsP4$&<DAtbd|tQu+4P?D$&E
z59fDqNo<e{6f0KNiO|@x;1gTGmCMB(pZy!1MQ*Q9R}W~{+cRCjU-^eo*m?)^%=*1k
zERv7E<=QZL*;chZ1xxN4gnIP4ZB);g?B=pSSNM(kxfTC9PP(0)7L_2KF?oT4Ve`&%
z@x?Qi?VQUZAr-Mt&+pmhIf*+aUYvLoG<yAFg*^B19!9Z!GBP?T3OovKi`jZrMM7R$
zpAmJe=cqY<XWv`hf4Wf;7LE_*Z+!Zg>$${o#$16^L#ss>S}yK0f6_30*}l207c<1)
zPCFtX8(WioUhkKE!?s6@W?0VuXB?V;aPzgWt_c21mnYZ=em`oHn)>Wk=$7!!i}(0k
zZV8U{4pA&rkMfy%(<a6<+i_poLVwOX%eCx3o13nk$UW)&JkM!1&e8wYoilr23mGhW
z=H}+!{NmA*liT;~4Sc*&Sz*tE7a7ZVSXz`S4?W}BA|~wAw$!f5y1_xfx>zB*;DTYz
zAqfHQRvD4Y9=n%WD!DCwqG4M(M~^M|;!%zD3zr6`YCUEP4rnYpbu}qU;;Tcav?9;-
zi;hWW?jE#j7xNHJTfC?JS7LFH(yG3u@J!9E->Mp3K9WmVzx9LIJJ*{Fw=ZUnU&+nq
zbdLR2>cKgOjGo6cwK(Rru{(hr3v%k?(+m+2LJ~h-J@sy8T-bQwV!N8Z#7xfCbvt)*
zY?fp`d0n*NUCZ~=A8i!oY2P?|v!Hh2nvRc)FW3Dv%zf$q@UffZ$6u58Me>A;b~!uf
z&)xr>dvRb_iov%f-4k8>AIk(JgdDeApu2hXzCNSqFK=d+IQMX8eVdc;FCc2>{>S<v
z%$cf_m)*X6!lgm!T%KRDZkk%5{)<DdleN<4R9KvFTdecUO$+4GcVVd|drV5THVC}`
zAjQYQ+t3$x&WzP*R@nOc$;TMpus8ml!*plPL^b)G8%zqXpH1Pcj5bep;9FUB%0N0n
z?O5$J-*xKWKA+!IA0PbhyXF!81?R-99!=)2s<?N}S0iGtBD>j@n;WF8>-kKjj&|q^
ziN8pSNPYBk$@IXYHyyWJg%f#%c$<C|DD7I9@qP*W2mjL<Una)P$ywpvD>8dE*Q8I4
zlhQ72_tw#PxA8;0d4IqCv?ZOMIv{t0@Uvsuo71Paw=r?^vb3-{9QXDsV`&k1k@4c;
zeEA#i@3JV!l-!Ui(a<dZ+GYO4!N%cF)6V8f$?avi`TDwz^2>f1U6}i0;ct<g``@Cv
z%U12#`{kOSdXM7*rn{1g)wAZ!xmtHU!*{*e1^J)6UcXbTGgmS=Y5FuxWB*<Jbx-X_
z8{WVrZi^jiuLy0vw%+xbU9RfUQl(Ff%)Qed3Y@+?lVPDJc);5nH0W()RkeF}_^~4y
z&%F%=qT2e*@5H?6;f$^6wdB%xRkxzJ>2K4WHaotJLi^@i57lm;yWq7@@8af4$$|${
z99Y?AczTP~y|7F0co}yjA<nsC#lP+~A1@n7t^M|~Z-&J*Jw3~+9sNfH66^domU2p)
zzpBgPI=ZK?t4P(%AZ3ZPjlFNnzr+U<q<XgrExs7Ockj;GW*q4kA01{-Y+-&a`^0&R
z$P;CEyYkm+KDtqF_MbX*qls1K#ETQn(B@K4pI!0usE$^imJr9X$jw|OrJoA7W}iR*
z|H|Kc592@V7y2JDaq{uY9?T8wZjW_5e}vew_%4sk4x2jHrp{b%nWdrJMs_te@rwzX
zt?~ylFB|Q<%HlMk|KD@29(BpyM+fdI`ZVdCyZeJZ?dOV%8E@wJA8ooI$n?$RRb4@=
zqmiPI%T<q?vGM-@XF2pw@t0CMl#!vhOe1mi;td&3rf^<6q&RK;>di-cj)R70K}Fh~
z6E9xu&j`!~4VA?mJaHs%uK;6g+2Oi#Q~pM**|p$6xPF|6zSz{b=@(TplRgE^d^dT=
z$7fqSH5~RTy7%7SS~oXgT8-=Rds0r$I=f}7^bcK7P5b6E*Iz`Uzp9<d)U@31@5|rm
z{c>L2OE;ze%HN;Ses?l+oteZ}mS>p~z2|17`B}I)N4#KgRL~AE7cjCa+OD-&xmdZ|
zyN}U(nn`LpKbt^YNlDH69*&lMOdM}RU+n!No@U&9sLmq%!0v756~6tHS;W+%su#!M
zw4?ZEQgM;cviD!!gq3}|(fuxOr?{b(P{#5rn+$?FKJMA|;B|p{<903$j^*c~c6&|c
zJZ<Zz*|Io~@$Ap!xn=@&dp&qvlUC{eU#~muE?-w#{uaK9t1oJ98Me9ix?L=oy`f-V
zoAtRlH~X_!aZWE=oV98Vr|iozeZ6UR;a_fQ+}W&M^vJ@d{mZ^f({-n^Yj$4L;Nx)+
zD%mnCBJ7|sDDOe1&o+F>i<|ehG2leRix+PnrF1+oDVVi>>xO{P@4|1|cio?G#9pjG
zyYS-l59jw3zjP{2aw@NtU8~G!uXE2n|FqkyGo5xpOFy(u-1co!(pgWlGtZ8mEuL=H
z^E2mJ^Og|KqJX<u`r23bShGk3To!SPe74HW;6d-Tz<OnioG%5o^@4>4Qfns#zyEk8
zP^I~h8?W>A)oytYKQ2y8c3ZJGD{4tYMbRC*ayK2ZJi`_L9?o=Oust9>rMoSf^Mr9&
zhD2{!NXUi#nu>odj##~B$Vvib*C=<;Tw71yLHmC{7Hqll%^^dlMC7EfTi^x-=gX2`
zTK>Ac<S*`Yp7%GRGrpG5qq@ERqep`PL)tHaqgJP<{Cj=gU;fnDUJYih6D$W-?Dv~3
zZLR%YLEb58&ky})na`dj^6)QFiDl^O4f3<HGIorgcGvIUHeLPswu?*6T=Y}c$7}1I
zKlAd`B;|IKG})7ZTk7?*YD?IEY|W7Bb@P*2AJ<m!^A>~s$JmvcTU71!f9_U2wYjS-
zn5#5oh1}z`%*&al`0u}}@?KrPQP0}SfD2Oc7+FPy_w*e&<o@(28>^G_0%f_3Blmyj
z?>W6<$3MQ$4IOn8R=p^Xz4G^;tR(-M7m=4=H8p>z-jll1B;)s%Z5LlGp7MUbqXw&P
zT%gVomFQFb_dRDeZkX)Yz9dBb&D%E)%_~Y6%aa$SE}wQIW6DLHeRH=haw>Ft_0p+2
z#<aD1|NKc;Dt9~W>XBM&(D`chEw{xFJb4#ie6nQ4%it?__n$hWctbj$QK4a@p%Tx0
z<|~Qe%JCZ{5B*!)x_!k(jeDsA+-vmQj%%O0W-gU#Xtl|mZ?W=X<?1I7l3#2})h&M~
zA;^*2&}V)_qct^U;U{IIM>^I5)_FTGzEI&^9C$&*O6dN!<&&J9Tt0Fp@d%0OO(+xV
zU3?_=Sa@%rL;wqu=bx~r#YZ3AW;`VN?(W_DrpiAQYwl=Vu55mBSj3?<#^u4%BNbON
zM2Z_`xh=MozIHj%&Sq)QRR2cXAnUC$8Bc5PUU!f7Ke{(Mwx=&VR+59=3zBj`eN1&3
z8KvuMU$0o7u29n-;Lk1lY>{dk?=(i1MHAf4olp$_5LHxsp+2G{LEg)AMF8iiO+Ka9
znO9gopIlu&^^s5oznSrheoZ&cE9|U4UtZcK!B<nXKQij)nysegkLSPo=XPY7ci#eo
z4Hqp-J15v)iBc^Poqt%|{pE(KQMQS{SNgfQFstW1-0QaZhCuS<S!yP)ij?f!RmGmV
z1S-k|gl0(gCcXLa>`Etdp_Q9^{a?4mI&SWuMnFnl%FM>rxu8Lhzo+6E7V@>e5bhTJ
z{WCq&yWYvnibaA!MWKZ6noioZms7T|W!-OD@?+Ybm>Ww)WbgDh+OGZ|6<_6KCdKNj
zd3}N0(&p=`ZPLHz*)4Q+vY6}P>J;)nAZ>}OYtONn8zfi@UC+;2_qk7CP5%SCs52tp
zTW23N4T=BESb1p8)-N{%m&82yb#T!sr;qX<wuz`Y_PQB9*UX!<jWIm-Ba8asxX>OK
zzF7tFJH(k<1W#~Fc3d{JI^;D=v-@J9z!6Xl@ZyBk(<dUE3m-pTrgpmV!=%ZRb==)u
z+t{4qxf>>23~Z0^NOJH`I2y_SXCAMx-;_52OiqSxk3K%mvEZ<Lt0Tv=o2&NhHJbK6
ztIGV#r^MCfPY%p`R^9l*Tx#hDH61<GGtP`%dT!Mz9~Ux<bQwr!igE__?%7(sT;u6N
z4fUN@666!vR|Rh`dtY(ynwHsepAKi^jR8^pw^m-c>D}vA_(1Q?EBW+itDbh;cX+HV
zRl@!KE!%M}b!n@<3|&L3d5Mby!NqE^^5Vw{FSl$iKGY{`+b{Q$-RZKCgjJQbHLt)w
zL#v`!%?#2k_6;{5G%&^cKGJd0@$oSD_4kU%Nq<)%DNR;qFZMl#2NRg9`ZJGYgxuj{
zyLae#-=f!vN?z)6@n65*?e1UP9cX&B%4yf)v^{U<=vbFJ8L=LnF@Gyp<ckk24|}CP
zUy1SJ&tg!X`p+Pd<HzxM;SC@1VtkJ7G_D9{INv6#7RvWYa;CJtg{6_mMhV%<3!s7G
z!hnqzj<QDlShBUWpy2|;ix)4SSU3b6e{teai`=P(TT4|w+k{U^wCR};$Skz*N&a*W
zt;u{hO8H7c**z|YDogivnG~P>y5d3Nyb0@$n<!k8dQlZ%@-B9ja9CC4qiBxZ)1y)x
zBg6KX9x>Z;PwT~c1`qx#{1-QOvBiFwc<lWDIg_S7V^QdS%DOm^oxS*I3}`VCX#AsO
z%OsmScY?mXt-f_Fty<yA$=)!>;{x3tJr^go)>y8T)6lGW;~{lC{nr9jO;)D|dnNzA
z<f#(lkx{aplgFI0>0fN{;)`=~s{R_RUgEN3(}gz+Tn{bD7rT7a@ZDyChYnFb)&iCN
zyC-jmESVe?_~Z5I|JmGGRXc19|7s|%C|VHK>6G_yUhEc^%w6{<9sN{TX!ZC(!ZHcj
zNJu$xruW*^;~NrR9`Cb#|7w%1z%4P^=7ZikZpXiC=B=}yWe`}l`s4T9u0E%i{PU;C
zSkL+V{Cx(;oA-f{*<qe@dqva@{;<7bxZ=sXbPA`S2|Jf*qKVh(5@ubCYaL4Sey!Lq
zxF+OJhVA5K^B*4*W%idk<$l}rW68n&A%AraZc;70IGvekuki7OJJ@e9KYjH6Z(y0&
znS_F}nx+eUJzi<+<K2_*N9q_qeg2B)(&k+=q$7L!K#NaKyvW#hjz^wP=gr%9W?BNT
z!WX#iGg_ng{!eGb&QJUOP4D)!oNWtH5W2{eW!K2qlNKhe;d;ctgZ&$e&!J$Jd5bib
zDIQ};KO+Ayqv;9r#<pvmuBYa=UCi(>uw~uR8YgtF^#Gei%DtU6f{XJk#FyRuBHeqb
zp<?O5sdkDpmL8Gf?EGw&e<7xSk;V@1rYF}=xr+)UeN^Chw|<FV_Rfek4(8&2e;j|Y
zA|Bj3c;@DIym+yDdUeH@Z(sgMH(t0u^=041i>#fjsmuKry}KS5=eGF9ix~O8Tyh;3
zm`)iN2rsl=xGQ6kO6Zn){jRj8$|c2&pEo#|Nwrq1TQY3yaQFZ7ihIW`g-?w0v_DiW
z+|J-HWqZ$<!SZB=h`YC=om8ahb#>jy8+UIgtUb=7vdiJOHEW(D!%oh0@fn-CYRbe;
z7u+*mU}P;=zIqdA#TIDj;C#RA?D~&M@*f@l>_6@2H%m&&;l*iDC%5C}Z8ODqetYUJ
zNU-1HvTD2Q7kQ5!JCVXNwP&XsGG3TowUKoY%w2s&^mA$a{9~-M9(Hw3Qa;tTtH({=
zX2Q2OnORP+_CBi;Q7K$`$yc$+xhrFO$c}n`sbF6N%Q<N-&se%sE#?-NY!UyET#{mF
z4q8N_?49s%N8y1()A#Nb;W#^e;swEz!ahkoeJ^etNx0E|Nx_sg*RN;#soJfL|DyKI
zDqpH;tu^KAlCx8fdrg~Kkg_l&EzOPTmhaj;ldh(DADEUpZILZ~bL7`|JLyYvmXwIR
zxpOY&pwS9F%bUsqMccJNOTZ?w%SO(dtS<iR2LpF0(?Z4z7cbwO`Lk=MV8>Sj?a67J
zE0h^;dwUxMMTm>6h={+${P2_J{rbgat6caR)4UkJUR~m}()Y8@%hS`m^5#f*)g)hR
zEMT=2brR5j6Z&FX#%|HZ#!2r~k1Wp96g1tZ@%3QP(tm%LZ>1h}&e&3WtSj}5s7~{%
zE(36r0umW-gTm9!?U9vRCk*QUDxUHCUv+R6tJx%}hU=FmeLlWx#mwNPOWOD7O2_Z5
zaMUg`n7wk}v&C_9cBVZ&z1;uhxu3VUU3h5w>Y=9C<sQc*lUb{F2EFc++xq0$g1pF*
z1bHcI*3OrL+nnsxYqbun@c108er0;~9JdzcwQIz3?x&sWG<dQylC{;lw?ZvaN0}>`
zJ6%@Br*r0nix;mYm4H@FnZIIjVqTCuL0WjCqNruvmaW^mB+Or(Yb_R;Z*Wh{G<Q<k
zRlz`(L%&+3=D3`nwd|YA%blwOU+k{^_vW{5^tL>wELPVAy9*6BU3}4-aF+2<`r5Vq
z_a4PNTs-)9#`nWM%GaX9Pee`WaTC4w`t{33ca5wip?2W{xBBe0?uT-1Sh4%jud|kd
z7JJt2=qNj!l-|ZQt?=plS1eC1E4sPMf!zlhdKGvTrXbzRx36vYs{az!)oIsWiF%Z3
zTh<7?ym#r*hKYGUB#g7Gj(v*v?w4cxvqkhCljt3PzfIS^w)FmBQMEq1bN8FAs}H&D
zxY*v(FV%K{Q)j_6t&{QkT%nS^Ts;%}j-4o|xxQu6{@=e&{!Lr^D7v*ua#exGzKg*P
z;hFcBU3Kks)7*UVy%wWT$ExFM&$g^h;=NVaIPsF^gr5gbzSnuI<q^VB+5wu>JPKOG
z^I}CfPfJ~nNftLp&urt}&t~!e`WshL`nP|Xl=S20yDlGR64wk<a68{MefqDz<{1J@
z(;XYVV=P5=QcM~)Y*c)^{QXqZz`qi`+r*w|-=5{M_wtrqmG|zctz`+@d&x-3HSeFp
z_TXi@e>ta_ZL#oNTmB-j>=jGd4~03eSFN46!8rSF7AOo$51;)x=dpr-Lb38<<!<oe
zfk1YFDl1D*sU(LNuMas`G&p_Lf4Y0UvU=ateSC*Kw@3y3KKmqJ?6U8p=R32*4y>t|
z%MdbaW*@V0(O=soieK8&lx&z7rkd{fc#FYack#t)bM^jueWzyWgW)D(@pq?ksn+iG
z2$)%t@Gft`>hzD?&+OK%T(-<;L)Ss~zzdW4HfSg8dvZcCr1@prvhEgz6jR=$`ajM|
zD-tB5#NSA8NP_D5qoDScoTUhd@97CIPMj1D6Oq!qT=#F`pDUbCBok)w@l9yDbD-tY
zDT$VC)2CfJ(lqDmYm@S8Thcn`+aHe#m(%TWJNZ#TH?;b1kLCi?Tk1FO2K?_=PdUTk
zyErf*?$mbgd)1*56AmZMdNOZE!9n{KyX6-LZn@6)<^84&OE1>k6IjpxJNSwJffFJV
z)<~Rh*fsHVf1?}sxz=S#2R7__DYCq6s<tre=?kAqingR*0?&VddUQrsub7;i7bu_8
zoAv!mx9Inu>F1-PRm~jIm?vG!{P{XB$3(Y2H1=bUgmu@uJCT74EgyV8ALw8{L4B>^
zti`h@A2ZLA?6q6Bu1mst(z@dd7AOdJer_n(a$j`8>WTBdUl+@?n)pgEqT4{-LBwKh
zoY>X=iyCrv9G!g{jZNP*y4`$aRzJCz{LeV^<e?9Ri_hE-yZc7U{QBNUYuI;nFMYn}
z(r2N^ET><5Diqsi1g^J0OHvnqY`n1Jg~TDZ#n)B~n5nB}_&sXvm($Y?tI~Y9w6nn8
zBIwcg-%E~iCw_D)&+F>C^5*%On2kLBO$U9-Yxn+0a*x!^xXiRT(4ziQ@PhSI`%IVp
z`!ToU=wd}KgUE^J_!bAAb#eSLYt}xMIo}IYRc((pUlH-zd?iD~y}WjA>7EE*@ppRj
z#Fsa-@_ChA-51`?FW)o!`MNXgQEQ&$PhZe2vCQ<<sZ~L8N46)}p0YS-RQIXnvL!pa
zuc5G!)u#o@-4`da%Sv*vbIPta7Kri>jhn|{<CWJSmZ^G!f9l~MKj+WhoXgr{a@N{l
zKHIL%2R^ISzfSXI7nvf{dN%Xgs;3^23_A{4y7?T}d>#MayrzHGl4D<zO>T)uCjOfA
z$t?H6mUnAD?$uiB;=A?G<0;Q(ES1QR2}t~7^mMoCsTmm^U#F;?+7KnS>_nr>9Jb9z
z1O&7%T$OyYJQ%bltfvngzHCmhTnUQ<UvnN#?kZeSbRbjMxhkl7xn=0?XzPDfQ|4X`
z4gM?T9zWmmCfnY*vM*w`J~(wTuj@{kFS7)T&@7I?fLC*pLV{Km9Lfk;H7jUwpjLzG
zG4ZK?r*4v%*V4jT{PNcw`}*r9QfKdOm}hr2OeF7GR;c@`hwDtznc5THZ!lDzq1x7R
zBjbvzIIoe_D{*+%Z@kdo>$Z0JoBP*o@+TkX2vq8x{dr}l`$1LKv(qyEt=TO%VMoEf
zq%WToY~P-3mtUY9FoAWdUWoY8wI;Pjre|G)>wko?sT|F?azA{sai(S9!lzAdqpzM>
zxh?Qz{<4oRn}2`Nd0Ic;=u5{Mt8^#E{3~qA$NJMINO&bJ4qPxR_N5Lu)*?YYS1y4n
zOUso{Ek#PFHeRT5n#!}n`O;6Rhnh;0FSQs>ovxp>kMG*Vpg`}Hb_XLaxlEA#du_8j
z|HI^&|6ZS8py1u(W^8=K?%5ncQ*RaR1y!8NG9_t2A|aB!a@WkH{`%d{5V11}O7*F6
z;Wc<WU4Clnri&SsGnZXlvGBj;!PQ|V9f$6+>$w<gI2yms<IRHlql!Ay3`=jG6y!;p
zp9F5sgDOL-fAgnr-W<imy^`l_Z+Kh4Cl(Fvsd`f$f8fl0CC$>w!IE`$QKpI3E~U&s
zZ_TEs`FC5y0)$z9>{zww*74mx4($7~)ZUZToV&+O`jFGv_0CN;?_+HAxtc?sN%St_
z(Fip%43CtTVY%$L)L_Lw77G`%@E$kyOuL!=MVom4zL$KOWTXD;dtyn-&CTm9ZtDtw
zhFBnt8rQ}PTX?$r+>Y+=e0-_y*S?JZat;^w{@5|?j?59`1wkzzn0xLm+;u55n0fsa
zM{}v(<ta?oVpmQrIa+XQ$&!{u(}Zr#+gUWz$jW1HRsjR++R~>IkuHvt#6F2Mi<wNh
z*W0(s;&b`AUt3FjE|xg2S#~kw<iqAJ;mn8cWIcAZuhsBtne0_&`Y1EdA?kBHlgFfa
zi`IUa*74C`$`^hOBdbk4D)HjW7kV^+q8OYL*qodfCU02S<Myy3a!bCsmXnZgCf^=Y
zx0c9_zr?MppH)u}t%_Y{`Kh##@k+*)g71E>t~dSenr9ih^YWhF`m}XFc;`=-v2=OQ
zm)m0Xu0yIfPl!QH)*;W<`f!Fw!8%Jf4kj1-C1v@mUU?npn!=Wu!!~25sy%=4jHB(}
z7H<_wb$*waR+4ga|DV{o=dG<)mHG(<D}ly#7Av0)NK)7$YyQgNxI_5iDJ+dm1}j{Y
zmp<9$+393hvhhdBiYrgo#D~{jm5yC-{`PGF!~1bjLGnU6s)xLp>;e}Dy0Ch=Ee^Og
zYpTf!Imf0I`vZS8#`5m<W|+Ej`{KhHTfV$Vl)a{ND8uBQ(QYZ17?F2(bN$x(sMv0j
zkd15$o-mui$@|D1@Iv3_J{{-o#tVHH3=iyU47k8?j43dE@tK5KoPkZ7xA0l6J$3ta
zq<6Q=j6-)>9+w?3o9njt!?7iMr>vO0v}X0gZB3UiMjzQR_uumAQoWZxEwk&9kAD69
z_cLd{D|LzC!Qvt_Hs)w<6-_lX-?T=lW%`pp8`r(L(mDIG+U*+|S5BS;EtpRM&E11r
zR{~M;vbDVet{gTCa@-UJ4AiFX)Yy6PSM(p7auMc>Z#(mx{|E{&T^2d}cj_{)67^;O
zzSP>gEiPYqG2_#u^%?K8t35Yv5qi7qMDK+fwg;~~*LOVm6uE9i=48`eH~A&YU)>Zt
zJb8uTx9j3wMIzRQ|2rpoSH<gyEnZwI`uAne{~6Nxe-3X8FFNVv09zJyA}LayW4(nn
zcO`FTY-uI8$KTW6Jo6+to%>fz@ltORJHYQ@w_|Iu^(xN|DK0Y@b94n?^39)g%3FM%
ziTQHD9AU2?NpcFp$BeV~i`|%z5Vk?n$mzoTSrH$0e(|i%)cmD*)<o)Rj!CO8ckaA3
zA1sz;wkoM=dl-sVsrI-zJHOBjSaUh^?4+$(mP;d_G90i!b?Qib(!XuGC-3XHB^x;N
zfrf!ZtS<5DC*|Kh<S(=N?bHfOZUvJ`72r_{P{-rgG**X<D7WWs`RVBa^KWiqw7Tc-
z8MgcqXGhhHiF|biA2mdN1<VtQd_HRmlfO5o-v#5y;<N476g7pr`p!OUskkXqv_yKJ
zhkR7oqZ{o~y<S2yv}8B1$p$PAl&Q6~{rLI$i<^>$JxV@I?9c2U8a4;|JP}S?7twYt
zhD|iO^XQ8TeZ6nF(G>v;a`g`%KdRR_0n{u7;iH=vIC{JL7IhZ|r0(1MJl%MAR`wMK
zjf{W~Q;#~e3Ose>tV^iUoMUgO!EstF<cyY$U-FC(FaM?$tVo+{@b<a9%Js=!=e^UU
zd*2;+nbEz>Kx%48-LEGO(!I}e?=8su-gMBzVe7nG$@iA=u9&#Uds<@i(H9x^hq`ay
zo_=|a&+RzS9JT2_P=5%#)RCu!&F%Pu#AloDBor$@i_XyGZ>;!bt#UEXi@U*VnWazI
z6c-B?o~9QUV!UQ<(9|-jI%Y59lGy5H_`c3dXxhaKWk<KWSzeG@W%+%^-aJ#?Si5zb
z)?IudRPr!unz^q2|1S1T5j}ln%Pt7c7kPKPSN_AhV{I1%^UU^4atMFU-Pb2ztO(!a
z(A{_;?M25E&fhFf8qd$)SG8l5f7F}%_wK3$n~SGB_IjEsv(KI^q^Yy8V#dBN>YaC1
zT-5lJyrtJoT6*P0jRQWHS*I{5dd&(`(ThoZ{+6q%pX2-D?ns?!8+R7&$iB7S{xQ3Z
z@U6nncXBye4jztiXnqFnp@JLa6OTG%)PnW{-DOfdWAjo+{!S8uhu~v(<%W0iuP^S+
zEZeSiM<?;S(#?)X$y?8h)=cNB?U!g=e3Snu`*-hBGv37)m#OJ4zL<F>L!|V?zcoo2
z4+YuZL`*ojaLe^YdxhWWY~a~?A;Uy@?mVX8`jm}tk0fo>S;c<rZ0Y&iyH;L0E!=#{
zmHoSNu2R)C6BE{sZ3VZdX`gj>baRJ6G3JL2C(d70&Do(Hx<Xdt*=0$IoW*-*ZAf<f
z#{6LIpZAkzd~x39c<|fWnX9KQ|NqVVSl9gqxA%7~^G_eU*T;9t-u3tQtT5S$tql=1
zvo^-b*ThOyE$LgZA<gk=z+o-5U(2Rle39v!?BDb2!s?@k9j6v>hcJB%bUd1}ST%P`
zu$qmBui&;7H#Qh5t$FjL@XxXn*YtI!6|#!36sp#4mS|it>0ti9Z)*=_Y<aV!x7W>f
z?wNEOaEGxZr9{T%;{s*oh2QtHan#1lX{>*ClI_lo%QrsU<FICtcHj~$y|=Gd@Zcon
z_5+juit<lP`}pM`bLRZ#Z*wbW|GToMXLhjqHP+bWHrFOi*Ou(P*WJH3JfbY<aK@K!
zKQ~LcEmpkcw%B9Igcl!8ExSD)FZhtzSManWMMStqN9?r5q2KNsV$Q|v<azIw$@fvM
z#?pV!wS|?8`HL3bT=-zU?%M5K7dGjsZ8^F-N^#rd?VE)soRI@>{Q&iRUYu~q*vG@$
za!*h1+2i{U7AvRS5Mh`!bHWnVQ-NRCu07y%HrKS*?V`x6&&RFKeoa(vpDJg)Xy%pj
z;!iAJy>b^{T;PypQk8wZY{|yinI>IVejmRY`o%1Bk9AM(hB}V!qe%;w^#2emDbcq7
zeV6yE>AvulbM>oSTp#bMdLUUASux$qMj&#*wz;KWME4oBi7i$xUu|S%WL~sgi+SP2
zorWnA4QKOQyeheN&P-GEYFpId?whf|<7mc|Ej^3EmYr;2y}kXSqg_n&pQfF!QeA(4
z%aH6<WB$B^ck{J1S4^aO=f7STc~IN3q~V^z-{jf?foq#1bY61_n7&9axopzs6|>`k
zW7MioLf2#C+sl_tDW7sh__T(ck~@36zGY3oEtRTYQ=T1Rso`Ggv}ezaf@>G=|A5pN
zpvn{!Y!xLuMZ&I5)}asA$!_r%nm@C@b%7UG#n#4ulP+rT?K!HaRTt8_yF4kx|CapR
z@QlqN`qk+sx7>Q&mZn~aUVKq4$>i3Zo}>k3Q;V(`Op*Uz{As%WQuakUHzNZZ3l80}
zuNObr`0HrW#z|teoU^p-Hsn9>Q(VD+pz~bopS80;Cf}2gyER9E-#EqPy^EjB@;Dyp
zC+ALCC*Ape?cCcB*A9s*tM|E@vpie0v@8DHuhREwY|)FB`7PPf*~alPNyxswk9YpV
z*LjD++ra%_SW2)iaS@tg%ba-R#>AW1VL@e!eq4|L$}_pnaK7L4A6-(tk1|f46%@7C
zQu%c8@}UmbD7HDTcdkw~`E@oaQ&o@CkKZI*xqPw7agDe8m%KP&S90mlWVYnqr}gs>
z<(K}beYf}9DzT2ENsVV+>@C~Au=TMWonw%;aHXnf)#<C<?_+i;Fcl@ptA>6v3fB>S
z&&#OHnke@6zVZbB&1@b2f-WwZu(@t6@BD|-hhy}ttY#^uIl;2t6GwM8r&^=?8CUW`
zYYOh)T`~La*RPMlRj<5m@Sj!Sp{bpGGbnTWpR>{{E^6#+Dt}=*bCsddoV<Gyf_l2I
zuV<9}joOtSJZ0L&7m@uPg^QO?4O%H6zgDlSPe+V<?X4HPSQ?i8`>^)t?1tk);^+MT
z{*#_4tgKmcWkXbb{70|W^7X4~_ZV{aaLhbpyZgdNzQYo!s&fDK?3G>bRAKM&+2xS-
zk363(5>addTqlm)e3`VyF}kr}@20ntYb5t9cZO{2fiz)xTB@FE_qg#cI->tfwe~A(
zo#pBKn*>95-+q4Xj%EEeyBAglZ(cV4J`s7X<bliO>09_sr9{~u{W#>l>*7%_hPF?F
z?~g2YoO0{@o$mgt22!@AN;PjhGB+-}sPU?9;^bowcbkb9D|feY+05Y5*D+DPvgN|k
z&QsC7_f3~rcZBnAQAsF~Tp#tx=RtV<o?{oUw}%@~`I_-DV5+#4=NHoj!45x@*8E<x
z#&q=r;pStEPdp#&exWJK(h;P{AQXQv_JX!cI%C5HIkx`2bLQ$SumhFm@4`|`Qu0zF
zd!;2gYGZl=6_2d<`cka8=c?{3@7GL!H6M2#spOhgkhEZ_>mE;j{uvhEBTt>$GJl`@
z;Z+d|sg<3dy;kk15nSV8$bYOsC`|FXT-b^aEjy&8oA0w0oBv_l%^@^3(b&*xQ^d;u
z=kG;UxR-8=-~Ipc_i1}PTc_>XeQDp7yLVf)N*BI6syWHQL*bz94(E>(911kAIh}sL
z`%vC|xpR_g?J1Ld)T*z=MZPRfIp@>1uK4V}_qF#+cfZogyyRUk;vAFlqPI*_{>G-K
z-(_!qwdR}mFSEsO|9(DMr!0;$N;b!sd1qTNvvT)zFL)Nydv@dTbx%*L{ae5LQs>ut
z%b4R&Zf4D^2>IQ-^6hW6@9&iq&M426?(K7PFJ64{;){wPdjrkgT-}`RQ#v@U_xuQ}
zJKghg<85WFeHkoWZ`9h}EL(7~$C;1+{oUyB$Uy5&JvSt7wIAZUm?ORK<@pNUDb=dY
zZsoeMLA5tsH`;2Sdo`;g{H(I1tZui(3ft9TT7|FPPhG92ysI<6z@vWV=RcbzZ-1V`
z$<yPQWGr7jBSE5<CFbAL=fAdP9Gtzr_2v>&e_Oq<Iln(~U;HwC$qQ)}5fe*?(%*Y_
zeo!nGxN@w2=Z`-xO1Qo{d=g60a$D`sxt7!ST$SkCrH-!Z&!riqWI?`K4EB}KvdDlk
z9UYz$9bFNHH80Anw#RfXJEXidb*W*n;M(7+awezd{hFz|*DbnSX9j<e+Fq|CCBGRK
z@$fHcDk;4`e`nz0V2yD7%P%rY^|s!ZpSz1$>a)p3$Ayb`hwJn&`~B%HfA4X_1+$92
z%bvD-f0m^~B_q)BKx1^;xeE=FsV!NH6s9iy<7EHvRy^Cm`QCQF8j`-Q^48}${^)n$
z6U{42T1t-{=I8jo$?(bE@|Qv7|92&Q%KdMo=x}<`zx<P*`*y#}61(l~+_n3O_;pFy
z-oCsN6DuiMUB*N&Q8p_+Z8l>rm#wLXuX;)d_<gs%bK~f@m|rK|+l3t$PmnXO@jP$v
z>qdOMzo$gHN13$JoCC9t%RfD~u~q-bos5z%7wq?#sy*BK{^)~GA58_~-x-K8t?pe_
z^r+)HpOnYlGzo^o5wqT?E9Q0i+4nf!u{k@j->-}PkBN`c&%amp@oqh%b2YEW_^v^g
zO7|QU=_6&<w!a=OpQc#z*_Dx1yuRSISlxY#JRS8bo6l6f{8?7h-Y#D5(0<`X2E+r*
zi2;cV9#7cAFC}^|RlLIO-kHX>wv<O2oF=!_<xF-Jr`Jq6vSnp(-u|c8-|v4ard26-
zr{U|;!!FIA*osv_(R#?WpYP6N`D8nnc{)}9Wu^YqMej~~KI!Q1SFankZ{Y0jbJd&l
zB{}9`$_|at1t!9)xD9_TsFa8|6mx1`%(2HXqG`uUQ|4cRm-%X5)mu-Qo?W3Jp&7;!
zJo%gEpFI!WnrkXut@x#&*W7ma#e%uF1XFLZoDxd+D$KOrcQ}=$_uq4S`y*fe|BIh6
z^TLaaJW!NaZ{TTpd%E}K#lnKRex)T<T}E0;za6&L3vPU^`E>bIm-5;FZ>?sC<9QgO
z?Rqox)0R6?s?BaIk4n|w4b7SR@xtF3y&(m%w|+}6KPstkTBJ>;_+h1Py(=hVx=Ks;
z=00A(pRIr?|HR=nvVp67iw<}Ec{*Q3`BrgIo|n18-g*)4fC-V-MJ&bt9W3@`dI_8S
zI{xmi*PL13UwLm_yG4-ew!@C(<$q#NoKAegGu!0kgjda_huhZtd1&2xCi2_O<&pEI
zG)Q`RO6qcSpE}sgwzV@-<k$b(*CI`MracJ#uzyqQ`#rst9cNekP1QQq;_7L_Cw``S
zUdzdEd{VZO964<VTtPANBEkTa=T1A^nD@fMV85(W#)tU{=W}ba_ifz8<?`fM-|X2>
z<7*vnSaq{+&+ENf`AYri;+p?+KW@1r+E{<GrR~LqLmR_moL2iApK&<-B13k4#iaWE
zEw5k2-&w}_I5KC3O<;>Kt7V$mpZgc1d^fCZUAp{6-pP&cTUH8Oo}`vh^8Z-x8-K&f
zqU@`w;`uVsN3Ypxhr3zxU;j6`f`_H;Re<Mu+5UAWHKuP2kM*<Bv_9@2GQ-DB@^gTx
zrlFbayWor8p9nWNEMC0xA}EQPN3k8cvpD(x<j=PhRc!Swv+cG`I>Q~BDEhE^rvK^%
z7iStza@T+Jb=scecTO2uNy$F_-Kw9x;&9Bjqv>m2d&}?8zM{7(?DP3%cFhu%`NqF9
zC0Dwus&Bn>()UMBPvwIrXa1;|%utW|bkbcS`$x`^oJpG}sbx&jVm`Ma_uZVHuzQpG
z?NhX`#c=S+mOgu#rJwS^_v%t{R=ueeS92Ck@AnPNYUQ_#-tsTlb@PwOQp$o?Q?zdH
z|J^pZVfqBE0I!`dzqG##=kRU6d_c*v<)<RJXoqAw#zX&Nccp|sY)rEApZ9?Ky~N9<
zH33JiPWf)ZvCW51H>4>eFBMeEgqXdGm%RV!fPJ8LPvonr-d`&jYo&fo+Oo$bDP@bm
zKhBpM`=x%KsN#G%SLmM9><#SC_g^&5vR@S+Xmc&)g2rY~OHP}ah3u<tYU-r3_cn)1
zXvQ|J@!9n>ZLJHl$5!KW%MJY1RN55dlmgt}GV^Jz_r9m_b?N7-eMK<`!XEh@zy4s6
z-doQGH+N8~0wt-{k`5Z8Lgv$^J<(_TaMV72yZOnMsC0iTW^-Q||EKAbm(Hu%I-f^s
zsmfMUDOTO$#TPdw1|?@|oZHj0MrBgxH74toVZuFEyiAIgtxF2=s8cfgyuCF0r|S*2
z_|`pVum1h5WxFHQadGX8vkoR1U#Ct_%P|t!ap}`?QKQ%e!C}w#eF|E$al+~5gr9P+
z9&B6t$KLC;v0P<9dWUVr;xAELan9YJIXOVigaouHGY2<=Y`fU=Qt5~LcJbD~x%E~2
zvx-vx4H3tG#m^VD-ueHr)%Nh>%X6m9Y&^N(;@jfq7pyYYoZ8vb_smVBuRiI|mCfph
zUA52KYX3PmgT41|^wsCfUwCSrx6ZzNgmX>yBAx;b`TV%^(@nR}o#k`0|BuQM*CQUa
z%h-;XJ9po!c3;YJB}MIK>B-~r8#oWl{^fr`<1yn^(Vw?xnX1&h@=CM&B~aUD;$*x?
z;P|AV8y6%!Iy6+*o49`7ukYg*wfLmM+zWrJ78a!kWFBN*C@l-}RrqQtS>BeP{e6{o
zl}rZ~=k!!*u{kX$b!Icpp2xL%YcpGc`-!u{dmR>^v-rva${TGi7hcTjywf#vy4CES
zK8sgp@?I7S|6h>tEt|LGip`g^!OL6j?bj^7w`?JIN>S3M>%A*`t~qade(}M~!a%m!
zfBzWkd{WTYI#%(g->GwfcXhp!vb=V})GRMg!&D}gmqtBp&y6a2k9aM0auHqsF016j
z3mc!j)CKd?&K~FE<URk%vQogx>i^eyF)I5%e-%?!npAN!^XujMf1i_`++08@3Y@>C
zIBxUFvU77-cWe+W5RIynd&lweNhhP?yoF6}*0XgMC!f9S|0168S>?G{_YeIO`5!4I
zMLE5nzbIZpf8mO$8VVPE-AzO?4=l3Iyglcpl)AHP#;3>xv)0_Uv_q|X?}glstI)XA
zHh;^jht6gvwE|Wz;JbB%zb9`JbLZpZn~$Vv89i;<X&STtLw}2e#>e^FA7%Yq6sD3P
z!sMe3a^W3FZsl#+>F(}3??uiko9AbAjhCrMmy7NFT&B(=wY8_u{r0z4(*HU4{Lka_
z_x|&2lYUikRO)}X=bM{-M0`%!w9G1avvPaSwJaeME(fjku1Oji$BhDQqcTo0aBgxA
z|M!J?<!mX<#{crAeA)AAde#bPPB?kOPIP(~=goyDKk{=)J$({mEZb=@VRhX<&YILe
z%=($1r<|1JZ%JOMtZLK7A!FTm^XmT7Cs%$v|KbHAr!ptL&Pef0PjO0mk-WFVMnmhd
z+SMaTr7k5)-fX`4q%C$^_RXMwoEOeai@vhtV87o3*>16{2DzoPH?F!;xqdI#kAp2o
zR<yXX_PVLBef-<7Zm#I3ObgD|S?p3~f8!r*tiP=G^>^wL{WY$OR)zihqg>sz;6q$l
z7-Pm&;S-k`rxkG@X5Q0d=l%J>d8v>o)(W6%8I*z-FTPr&Ak&dNEwYuTC6!C+ZOS6n
zj}NBl*8GhR5A?giTwZ-gGi&nmi_x-9zZUrIco;P!>yzyEZ7jFl;w$F4=`=(~maX3P
zM~EZ$V)b6JeYd+`9S@mNRn=J+cu>79F^7GU8D~u5<vG*m*&o|@=ZZ(X&Gay}J0;A?
z-zPPDE<EyU)x{$lC;U9A`gd~ttlUq(-#nie_IAZH#<c6dE<JqXBh>RL@VU+ZH<#|o
z8w)f!1d7)`b8+t4y@mNJqFtWFCg2vDa3^Bbf{T7?){S9|9eEKp8{M|As&V1gb?=Qx
z=why|J-N2z^2CKgy1$p$_BVO5y<3{%*V}pDV3o}_yO-PKq^=(LZj?B2;+I4FLu-F$
zEd90W^tNkfLUz796qkRt?%mA7>+zFsS^t&xdTR3OjK~75TPC|d=sw^7?bVX#|LOPF
zPc^ZrZ@7Sn=&;WX8yGGWW)!M#4b#!ipSo%K)RQy0o-9#a-+JDISvPd9%08c8@!ut^
zjBd;B_Y?4tzuWd{V)Qb9VX=3STeDv6Enm9ONb2Ve`S}w9F2DG7WA*w6b8@2WYce8a
zYA^o0pw{gpcJ<VXyx3B<Am`aRF+84@*=)QKziuw)zE{_Laj{5?@zzHU&drZ<Jtmwg
zo7Zvq#;r|UGDt<R!kPM#GwmmZr=<oqoe0?#YX5h`kG<u73x53UK7YXY%~mnC59g|0
z74klRGX2G`p7wX@_m@t5nszlKV7XrDzt`(0JvdZ#c#3DHTC@P$;d8%Vz1BW&ZM}=r
zdD2Ybq@yo>&0^$|iZy<<W?fXG)t`fFqi;@52=be;g|UCz&#T4}PTJmfe_x!KU$6F?
zr%>wU%ro;B_Jz&=|L3{-NgqhI1|>=6#N7)XD=;riecGtCYwo^EuVm%>_e!(-9XGYh
zuaJ+uX;66R#pm;RWsN2ar+eE~)xUk<c;>UpuFZe8Ji1{Q{C-z$eXZ^JeLwz|FK&*z
z@_T#s%SlfZO|GnLD}JWTZ}#$JG2<Jag)9FUt*UQ!)8A{LbIEqag1}wuhaXMyw@bRj
z{9JKq+DG^I#adZmnRY75T(c+6z1bqUVy@@<MB#l()6(9aFnShba9{#g=%UnF{q;ND
z-Mja^p6qyV3aF`b7gT;)?Yel;VMcYynaQ9~)_wh#^WpaW@9#J=q(#Jh{5suf<;m^;
z^nX8WygB1--`O4eN+kByD~GO=tPGIawQ*NhQSid34EK-=FJ>|RJ;b^EZn3&{gXHCJ
zMs~`dC3bAMTKjv+$~@a0YcJlP{ryz;#-<xTZQ}zkXaq>D3OyX~W2V2&D$&kg=bfv+
zy=X1)s0hsBUa~86H!JtVgZzKaq)W=Oi<vTm69cR$6?hiJ=5+cL_u1N)Kb`mgJ=U=M
zCI201vFA45dAb?Sze%6xBcyP3_Kf@qPrm$q&-vQqMCZf;){`!oElaPi<|v6Y&*>0~
znUvekAT79fjj*|tAKz5XGr`)6&)MXDdTXm8*2?fQHf3Im-`3)fi&k}?&;NAwZOoPl
zbL;<pdwt{AnffNT%AbjaSt=PO+w5ceOjz>fTer)8yLK(eu=}m&DGkSiT&8a$jI8+d
zUNLRkx*XIB0J$3!$O6-z9@KC;z3G9&vV{(g4&f0p^>;&^7Psc_U$|`F()l%8cD+BZ
zbb!-5ZuPlcw**rk3T!gztX4D?iC83396EpgmUV`r7pAx!Z7=0K^H{)V|Ec2LnW+b*
z*FU_w@}R$pWc7t-?mpaq>nbMs?%O3`A{Bl7=MzuUDN0pyrMTjw&1@duoWUGe_)YSq
zy4AC_XL=9clI1wt>*j851?pPom6!<doo`+cczV-^eRa{Bt+EzRe9V-W>9zY%?4jl#
zGg~%`=eo~X6BBUj?IeGfD)l$tuP<~?UcXC6$LQR{_X{q{-Q8;R{pj-yL6+Z4{~hy6
zjDwoJ%DBV5k7oY*5Er`c(VL^+me`dY|5KT>YPF20*hZO`f0O4PvtPTVx2G?6{iR7Y
zj82eH$}_QwQs>ptnq(y{z*j20F!kv{nJKSM>nolK&QMv${kDG5ro+|WC%q2}5A^GO
zapc|g^s;YTZtP#rV5A%%cw!}ETX9^4ne&Agm;EzRZ`GE+za4Oz>%7MjUe_fzZ;Nl<
z@Ak*d&s88pN4EWiRFm_|IZtM7y`-2@a%QT<?epr-RWE`X%j?2St)k{iaa>-l(6HgH
zx_`v9R?cl-F88mz&GN@-a$Ig?W^(wwNk<n>?GsfpakLBYsy?QY&VTaeWDf4ot;=8N
zsbzT;@}(N5aY+4rV7oRXzRa*rLHld6*5*B3n&o$9u~n@s6us@Y^Y649VSCp(O})6$
z^Xuyu4zRK$Y&qMZCWqq(U3czh-=w2${UJk$nZH46MvH=y<6?`_$Lsbfz40_sFOxqy
zXL9~)L9xvi)fwM5`zNYz^2kj;#%ANY<-WzXC~YpOqjf10m9B2^nAE!}w6$;XISW%O
zi-}*Pt}a`qXtgX}r(*H*Gsorl)Hj~#y>viN{eR7;llK3g+h?YznOMz&3?U`AvmPqZ
zS^`QG8qG^2j4WLP4l9OCuw4KAbX4H&IHQb`Z^i!F86s!6yCdh=UR<`w+H--YOw-r$
zi`#B)zTx%CM<wG+%+JOi=bm>w@|!wbf8M^ewdLjqozwe&HMK}QQx$SJwRBR};<zKv
zP8wMWnQ#d#6ODib!`&AVKVD>r+6g?9wd&K*)Utmn(Yr-QyH)GFrSPw$UCu>1EUQ+p
zxzNMD%4G5DqT43l=C0&SoVe>0^KA3Y9W%wmmfx+OE;ha9i(|x@S8p^kN>sahWX@Ea
z4Uo|}zT(#lt3B*L1T~~`-9s2x{W*4{Su5;Q{*hg0r=^z21nDT`^uhA%os6eK9PFZ^
zuBICTrsREM5ttD)S6o(CJM5js^PlOGt?E`uF2AqMnz?YIf6^4D*$z5tKUA9{yk;Cc
zaP8Nsix(FJrm>j?Ju1KNl5WuP?i!zzfY@fMYA&g{OR~;y43CqtZs|UF=W>qos?g2b
zmD_Xzgfa|lIQK-Frx<jcxbf?v_?*Mb#7-Gm@res;+tkwsX_LLkSjv9ri<V4@OxT=x
z4BRuNb+x5tXhulY-@SU;?)Q{eUTTlm%A1v(n!7zyn{nQw1Gd`rsTS7zyH7pX{$fp~
znB+Z&_jAG)*;WL^cTDhP=?!af-I4uy%SxS3#yWDxZ(6^;f3&XF!Fuj|ndyPC{uiz8
zc1nHxetVW_==7KaUTcyKu2o8O1itq<mntcHTB_O2|DA-9Ii&c|NhsOE(z15dA@)N}
z4(_LuLabukoA39u%O9w}y)`FOW73rZ`)iFRzkV%nIi+7Z<walQ+lw#!UI-?se3&eB
zK}Fz_?FmH_$yX{x3X(_9DTOY$IQKfw8~#s)o-zK%76dA#KXP3Be(zzWxh?f?Zu%b0
z{QJVI>VKB|w9F$me2J3+B~uR`)&IT6{4@XUPrTdD^wv(%4)y?5ZlDrw@#4k}$qOIr
zyH1E;pK$Tw=U+359nQzOZeO?dyNhYR{jci}4{wmQt+pr?kj<06y72V=KQ;fC^<EH3
z2(w<qlN_)ta>b=3CBf&SOSBFj)Q#?wvE$K8Q}I9GGg)Gh<6<2l8L3=rl~b**6Z9ob
zR_$#1&(dorx%D^S`}_R7djCGu9?Ytkz;68ZU-hTw`q`4Qzsn;OO17@Lc=5%HtkBaA
z5ehFXb|^C}ym(P*x2wlufpcFLCF*-ky=nS!nY4r5jDqi7PX!WI2(tcv@lp7YV<-3h
zI_0ozujzC3^k?nzEb2KFyXfnj#0&TL?c&Xud;jy)hzlCsJf$7yrXBD|DNI~%K3V*X
zs8)u^x9(;Aa(A|wF6mE_W7^_vS0!IPxgj`AN4wr+#R~8Fll{-F<KwLZjZIy=_##7+
z<Fl+R`&J_XDcQAMo6j@2HmsP|67;Acv69g;Ao!Af&nC&6vwPl0-`&o?_?t)W!Pm^6
zgNzhYXWo8(?qQ?^r^b=4-oysBo2P<Zu3w$kF27>Kv<;vZgEmjo@sHlqGLqCcl|JRa
zpUN+_w7>B9pGx<)$FDlb_O!cpDz3cQT%!AK_3G|Yxgx`h8d9fErT<k@@X>`-4d8)B
z-j<!$PY7L3&@Nicdhdko?2i}zp0(*rdzX9bh^N@z+uAyPR-d;-+)@4fE9ACh^@=>>
z-i#-|Utdt<^K>gIDw<jPqv&KIpURF6on|&`SFlVGbtt@5TYmhT`tDZWjSDVzn%|$n
zBjw6{ug3OgS6Izo)!859I{&I%3}IdRFgJ6Cjpt#uqX(u<-7XbYbI2j1qy+4+7jEv_
z-yJ+|F1cdaxZ#S!jae@;68YtBZC*a{>AlL`H`N#V=YQ`Kozr4<M)ZEo*2-5R2l}P_
zlFTMQ@zmqyQ#76S=49THy&FzEv7OqVChl@P^JL+|v-)xKE03@3nH4ZMy-4HevX75%
zghYo)iDl2Lm=b3vcCv)Cdyz#`+@YmzuRSE=4=P0`tIz-W!dd#1yP40d4%-u=MbF+e
z%UAsLl0W<T;KymEdzP%&y5c;v8`|3!X53(~my45Qwya5(r0mROzE!FB+uvEQGB@vA
zee7xWHIojZAjA6m8y8QU@38yD;}e2jdaaeodN%&Cl_C*sll*=r&sOVe@4FH5`G>Nv
zo$S+PJ|7ONs3fTETKCK6W`nkJ<|3iRve$TCsK@o5>$q=}yzAHw?NhGrC6+E((xCVM
zk+GQ|XY+1}IeUGDk7@5()_P9Paq%7&E1}MZhD8yTa=Mqddr$wi)D9fDpuyOvmyH_?
zb{1yrGIKipqC=bYhECP`>$?{2cd)w=zre5RiNHeHd_n!}bH(QwDtzph2kRY~zoOAV
zKw-<avJVc+{!E-I)cZ@t+;xY972D#3ZN(Rz%nbSBe(FWKEI2K{yS#8!L{X27&Domc
zJU&c{OK0aCnvk-}#UWCu;EDgG8V||m-+q3!u>9XyYPs-tX_fDu#)r9zB_iL~Kiw9m
z;i;;0^+e*+oxe&`_)I`;=sVy<(YS%(g5l>UoTp!CobQ_A-6eX^o;CcKTt(!My0dxQ
zF<(FTU#W2l2%R3cBFocu#<hlaxASs7OCzLyOnB!gw(_}8+4qxdPaGC_7vD&J)Oo|}
zqGnlYQMS&zR&mkp>WK}W9y5GPeyPr!b}Ay)#w{u5+3$5vPd|t->*UG&FYFxT+^u+W
z_358~%8zk=dguG9P*{B0^W>+x*$IIUofm-eH#8qr_VgW}Z<9Dv`r($`&FQRu%~=Vn
zei=@^QMjY*@w(88w98D-KdjN1q;kwy>ekB4_m9`_=8|Gz+J1Ib<kjcPd7mn`__J@%
zQ>`$zYH<7}^=(1eBIp0x&doWvY**K(4HAouw#nVNWAJ$*`|J`&QIn{6Q?;E_=lHLi
z%yX&ba>wCH%b$iuPbbBkjp54izh_d`ox4?sz4x2#&nG-a!cwxaYqLsBtae3Rb-0oC
z!eZ0pzzL?m?&JmMy*GS)@_3e9Er)ye)WGFaRmxXeJiZcYU#B0ReQR&IseQ(mwdNL{
zIfvvHvu^yYVYPIEP_SNC7I*bt*UJkgB`h-jK1E^Io6Y`{4VEpepS|42&u(|x$Bkb<
z+}k@VYGUk{AA!$LY8+}<AE<Fv;l~nvE~S66mY;vEetBQ=^rkirj^NWTAdM49fA5{?
zq6N)vYft4Z_uv2io$KCvDF%19&6+8ZddQgf&SU$9o6b&FXKa7E{GWN5PUox{6;e_c
zbFNQJ-uT<%<equ@?XDaGuY{Lxl$-s?VX?w&jzZ3h3nV7(o~D~x`1ixYjh~Gl7F^!3
zG3VCqy18LVN=8${Pw|z!2z0ucazVrF!Ta0Wn<t($x^7?g_R^W}DOWYxvVJN4n3n3f
z^ypc3C-{)Jlx#6`%l?uo1s&ZN3j(uQ8?~!kEDGN5+Isu>S=C(EmFiVF5`kvV{%l@+
z{9MHcyPrkgb~XENiW}@a?mO$S-|v`|jn>72CPlWD{T@mhvlndQG>?<k2<&YN*{Jq?
zc~|HOcj1I%LH<)03Uy63$`JX!>DkHSLSau*_t*V@JFD^UR~_BysgbFwxm+!vrVC{3
z(cCJH?a&u34+WWfiH#Rl+5G0oS>2ky&o5VfGXJ#NUxGU|7oWG)-o^iNu2xCPpTl#W
z&zo29*EBKsYU^{~H+8Zv)x3fpHkyXtT$?@R>9;k1rhYBm&vVTy=#%K?j5|}O=h;VH
z^0f1fShMfPA6f2an>nVa@k<sTw45b+kTv+6)TYEf0rSfj93G@E()glw&6IP(v_m(-
zYz0FX7=7HtEk1Fs<ZXlBJC|=wiVR!rH}A#ubq~_PGeO`sL~@maPDGx}t%VI2r0U;J
zeIReB#cr0{6<MFaV{hKOTCV)+)5QOo-|uMNi~bX*zgETc>$%$oJksYs{C+Po{on7H
z>oF^1X6jyEo@x{DVP>p=TA<;al;ek3FP8rJkg@$<SC9I{`W=5h-xE!rw`{8G-h013
zA7ETpaO-Zl%J=o_*IbzG5aavx>GYPH{6`LF$iD8Ms@5uca!FT#g?)7Bv{c?Vm*%;o
zgR^yS-!#FEKOG_rURW$~X6=pIJg*|;>BLzVKHPp4T5@6S%j@aMS0ySuU;mNov3n(5
zt{W?4{9@9g%l)+`w{3O8VoU5cF4775eDlTE*iy-ZT2ES?;&)Hi|DAmP-L6xCnd>Tl
zitlX<^>QfWKK!U_{XT_tZ3TYo3@SM|4SQvq54W|68@>MMUVndQv#ZVdC;uYm7BN-6
zS-<|i!6u%L&`;{hx9b1Cn?0@P>4t=4-xDWx>SPD7L%MyS9Cg~EgG*S}^5=<3da|tT
zI=kMN{oloOj`8ZE*NgqM=l%UMxj<_63c<PeKR*rF$SHNyLqB<{T8VniAp;)A#Xe6i
z2UHwmIL6~SQ9X6FZ`|iS)8kd<u-Q-W6iO^ScyU3X)HjY9o^npCIg5=gOT8@qFPWVu
za5HbsI<D#Nfv<n8UVou}(hM(Y6;0EN+A3Xbo}#xD_xALOrkAE>{M&SI{)JsT)316h
z)4w*2cmCHe!Y<D&ERLV5yr2=fSa2q1Z{IUFNKK`XQ(W@KVY0f;4|Q+J=Xb>CrCyG2
z=fCW`T(l@@$JF$R4?l^<`kyR%W_jLj>7wAG45x)^37kq=)on2W$G)tUH%s~W`~A6!
z2XTK6Pswd*xvY^f<;JBA7M~xoe~@rI%bNeiN6zW#s%0lH=dPG~@%bE2on8Zem1AsI
z-oI|+=`%BN+QxmaqE}(&&hz%#?>FXNnRs{qBhI_)lh3$K`7*8MOXHs#H<F+F+h_c$
zUzZYjxQn$VGZmU*K<&OpgYPdQo}Cnyb=7(-b2s9cXL`c1wK+-?Tjw3v&~e_mQ0?`M
zoXB%Nt}piOvMO85w)NK~?qtWsAr;$>Tn)MKV*SJgfuHhOO83|OF8ws&<@bB4EWL5Y
zc@LL;d>kP%r(tE!tcXANtamKVc`K21eUrc9{UfvUWr{EU{ButK#@Z@l@o!beZ#*Zh
z5;N~x-L_7W>10T)ooH0d-S6qfK76TDr-^)heMz-jNCr~;-UUz4K9k~DYxMk7iOj=K
zD|>{GNmn0LJt_O|#@_C=CRbS5``7sGwEfY3^K$$FkKQr{zGTr=TvEC7cAU%YTo9<|
zA6qXeEqHuR`L++t-IEqvj9~FQo6OJLRiwrp>U2Ew`@O3Ml|qLtXDqw1XZPDzr}en@
z`|o@lRx2b{|HF>?@5j2YYQZ92mM`p$?d4KigW}pMr_7HNvb}oA-#+Q`Lfh&U=gz7M
zMes?r{)*Cr6~<OkXPKRpLW5QuXe`)KoEoH2pQ9n+x&2c?ppmqjgNI_OhJfm{;`rR$
z9HE3Dk?BSY<AfhF9*Ssvbxrbew2{pGDbt@!;JoC%@n^-Z9>>L3jyU!BT)l36-_mvB
z+E=BS0%!9qkEOl)JpaS&1bv+#=iS@4O%rx{7M-0Y^!ac}Z&zOIVLs8je(ABY%cD9y
zlRd(|zdk%~=Of0`QV}fYwyr$W3o4;OO@p}x0*jd3jwiAmlK4G0PRJwe+hzYXvL*@d
zy3ap7|FqTU+*0{k0q<KWx8`}d9qmetEz~Jpd}{O0is`XF9j60ZB2+)?MlQUSW9ZOS
z5VFd)b(YZ4_FcCgU)>b-VZ)}N=`}y<+=8c{ka3Dh{I_JX&uVq{clRUYb*^1}K3{ir
zS^QnLeHI4{dJ><kF!ukQd|j`!T5Zm;ZuR^3l7IiH{50QCqL`I=nyH7wjc=fy9c1YQ
zsA;%iXJLo8TmL71=i4u5tg8GoF{6o_`Qw$a<)W?8k1m?}%(`(%%Zts!z^m@6zkR`D
zyKkSoE#7vr^$H#3+;ncof4L0C8^PXkOPB1g`yBda=Qf|&tA78`S-y7P6Q;svjc0j}
zhpedkzjlMKv+^u;BiGQm5@$u`)|@`eGGUU)so(n27rbVzW?A|wzqi%<qJBN!pS?fV
z?>lmh^Lp&jWhwH@>@KnV&(M~Cv*DZy|A`o8X=A_l57wW*#+tv+Z>!ctBNd^K8wFL{
z*wYjCrLIdjuqh+;d^~uX161dnc900U@#2Mb{u%==spKmy%!{w|GV}6YoSQm}G2zZ)
z^W+H%1}7Uz&j}m~?D!sIz2X0h;@wO6rFbX5Sj?~W%j3Gwm&Z%Fq*%R5ow7_#|N1xC
zhAh+y$(yHkw?_Hl(hp@7$9)=ZvR>@n|LoM(X7+#ka%bDAT(tkPtnlhB-yJ9R@Ln+d
zxwQGt(VOROBz+~U_T<NJx)<^2G%G8&s{9tdPy8*H;?KmDDYsA4KI7@um&&XA>e7Dh
zS08+!lSfxqO>5l1y!f#Pd#}*C8~gRQ-`&49Ryysz=0sNE{z(@#ybP~4NLICfe}DY3
z7322jYt~7vKi=HQJwbi@b&q*H&o(Siy3T!Gc;csoH*!xG+-N>+_jiUPpVXxZBGEIG
z&i`w;`H|<+)!N?)%$xjk_*mS6R|MpCGG?a=#>pq!PpkPLci<RDUE=3G;c-0zlIPy0
zSy}#kl<;x)-j33XjXjG)_yla`>uB8FSs@thxMPFG`=#P0s|<f0Wt>%Yd~MCYo2SIZ
zM5ZUXemeQEn_=!A&%oKYdMZLsOT`7T@GhGU$|lfe0cc6VVs(Focbos)6fm4=p0#Or
zL`j)riB<#4XM?{dvKK1%y*jS*{P+h(ri1o*UuLcnPslt}8vb}*p;_Bk!yd)cl8;j7
zxc4!%XU0iwSXgng=j?<<cD?i1^-IsCw7&YaaQ~A(w%dPjtXyDjW705@D~?4zi7jZ+
z$$0hTlk4m_k4*S<(({qz@lB>YORvcP>Yr;J8S~}b?U`qv&zf1(dHJ%P>Pnf`ttXD}
zkbK{8@uHTtrJ)pJ0_~#VcZUo~4#A&>ucprW`Xu@I?(eRT*Y6c_=POC^uQ~Lh_Rk^n
z`19`s9vztQh2x^?d7n@%=BK7B^}A<<ACqiyoBTZe$%9kx_g&<^xjXOel-v29Gs449
zn;vR=6*AGua*oKMaJJQT{|qfP<nK+kKf})N&Q}zD_xbX+&c~cT=M=sE&vYnoUFDty
zfp22W0;Nvnc`6+FnyQ`7*DajCCoFg4k9#LK2XgHCu{W-0-ej>wWeIQCCAax(?zlC(
zrY>Zs)w8DJ2us76(rd+-7hb#wYC9}mEG@hC8S}#nix$0krQ%?*N11tHo7k3^0O5%}
zcdi?~wz1-=J@|V4wea3$|9k%*xp_H<O|nF4-nqBd+doC<ojllZ^I^fm===*R+j7Hv
zS4cg5;(ITMTWH6XFR61BGeR6Kq7<dl|87w1QGGBqL+!|v+f^xhLSzEfj;{7z8_-&R
zTG}Zio!foVhw4wCS4JvKiFdnRnEjKhp;XN_;cRQE9fMZXwUrgmH?#C=S+?b~uVD3^
zq`S;KdgYI&-!BAk-EiM6Fj*<>8%MwW|CnDV-4|-iVhit>GAq4yvp_-Me~lRlit!WQ
zi_iMVCMCPJG1s{kR#um6nZ?-R*xK9YZ0)y>r?q(Vys9}0zPsLgq%U0Eb@JKjx<7HM
z#kzvEkzFqq%ruB{Y0p2V^wOxvV@Lmele#%#JE!I!6E6H~ka8s|#7e_{ru4#Z8<s=`
zfnrxvT%|&7nj15hUd``bzjyqf%|-7qA5j028S+)XaHU1QwV2+5dlsB&vzPlkd$Q%f
zYwykb*VasYKg%|r-Jjp7TUO5G-Kx_IeWU&vNKf8oEW6>Cu)BRo4L8HPk3SVXJhe|2
z2i;!7{PVzvP^M(9L(5xzq@p4!A6`^{q}{x-{O&pK%($2d7cc%=x+3<%Iq;ChEa~39
zuqp+en!Gm>&JV@ER=qy3%vUm4AlisUsb%Ylzs<(|lB?{L4hNKKz3WK0xx4OeCtL5j
zAFsHN+5{=@sywA~$`mv=6wvs8v1`vM6UW6rx_Vu#irpq#pB87Dy*OXo|44Ug3}fr2
zIlg>B>DM-$w_6(8|Hx<0WtEGpK|w+~XBU-<KJDsydVcvM|H{IX_VP<-7g$FhJhZ}A
zV@H$9=6H!V#dFaXHkxX`H&504@5wFR9<X+y$;4wqZ4UQ!CVI^2GH)^d+}5J6b0AhK
zwNrg+W8?!PD=7|04JIXf_eF+6PP!zA@LBJ#Q$?jZ+II#<TlJ)=FT34na-&3L*@F)$
z?;k(<Hhq=ft@##Zf$PmZ-&n+5(0DgLXFi8k#)@B0b$O&zIli24W|#hZY?UETlfU1q
z#b5dq88dH$zGu7UdusVHokjQh#rZa>JdchLxV3O^Z|=-QFT1mgL{e5o^0D_Ul+9UM
zExg@Vb%9L*Yqngi$7Po*Tqox1pPbAyCq;W&Ld3#r;q`gGKTfRM+RXN0<MJ@$NI#w9
z{lOQXd+NvM2;aAOVI>(S&nxxR`GkAa-c2`6|Ng7?uw`wy`XftHHrn%WmndkM3D!_{
zxKa1QLTP{cCf&b34%ep{^K{NAD#~YAQk-lXGNUUb&8WWLfIrpJZLMq7_KZ2qn#qno
z1(Y)lXJ}ny3i);F#l@uhW9waiypj}izT)mxXz2Cn%#6ZSg(3@^4Xy7d>8|Pzobl=)
zzphNDBlE&L25S=580_3(bH&=rRz-4yM7G35&?x0?Mmy1q7GX@uKb|l|b>FWye<|=O
zFob2|2cf{vJdZy<zZ}kgv$gun#u}ZeCc?rCx1QRwRMm9XIdzt}&`d+U@{$`1>~_7%
zJi{L8c6`$#J?7m@g6dC$#&co)fPGdu7c?G!HJLa2+U_szfmhV|b5Fgs^~gPVbs_(R
zF5jXUlP+D!edl|3H@W>(oppO*2)~cbT9w6iLDzEE$=iLYSl?72zUq@gXw4pz^v9>Z
z3Z>ap#7Ato^k4VE7K8Qt+<y7X)C}7qCx&ExYPXBhsghi*@TIVcXL4`Tm53xA=88F5
zo%dC?o(egl#P>)4na^W`&u^O(Ocz)8<Z7r-sI#9pSLDJmv+JCXf9gy$(kh<x>_)~R
zfnX&K=c_rtY9^%S$rPG|tL=r)IJ|H>eusHsXjF{Jt10!N^ZXx83opJJ{_jKVQOV`Y
zY`P5ZFIgV2{Q8Qks~0&lIl6p(U})o8{zu4d!X@j)cKmsY#rGnX*qBydaW5-;`on3~
zFW*z#t{WOvKg`W|by?!0Zt(IYoKi=#lU!KTrt%&znYk`O=!KtvpaRQ;&y&})JuqQC
zX>^ufWJ*5UkB`TWx&29YX^vnzDtcU!*Xi}je>EGEMK5YD*Q;6AVCZ`Kk%L)g!l#WP
zYfjIqtL+n?(4BdbkE@3_&WdsQtaT?le%hR`+St>l5Oe$V3(%;dl<e7Fx8sxBL`74>
zo--eM$aLsSmUG?`t)MyE(j4md%>5EuthIFUW&hr|z>5y5^CuLyxw_?OXP9JN?%n%G
zNcC&7WtOY!s*5Z7r!3O-W#%!o>0FxFA=At_)xztfw*RV`MG^s;!DVYqY|b1gxmozo
zkzLmQI<K5a#N7E0!jk_y`;;o_f9SsV-}#d5#VZ&?EjQLgPWZzAHS^#>?w#wu?Avtc
z%E8B>y|1bn58C@Ke-)^5jkRWJ^0Z4~Qjy9BH=8HcUiLh3U4Dc1NAH%7UyGAU6-s1c
zu6)w~d2AP`iBeLsbyb7GTrN4;c216HUtOOmf~FH!J05YJ#6BrO;kHX{GZ%-iRnFIB
zt(&JL+A<=#YvhD17N1|YAW&w{nLzoM&2CdaN^C6rk|1L_TcYB`(nn2NAJlq#>SyHp
zURp3q_hZY!{I15I2?>J95|j2yZVH+r^2`6ii?5Q|B~x##+;o0P#=k$-8DHjEC(r)T
z%*FAM|FF_xyD9fP*;YpJE?#Dmrp9{gp{nuLNkRc4e{Wn+lK!3EWc6bHRU<3D%xZ80
z7+P8w+6t5j<>~nISLF8fU3vLZZH7bOyQw>8r)QbDE?i<4^w~37q|ED5-(o}m%S^^j
zYUu%t=~K8ibei}x-B)YlvN08w>O1-6zPxJ7mRTP!{JnE3Sv7aQ@$9Z(HhTwC%~<{K
z|5{Z<YYcWh+je$lFXyyYxu3yWp{&8?zfT%wrb=D6`R8%$<-{Wsn5K2<dvz_gm}We|
zfALg}2OHPvT+lf6N}JQ5f4%68rJkn*-^nj_F__>Oq1IaP_u|a<8oq_@`|K3#+1^~4
z(|HJ#siN-ig)Row-K#@;`=(v|xFqrD(FIZaR!(M4bPJ6y*_X2`S<bzW<7CBy0|I|4
za^}W`^Rl$>-XbK-HZkwAq{;-Nj42H>GnAFSf0sEYlFu-8cBxbL3Wg&MS(ol={fMqC
zm?bDa`&jSNHHP8EOqw%V-W3#1ufG><I=|}kV%us@q2P^%wk^JPtRHPAL>OgxEZR6B
z>z>ZTIVCDd{F|I>ufDh;KUeq>i&ln-RUXTfr9!5bA(QWgKU;jF@}0`2p1!3=WhcCV
zl?Yk_3O=h3xgQr)T@d~+t7Q8+Q-1pZ>l%%vvlAHX4>DIBeqfTfpj3VDlfUKK=PgWS
zoT8_%vMLNWvT`~lcyLp<l;aP-<J?k9R~c8a?V0uDuFbQl`JYytP(7h8;<-$)bgIwZ
z#oIUky2SlB+I0ED6M~yUJI=B^Ub(jQ(#s>K?}b?IbT41J^FqA4eujyPT4bir>t!7A
zqI&{QE;xK8Ra@@v$F#-_hP}r`SLp{zF5Gc}r!gQ%LpWfI9IwWrr~H>C4o~R2_R}_g
zq2h+kqV-YNIwl<|<$xx&i&`QIIyEIa!UAOiy}SQR>NJnB{&&iI^*Q_5_Y9WmIJKS0
z;{JW0{Z9AhxX&k=kIU4(s{eU1Fvn^~<>xKd`M;}U9T$K7x+b`PmSV=2-T7OTCO+br
z_Mmy<Z~x=shlM0RwHd!`^5^woe|W;;<h^I?86Vem$$h=Cec`l!XC%a$A}qH1v_DtR
zEAaZxqs6?jBr3@Er*~jR*TmC5GanxQ(k-aTy5h~ryo+BCOmNxx=l;dGBaeMEkMF(G
z-p)RC{_JC+|9y{MUY3+BlzIC7lG$pq$)*BjX_41X2yLDNnrQ?jyVg%q9NhDzPfyXl
zY}m@Y_{`s>@_XgQG`W_Z3#gp5@vrvod5ca8-&x~+U0ujzR|)6qZ1ykw-H+Gr;@Ob6
zG4W8vT8j^xJ#}k7mujhOJnCSl<*_kQb6d<m*ZhCRR_6+T@7bxOQDd(Zck;)>@~6KZ
zymyt>U+BoXMTl+oKcfn(h`D<rYfS}e53CN!aVuY^D|<}o`hg`~J&ubd&K2DKk-g3*
zk2lR|^6RPYtJpcXd{#-#e6P?~z9u!YxvPuqSW1pDc#`><+v=$oKQ4KA^r$EA={1Mk
zk6-HJX$hJ9Z(ptT_xpD)x4Yi@dF7gG=8IMG`<R)w#uZk1zTL2Jjj*uM`=!qpKVP};
zgN-6r#0t^3_MaF2-YB_R-zHr9<yFgO2haN}<zrU{#a(^c*6!A@A|z<@j~NF&Hu-f#
zEtH<TpZm2%&i`3k%<nq178I?i_qw>n(@?9&%TcXUCuO@qen8>+C)e1T^Ip2kGi)@`
znB+0VhO>2U4pYqX`{m_j(UT^s*El=A5t#3=F?I5?jj56Q9U5N32HvL4G+26xDUnOm
z&Z;a$LFHBOp1}A>K{551;-xa`kK8nQ@9r+sRa{j1RQda#T}>J8lahbfR<7E4-gfhw
z$NbCh7cbZHo>-Te`?NsIIhw0wGP9VAZMp`dXbEE=gW2IPGtMqpC}ki~EPL}vhJaIT
z(sW;Wwb=?a|JEdaP(C-i!9YD<@be2v%M+ZLCcM1WA%C($IA5;6vc`y^_?xl+q(0+^
zyH;O`Kb5ZLGx_{lozqF5Ts}8Kc6;o)c+tqp%$w;@*!2y4&3#X0C$nw*dW}~~fk{zI
zZOvoui+7Jdx+Zyf`Tbh=1tL#vjUHQ9uIjqn_4)tTY3eS|pM27{TWqhpJyGT4riiWQ
z1ur;VQU7d{F;jUf>tWq9?}W1hWw~}bmPk#XZa8_euREW7*u}IUi;4>>TlYP@X~|!4
z^0Hx)iuy)#gH@l>7WFojE<W{@b77=mP1FXln_l&r;jN82K4;hJoR*5?*|2pptjsbJ
zNDF_sIQbrv;vBP1gJaw8KlpC=e2(R>H^z(15^A5Wcp=dAqA_t@!dKVc*PG?)QyxmM
zKU?+YVd3=HHL_gJ4Z`~J|GUapnsSAGJf-n~<pamhmJ2D@T;+2XB^#Gb$(W<ItA}MZ
z^G0FjGNF6M@1Kg#JmLPXdzD+cPK>}JmzVY|3NKYswhOyP&QrB|#r%DJ;v<%G{+s3R
zc5eJQRr-|srDBenPm6Xi=(uo&m2SIMoTPhNOPBGmRR_rRphf6L0%BTL&ptot)U?f0
z3TT-i#O7x(dBW`ywJXMT4w?VX%)en)eeKHa{EO!<E(o-`d80i~Z>`9Z1u;&+42Nd&
z-@D#(*f~S1Qg_yg`6gdPCPhYv?b?+u?;Ahk_n*zC{kD5PwZH$do5OwioomWfBEK6#
z&lGvE^<KL8{rJ0BnWOTBk8fl-#h9+t|E91ySW|~f>gaV>DVg~}R~9#Isxj-3W}WTm
z+vBJgy0_beH_aw1>HBMw6Z>>iBj<T~tn&$Cw%&237c@dHEvw6%=<am9W}eN#3eLO7
z)lW7?|4E%+BQn=Pf>$cF!uFid+(uTO7K`~Q+a2P$tM*O$x5Dswney}EpXu|>dgR^T
z%jCa5xHfv`+WkAON8frl<I(Mty=C%_3lt(}oK!T-iQVC0xipGp>C*W%EXyuAc*JGM
zaLlg=SuDGl-|x^Jr-sRu{b&C2KV84+*@jOE9<MxRN-X?pqIAz~>B5Z-fp@$cQ~#aV
zwC12dLYAZ~biF~IiNG^CS#R%8wq7E~`}bTZZDwEh?<M=2xi|f7PH7y{X;0wEiea=C
zHxTgK`82J=FZtai=5Md&*H78GoLz91qTrMrvYSGak8WSEK+0%xdi1Y{zZ<qYSvSA7
z_}-en@=uTN&*?vQzlq%*rf7I3Ykt-7wFc?mX2`rUlMFneSTRXmMA7-;%O3Xk%AY5n
zbKAwp=>4ke=9KnLI_$lCS;9~^UR~wp{&Go>fQFKB;y?d+7hZIHnN{#r)TPHsaLG9l
zJ%L9TV_j5r^(QAqZH*D?vHU+(e4)jrh=#<n4q2oBPxnu@kv?pHzq0z%|6Sp+1?R5Z
zu3q!<wtJ=4l!b2h->Saf%d96C`+nvghAQ#YBaN>UCtmQ=aThySvDU@iI>~iYXZrb~
z@`%!jC*ICjaPilwi&2^ek<(1K?C5Q{@FD}Wj?T?}ak3Cc@Tw0N3$LtXb@lq;$24{A
z<>i@61CHLY*HY}fdhn)lMtl5|uPaZ8eeZvDbHz*djW2F7{(WJYVrcnv{^D&{&pfe7
zEIeoIzv^}V#pryM`E$?A^L>15ljxb>(}i}&`xh^8vp(|ex#x4c?^_Ppgx7qG{L~_`
zUwi-GU;VMWr?9CQrc83q@LIF$!=6LCMYri>N8DywxD&h`$Vy6fZ5l)3!^O#t(}IOO
zf(vJDSbjMBOJr>4izQ)Yx8`nly?#*rK)<Dc@cP|SQcLzsuCuwo*AetyHBDh!?6=AO
z`(CoSeaM%JKKpM@*ZsrGGRyDk?e0Hx`bp!C?udywsmGE_WH=UUM%=N<Oggswc0ia`
z%3Y&csW~SvpRN0}Q8fOG8dFL9UA9MwH;>HM_gYo|=FZO4Q%?$~$4^pIJHBa6-_lEc
zY%Ol?(0&RB_XKHoF)`k4g6!M=eW=Q^<2={-tM18GfkT!*pGhxvT>Sg>E04I;Gj3D<
zN?c#)=Jjl?`rKW!+~p5x9dTFf`#Qr@$hy4XT*^mXk?9+!gsU!iBODuVy}*8k*Yc!I
zX{HAE;@kP#1;1TnkMQ7pZD??3ZT4n$w^`Dk<EMp&1^sXUEmH!mYH;goG`N4UFlAYc
zWcSJT({}#~zHeIkx}C=_FV!SzwVm~26OBqyql4ie<nETVY?8UPx%!^>`E2<%?WTe^
z4t?AcS8Y74+}7^9VG)PrlAeFRzD~awBRMJ4;Pr=JEBIRZ7jCVe`2NgggI^|V6_wMn
z-~B(f>f#(TopW`+IBoVG`)WAVM1GQOaCqRkpBoJi+eOTcVLQLO`lpdm8iQYwpP@?U
z-jljT(z2i9r>Xn%=y8G85a_}><NPH)e)Bdw@im;iu<+fXNk^kN1GRhn9j3T%yA*ub
z@3;B2&sUCA2u<ajkvVshXFylf*#ODa0)C>o$6PekX0P};r{b^aLF=PMBJ4peJ0ENf
zUwrtNqx-d)x7=H^B2@C-92cLqe=loo@67byYFDSk`5S7z%lmB?9bFN0werw@zV$_?
zvu4^<D$NBI<)8%wC0n!3HC*UoOnl~LlYQ0S{=|ZAzFi9z@~QW#+5Y;qN&egnmv4zP
ztS8R<k+y07ERoiUrHfBh#%0-cHl7S(wElL9+qG~;j-+$EOOj2g#<nG^11#qY=kEyX
zc08qXcV_|P)J2JfAFKC@n0UGH7M%FNw)XR)hEU51C$BF}3U@o4Ki^ooTEMvA*<pT$
z8~<FUs;5L=yYNLOqa<fzPv10fx6x)L&p*esLki3fKeCzzPSbSYdfF|L-ZjyrUO&0^
zanJ8}%VhaFx}s8chwD7g@$Emm<C|BRTAb?H8$G{HaYcPxk-hYQ>CUM$#9R-ZNM^}S
zwYii#V~(O?*b*(%TSv{Gzf`Z>xc~hP##@P9Mul?wLqwM^axBX`xk2Fci;T#_MIH5^
zxk!*Z@=UCju^;;Kip3!!=w0*&AHUd1-&5){m2CPXeRk|R?|&wjz4zJP4{OSzfBaf4
zFl9n!e6H@=28*KTWxjVee+pNMzEr~hDxxm4=z0A9pIpqJ4?JV*(Azn6`7@i>?f;sr
zmpcTO{=K+CT)Qu|f#vx^D-oSJUw<fXTo7n>k;`JI`}e!rVJ~iFSget?3pu)C+Rlrc
zq82?o8heZ9Cny?=L7R{>@^bhD%9u*FINxyTSWy>lryg)6<FBfak>`SmD=RAQ+f6NW
z3YcgzeY3%fOHWdQ9(oq>q+fV=(>05`x8}<Fpvg1ubR9oY`QpXodXM7?hg<d+JH9mF
z(bM?b67%`h{5l1mwqVz4rsMIYmNKg~|4TJE3NO~V9COmhDvD1k*LZ?4v_X9O#SA$P
zYjJZmStswAbC%>iV!syNH)-;*Eo=|v9XPBF%M-tzx7T~|)99yOlkGCrO&`xUvu}Jn
z>-&<;^Q&U6&hD9-UzE=9^};;cmWh)DCg1T=;C-%m()h{!0>4<hG=*e!lUYp61y8@<
z-_&n*@soINbI1h^y%li@piPCk*(uUY3qf&JvZbfb?f5fBP;q)Juq7;Y`{kA2df0k{
zR8C%DXVbdyczgNVTTc`}$5k~d3dk&CIG>jB>u&j**!}a2Gnib;4D0LvFY7hz;$9R!
z!FS6a-&b|9GgJ)!PZclZXg+*$b;PHCyX)=0+LpVuJA17D{qIco(r=>M4W7T>kXo`u
z$Ig3yNzEc-@EUeE_tlRX5<NYmO4UkaF3v1UHQA=PblUfSElhz~n$B~V%rTeQ*5kPN
zjhi0#g4X}r9(CU{mfzE#<hLj?<Cyo)p2zEV^*GF$AUi8IS%0U4<Koh%%9Em-U$QS_
ztM^~vy;y;F!h`t9$@e*>R70m`NP1l5NRgCXd+ovmr5OgjT#T}?UgRqahZ{356uJ~P
z-tTuxJu^K$?*75Ev$vn0z5B&m^B^&YN9>23eq<WU?=aUnSNkqgtUvtf&K1{ZAKIWi
z(at%?s>agl;|#Wme<e>of8rT>)l<$VM?1ELhhfQmeIXO8u5>1D<8!B$+ZRNi^(mNg
z{q~;B_ZQaeQmTw=_RT(FWEFMz5@=2Yx=`tCuP)0W!Iy^XgBK<rWK^uJRmu9dE$!?M
zZM}u-{U-}8>JPQAaqmu;{JfDl(c_!CwTX_ATtK(C{V#=NDPHFrp7M9?%J~FNY~eiS
zWU#^UZk0uQ=DPT$t8BKNo8wsj;L7bPgHueqi#|W`bmx;#t71u9ek(Y)_r?q^sk1v*
zSpThk&c_w}+~)I=!lk7tGo@usZpFNUMAS34;>A~a6nxg7JJKt=DW&94X}F`8=V|Z9
zkDs1?nEf_(e_nm8Y_qV$lZNH)n#&@x|DD!1`zbQ{|8?07J*8hJp5c7i`sQp;(t;WW
zzq*5qqc5-TuQ@EG+GMsAv>K??sUdL6-R%pfMRp{bAMz;F*|{X(+sx>R+KUa_)|S+r
zHnNIJRbA^}3oB{B(<pPfWKUb4+fZ>M=lLVokPs(#l^q7T{ZglI<Tc2*_MKr)>A82V
zmHSw1o#z*xH3d3{zt5_%;=5zEx^1o`qx@T^lywT-e|+knUTG>alxeM=xhZe5nY~tQ
zqrV#Or_FgGmT$Waw3cg0IBnKhyx8>76tjbtkTRrX%b6CYL*Ihtg|D7Ay`;g~%qS{j
zTDRFVPVUMTYxOd2-7S~N$VixLBeBRL`JU|Lo2I7wUhUbu*<SfsMDERk)*~+0uk*d}
z|E87}`?dA?vON_>X&P^ygoq?AvvE1hA1WJlV3W?`#Z&XaYlA?ODAO7RO7%))D!o3g
z2<{HJcdlc(RY;)TjnvO^71Jt2{}|43i254w=ktNaQ2RQ0zL^DQr@EZja4zQS6VA--
z!CBnRVw0jLUtP{q&#q&c9+48le4gXM!|O-CrJGCfolH_ZJh_tJhIR41nIVp0>i)YH
zu9;G+0}5_7=++L<aubf|b$6H(qqhF^aOg5))T*(MV(gcduNPaXYs8bfEc5@_U^Ugb
zdlj03Zghou^v4K0F4nhG7dSefr@JS&!8<bMU*-FZz!k4-p0dc@+H8I6w>#(SQ~CSP
zNqo(WoVN3#<6`Gcr$M{2%%x<{_C9lCPF%f6*?P(HgWKHQmzfG2ciMC6SEBQz=;e1S
zrOW1j;1Ri^q^MW#AF}_`r6-D6$|<j`ew#~f{#kzEg|zKqrRO;_Ean}xFMF>fIOT)C
zhv<ovNAl6(b^qUfv)o+y>hIUD2eJ;ge2kGWTqs%Wt9yD=Pv2p0hkYeR(86f(;)@%n
zHeASh6JfnIaPckAo10Vq*;E+ZDDhnBP;&XktBup+R!miWzxT35VD0&NnKRW^U7y;Y
zQXkQG>9SgrTmC*nNt3QDxyla@wyibf54fPwl=`UEIUW?E%K~3^f{I@7<d~G~+GmUp
zPfVI*@@k0#2k)}b=*5rEw7(OsJzMkPUeAjaO+hs~Im6=@iavWLdvCvdaN)bp=hJ#B
z66@UpOlE2uzuVM3^Q~T0&pPI6i@NUnua8z7__=<M#nWlCIU5rHx}-)<OD)mKwuO$#
zf(DYV@+i2>6_7pcuiN&qX#E_9hljtfPS1ZBy*~X;ql@IWAdaZok3XYkmVJMlbRt#0
ze#Rblr7x|%XVhituRir<>or=?G*|jq|K+aK$Y~c1w@ckra{vumgCfk$UE5Zm%q>sH
ze(6q!8^2yyeElZ3>UPZc(+i$l>sqIp{p)+`>vgK#haa_MulrG5^XEb1NoTdVdehne
zemyRaVwtTI!D=+s_OjO|ozq6<&&*#!J0XjAUUZ1~@#4hh=9J1+AH!odWyY9txUWxO
zlI4`L4gRNia#7;OO}8^s_HNiwdTdMJ^1tRMTeAK{U;F*|l(GL+FSo*+?BlDWrlm^C
zwu^1&>;#$m%<c4x3<VvDr*a(rnkS<bWNM$S{2X8NZpHHN$8RzIT{L^uIosl+&-ZpJ
zq-xhTi!T3bo)dIIBXItXR?ka||K`6uE-&!+(z}nVrlm$+`|xPdLf4t8&}}zA6+qh+
zK3tq=+qk0U+O(CEQ(s>VpW?s&ci*bdyL?|>ti9TQKeO=k7R{^A=gZ!e54e)^%k%E~
z-npwjeVO#_)Cof?wbaOIp;`()`jGZ7DAUREwpfPGV^(C@u`z4QhxZrm-S-gSRhECH
z?e4qd)utQ&K0KVUc{dx=naMqKmh|*Z1FhN=h<$wuUW>RLpM1*OYg2a0^J#8^&o*oA
zo~Bc|T|Bq3{rfvsj_>(vmTxb(7`;9`zMw3}|7zd1^<XnJO&_s<dV=7!61t0%S2HG7
zNpjqdOR|ZqpS(NX{Mj7ifA-bo4YzmowkBTLZKUEAeXcv#v%u)`-mM3{8@ISkIz8*$
z)V0ht-47a1#A`p-w(<(vu<}kr@tuyo7ae_%j<G4+5t3bA_qO0t@~*&1vzi5DFAB;Y
z?R_D^o>-U7m^i&jX5nHL+tTe*C9D=Hn{&xt+{noBnb~RK;w9{|Qnk10dpIu&g0x)R
zXvyKtdG-74C6A|=m}up>xO=v93mi*!DtY2o;^Lmy(`;}h?WM)!{tJOYZpZBs_G>%2
zm$-n@owG}8u8CxD=f!ZHKam^i$vM|c`RhVu^F_*5MT?mfc(!<2om;wCWNAy^Bzu3G
z(!1AVnQfq2Ls&Vsd%G)yc)ifjWH?lDM}lAW;zViImXp4(7by#9sh3RovbuYgfNU$s
zvz&|%-CmsFoYXsK$`a@Q(>Zs?^Ui4RI|;IBal?ncmmCa2R?Adm?>j<F0sD(1`trs3
z>MGkqgD3edm1_C81LE0<(&gTo)6f3*IsHH~(Mib4>+)6wh-aR-U2QhF7v>PrV4%(^
zyY#jpzwA!1o>2Zn@=KHjygpqBta|69_Qb6uN64yZaf8AB(54F)R;ZMm@ocZ_UE~Z7
z5)pyC6TPPsGD0TZUS;{R;<-Xev?$0N))syTcZDe}eU>k;yq~{Y@6!6+eBjUzbeM7H
zSDTwEr>yBzbAe;d?yz9rZaw|e#;21@*bY^DT<Ym_=;*uC(f59#vbh%Dp<mnBopu{d
z5^{3aJ-pTdoFHCw^sQolSoU%Tvy*30bZC3dn?hx)suw4EUvRYC;b@uE(q}3A`)`#?
zJ19V3Xeiv#l5O9s!YSJ*Abas*Zm40Rfx?-!wj8RSFJ^pt-syb3_TuJuvp`n9Sm7hU
zcX<2XW1?2`x+l+6d77g9oVV`d1#sA0oGATRfv3Ii?#-3nlZ2d(O9?DewgN~0B?pPu
z>l`KWSNctA>9c1Ar=~3voBLKVDO%|{%P&cYHusuz;p2_+_I>}ueJzgnzUb(Cp`pOj
z-go%lb7yx?r{lqu%!#1nvM{;YoQvaPp{9A5yp`7^sRjYrsb21RF7CEk92W~EcgbIu
zwep%&_rG_;{x<?VkQDRc21AR~Z<cKf7puG!7C83U4HT+hE=-ixzrFWLr-!A&6F1Kw
zTPAQy0Yw9|LQna%fS@U@eUp|1-`^T6Z&jphwP^9}Rjb$)t(X+8yo8`0Tl9Ew2)|Q_
zkKn`$fs>Y9l4}8F#}&(WT@d8hX_%Z5@<PKic)$M=DNrDA$u=`4X7O`5EnKW}HnslM
z@9#4VB+Sz;Oq4#_d$7S^>u;uoI|3)&bClo$rG1cFHVSe)Jue)^E~~29=K#$qCDEpr
z-jzxy?S1k7oGN>Zle_1vs1^LOwjk*zZY6tI5^YL!B5fvI2sAR0GL;5dylC+S!wdC{
zidK594lR9?8YW0zG}Hx!z!?@rD<@YkCwI?cQI3m(poDo*Q1*871nJ3TsVaF>Ow4QD
zI{KVIfm^bMNzv+AbAXfk$#p&kAj?46<TwMz@sG3H5>GQOZ0Wmn%Ham9=?+Oy`Lama
z>J^v3zkHef@4hOPn3!lSTwGGG-~u+u#l6)r;{LHaGm5@VZRxudBLzxxg0i_!3Kp+&
znBnKHFy%<^C7Un7n)#`o{GiyVEpl;Ja5?_@g6f<w)rE^gz6EQR7AjkD$>w{xGbUE8
z|JV>9Wc6y^>~=jr#}W~%b!U5DXeiVOSnXTF)9dBrzVglUpnbVn;#RL_2wE*#+)!|}
zq(-uMo}ibIRhC}uftHQi-hxWD?V%SZN|*naKYl*xkbc!!riChni?bZT+3dxO$%~s5
zdfNLe)onbT+^4Q%{Qynxf#D4TvY^1?l%2|UsK$Izavda(y#VJicwTgv5%bCT(42*V
zo=)y(mvTTOxY6LAu0uo-pZ}zmKCP#lpLuu{fRfn`!!RQbQTB%uSe-nD%%?4lkrrMA
zE=7Mm+3`DBM!)Njr)RpXr;ydR#2*X6`D>A~6`Ny(ynvdDr_=FEvFB|{zJMG!QTpOX
zErCUkD@{zaJb&Hras(F*R$Q{Pn+0UgJD<C-LWNT{*z$O9-s(llR$BLae=0mVc71kJ
zz@&dU@B4~xU7N<hmmcolS=)En*FN!h8B=ZTt4(=3V?ys-I3VD&yv_etXZ?)>KSj>>
zlms^0|GRoDvb7IV8^p-9ym;}cMMZP9Jj<?18R32NpvkC)#VMBg(6w%tNmGJ1?=DYR
z!d)U_B?V4T$Ir&Re!Oh6-T_asUav`;s#!rv5|j-lN;`uB|2yMC70ujj1;5qafQouh
zrSeE&&%XY5$M%(0I!$6}dC}2lS*UEaDA|bPVxb1e5TmTRD=Ei7Wl0?*4LNhSOj^?N
zuloP?+MPBRA%VxmF?sg6Dsh2bHj197R&mZSkg?*D{d}jRkLl3XONAwsPLsCy!Lqxu
zRbJm#JCoP9)`#YI?KPUTWJ+1!p+aR)@o;P6;okGj2KWBFPq~=kH)%;)_1<e2CQ5@m
z5O}`XK*H*qSno3x&r@uQ;5?~p&ZKB1*R|Iu({qyRVyEM0z-l=zehhd!^`zIND_o$I
ze^F4@*zrVfFyo;mDxSX1C7?pFqwfVr%gmBFSznbry(VpWecSBP*~v$GU!3S=lf772
z9CaY%1xL$IPay#}CurqSV#A)e=W*+m^)Eygs&GO>b*G^0Vg;U-KIhk;T)ZYNd3$vZ
zw8pa1V|FT$iJj-+HAzH8(wqy_i1-nw;Bx%p)6Oj_p1v_LFEsL8+)GSe?6Be3S-9$G
zw~DG~(0?6{Qe{w?;&S{xgHy>DrHLx3jRhIE(_gjraV~sp<>X!x!_)HO#&%G&1Uc-m
zbx+U%$GUsTlVfLdug9*rHh=DyAm@!4A(N(D%7#>LFFN|VnhdTrOI-Z8K}o=CQiA|E
z<4lwmWldBlk?D3_JZZ_CwrwXv<Uv7Nqzo#W&pBv#dad$jQ8Zt)_(C8*W1^MpWJhpP
zT)A(Hv!=f{gR~V$rm^7z^QDgw+3y3DJWs92FK-W;XU5{}zA)M8#R`YlOo~?E<iMV2
z0c!Ms%eu3%*KO~wJ=EL>@<Ndoqk!I}Rd+l3K>2-zwu1z};PPAFQh#^f`fu|t?WKz6
zuBI}Ol!m=!mZ!j?$2FWS55pe1c|vNA#TP!>D7YL?)-C+4>+SA2DY&Jup|$|zWJA>w
z7N-)Mvb&!?IJ<iWE!ek47L>4GXq3d*bL=#1t$Cs0DdlB6?US*Z3p9Qed=@<3p!AP5
z>U^J!=cR9rO&>2@TmUK;%oja=mVG_;mEZd1k0WM<F5r_@1xNo*LD{G3$EyY0oR2#M
z=UQI4zG~8xOCj;>HYH!SYJoz>knd2yi;6X^?=A#R3bLB=?M_-JEU(xr%KFEqnw3nM
zGWE1@vgT`UP&(Zi=<p-)#Sgh|x6})PpbCZ;6d_r%3QvwLe51iFtE$P^l4?HH2$HA+
z9cFkOXBOa+RZYFJ{r1W!6+X~VJo|swyFJ@8xnz&u5}3$i<#h^D<2QraC=NUB|KGIS
z%jI~&X4l0|?w+2$OZOhChG&Sz3x?M?Ia>QBO_I9L1a4ipxHCSqzE(QFrLSDi|HOjD
zOP260^-PtsTC~^^)HG9YIsUh<fp_8JB|Us^-<^LX18Jr<eE9n-`R<EPEkU2Qu3ED1
zuJ6`=!J1C)kbp^M;<#AI;>0PtwCC5Rx!JWFU%m$wv*4zW`TcLd-C0wP_A*-eZT<Ra
z`h`HR6*>K}=GUb-!HHH-cIQW#mX8-c&h&H8kSv)pX;!vxr}R!i+3V&nI{J1owM@M5
z@!Fz5PT8ePmR&lxbs4y&`{G2eLq}iy?sJ=?KW$w#<<i2mW^lW{c5N4^1*qrm@nXfA
zIZ81*nZW_RNZD$ge9Ik+Ysa*Iepg?(_{#LVF{@!N<S>4jadCx8bDvkVN!075&)iR5
zUj;2RKL7vw&rU67R-e1Vl$Jg(riV3>Eg#b$h3vXL8XS)oChxhuu40v!llxMW>qV^$
zph8Vh_TtCOrK}vy3m@OTw<yq)O?K+#h+D~PXD);Ua5Kn-VxS6msmZk*cmXP~=<&ig
zd&KMOCtV0^-xO`h0curGl)hN_SHZ=7y1L5A1<78A+nE(%mBQD?3DW5bQ&dWPUWL4l
zJgyE4P4oNrd81xbY|03kRI_&0m5tXfZ<V$8g{FrJ{zD1tmnvJ`E4>=*GwFii(v{Oz
zFxVT)UWDe0ynXdQKW*XQyJ&deP@cx^=dbT8dJ0+jE$!U>Zt^8?ncdp=T%kw2K-sG9
zbsSsb9=kazCl@^4p#Um8L4nV7=(W@Fjqk)v6wSSatd8mXt6T=R-**avTF}pL>8b9m
zc%k9>!eYu>`LmXw;u4e`rK4M={XG?2K+W0PQSw%tpuBTYP&U}1qpv*HQ&GmsYm#4V
px%A3w{@$Q8YF%_eQ1(9)&)w7&YyW@V#K6G7;OXk;vd$@?2>@AW#8UtO

diff --git a/frontend/editor/public/og_images/split-by-sections.png b/frontend/editor/public/og_images/split-by-sections.png
deleted file mode 100644
index e3601ddda30c69c034c9b29e3e31acbf35b1d512..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 61572
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H%VzPZ!6K3dT2g8q@Ej
z%N+msSGn0qbyAj)i;%~qoC(Xgq|TZ}J8an4(4(8@{nlx^bnYhK%NM*HH*aYvRaxC8
zGLdy@ZnWcOv%6Nlla$Isr{BB#{wBYHLBdVl^RM5s9{A4q<G|-@;_dwZWf@Xly?$;q
z^Ut$1iwmBURGI}E>gTjZM>|eZakb!JOjxq;p_^Isjhmd4R5TAcaxf_O_HysM^ZM>x
z1<gY$k}V7c%T{X6Z9Q6J=P^m8*}#b*W%lfRUmp?fRt3*VJcl?KC*)>E&YD#fti$Fx
zDMi4Iqv7JVZ6#vU&NzXjEf_!eR{#F=r6e<7-(`l1Cz~QePifh@b7w+MJrzit1TufZ
z>sLnHk9{Yl2rwP^`R<){ak1x8AtfJ>Lm7@$SG_xbUfmPMSM!_alb+aN>^X_YiDAZ@
zx3SSNJcVkWlN>o1#DD*~79Qp_2jmE*155w?yZ`<k??td&L*$P?2b)38bz)F5i3u)F
zO?YtLy}wDt(};ty<3d61+p7l;uKoHIqGHk9R%`$HV9ziKEcA)J`{u%h)4jbA$wzZq
zi)WsB*DdY{cDsv4aQysphyGj(n*jEk;ICINE=u3bNvyU8g_b}AN3V&A&Xc0`<>k##
z+h#6XRw5?$`6t9Yr7xw$pVxMFCM^_D0eQorWs|P1cW`ii*HNeflUuiDojWusQUfeK
z=iIjK`u_gYzkP$bKEnO@t1~`JWB4YioK#>@aN3!C931pc43A3J?f!l4&K#)LCFkVr
z>+0+5JSQo5PEwL-VKAtB)Do%T8MLQafI;uew{^ODY@U-uo-434oV>jJdU#lqif31`
z0Mmh^`}W-r3vX8OEKCyshphd(yWC*!3%u2-`S&4lg33vS9svfP>sMkVB`P*<6I1c*
zDiB~|IJ|XhI6M3H`8J#|)pu^*;D98%257*hpKns}6y$SaPza8<pMLU*xp^~$|KPN;
z`=!W;8~6C28YZ^2N#A_4dhT2W&!CoO0S1Z8oR||&yMES8fTY_wnOR2Ms-7P~X5GG1
zlby8a$E#4NT+g;`dcMAUHN~KYCu~`(JGWJJa{$=C49BdjrY&FYU0v-M6uK>3!)EW^
zFCTurIaU66`}w|i&0hkl^lWF%<Ga)--@<SpBK<iuyjLyu+WF<dt^VtFHSg~{biOZF
z_1k{pynX*J{(fn(W{S6?)s1EWh7+Zwp@(&*eEIS0(9`l;mp#K&_4eQX_~V(rqt%CI
z0S1fvcWWVWl6l|z)YIGP?w5JPTJ!4uMJ^5Df>>DLf8OrAljqW;!f(x&Uw&B?_44x{
zm!%PGiVOu0udLj9^r%9nyw{}p_J37mV?*C9?`L<K#G(nx5kB9(*~P{2P5O7XZtsU$
ztL^{9!_@0Jf<l@F7<SyazJ1>(@#^OfuY~OS_i_J|Yq~yFjHwrNucel~oqBO=VQgwl
zb#tI%37d(MuUbRX6~;GReBa(Fguk@7p|Q=8G4R$Ahez)ti@yKaq$0yNp={Foa=Yz0
z73VD<s=V1Vzw-WPo7DIm0T#zy(b2-L_dmIE2)EuZ*}CuVqdZ5276t|eh7(`D*N4XT
z?&N5SFrVI3cJuhtNk`<iJTLz9eCHnX6RdgF>Ce?mla9@5h>b35kKb8${a%01H~uFg
zbGUA7%D?-}Hgf0jQY+c~Jed{&1_p)(v3)C7AMRmsTqE@Mcz^r8ztd%N49=!IW&4_b
z6@5~7VqyM2)0l3j+;H*r`M;O1dskWade3sb1dB<rDN~K7$L(}oX5QjHb!&ZX(v=Ox
z`8_YMn!n|``ugji9pwT}AlI^Rvsf}R=F8h3+r#2`Z07Oh{<jXYaf_XOU-^HY-tkxt
z?!RJz$-f@f-70v;vp&E2*hZ&ddF7gAx=TzCf1E#4?C*?Xqa{n8&gfgYVwJIc@n5ld
z*V+U?HNhUG2o0S(+t#k#D7aaeMY7myTh5lPyg`41mc_D&EB5^VCI8%P&3e5v_It~|
zZg_rY+sy0RV?}FE#GG7}C3oAM<NUN3L;1-wqt9I5&8f)3z`(Ge_3hcS@ow@gjz!P^
z<XDUL{C_t8snjwJ4RysO&w27)+9vXD;!eD`Co-&N*1Lbr?z5CDe=A*)E?*J$XIt&V
zPYtR6qU&x;h{(;3DB1Mn>+CSS=ZdGjJkKXCFm;%A@FuHz`;Qyt#?wnmOK-b#WWSz2
zqkm`gw-4M*V7n{2ymaj3ByL>1)HIXJXqAFg{?gtYgGi-{x~E35O}hoM)J~k9#5a+v
zPopK%F7EOFyX<UipSsWe(u;7mI&y4Ft4f#ueDjU-drdBVS@CjneX8W0>&s&|6)k@G
z<B;(4m!-cs6kSC{^Q{yNRIW9!^}o{uB_oFw4g$(zvQxVFwNoxC3EtoOp~vg%%B`ZG
zMO%^uqK<5C<&~TJDfai~<t26RoGQ+g|5|)T`AK6;%Y=L1Eb0sA`fWEgm=n{XJULy@
zuI`so_k)S%MdD6g{`va4-jlN4@mf20Px;bi+ZvE>Fvli(SF-<=Z3|93x-5QY(IOsj
zy5sovfkT|@@sUL?GeZ_nNv%4?y~nn{y4p}?l4nff)&M0%-8YN4#5kIIM51pfTy1{&
zI%E0dVsR&{C06#+RVFMJ5PJOQ=;KGGcXB60YT1;3)GB71<~yTD;FkRxr;Z&H!AT_1
z$#IQKO@NkXphtg&<|lP6&!0CuLp@@jU!Q*3d(q<Ew==`C_A79-d^mMap|;+B?##sk
zLHV7RVsA@wZs`{=+h6n6xK^-SG-ZZiy6f}f{$lb9Edov)j0_A6?F)rC79Cl{EM%zr
zcd6#nn{i!AX)p6lWWEONxG|SATtjc=)!O+POzF23I9euLS*K(@+0s~Cafy(Td9u>U
zzi)I}GH0?b@l0;M^(*p5<?Ny>cUvZG+Y|J=OS=5jDf!U-Re!_s4GKa&vh%NgcSnEy
zx?F{=kVKz+=bNW@J*QD;;cfNJU(D-1saNfK;@kb<i;C`+SoLg{Mgh4nuc&wT7Yi4O
zANt}cEWc#ggdaEKIheOaZBR=pFL*OKz1M1PA5Xgfjk@k+rfsa!{)=9}um7~=<D;ju
zPtJOC)BD;i`(h7%_E|zwlMn1^{L7hn<~2|1|FtHylV3)*I<v*>Eu8){Gx~RX)8pr6
zIs6M3Sr|WGXEURwWw*ek!xNr`%LiS3cIxYHXSNH!4gbBUjb{I=7b14`i_m7V^|rHu
zeYWTA2wE4izkR2-&uiDJ?Nd#^nk?A(bLr3MU-_=Qpk#4CKH=s21tC7S?JnCs-6=ff
z=$T9Nc{RR$;}YbE`I_cdSsm}~cde}aFr&bcT~0GBlTWpapMRNir**=u*b7BUk@KBf
zE|mYvD$br|_WHWr+G&!Xe{O#Fy!GF+!!_b-%=k3+))a?$ciaE^WvD*?`SyD?455{Y
z@vpf%d(6c)1gfX;-2CMA>r^a<a?<28#{;hOUULlz+V}s$Yn3xPrI9D6z1%nR_JebK
zFCLaP$~=}d$^Wz8UzXe>rTU;e+^}@N#>5Ld-cFwOZ_^%;R+Y>$^&pj!x4&iHJ}%Z)
zc0TU&TY$yM!p`sK`lM<1Ejb^C*W2$*b1ik0)12?z5|D2YQPW^x@kznB&2`R;h`n*|
z1r-03zTNh2-o5{S<c{n~@>f)eioSpTbM*0l*;##JJUe@@e46)nf~LLx;$^aVD&P#g
z!6D(!x5@x5&(J^lx6=)O&JcERd&MX3cxH*`lGeW$oKk8U1@3ilnD#77KKS^ux<2dM
zq$%eWojm^D*Uj>r^i0CI?dF!u!X;s=OFIPWzF)qy!#VRyy^LzhGwxck@Bq&lzT#2o
zXJSwO)pG>pfgMFhr>9uv{x(_t<57x=;av4Q4S$1|-8p~m-Tyz5VGRx(?%qwu!?)Zq
zzjb==>eZ^3i`NKTGMeuCcR_5ovzyplokYPyyN>%O@n><oQq8byliRphex}oJo8!tY
zKCijixfC~_oP6&;|Gv7zycORT&9wB7tXz83P-Xj<DGIi~Jn|)+I2ai8c%}aOrrhb5
z511HK{`(4_&+M?ckR|dG4bln%PJJ1BZ10DK^*k(+mx{ND;aIt2sq5d4-s?P)mHWO(
zbqg42?yb6A!&5yq@SW2MrmK@~?$PeqqGg~mt?JHgcaD|s{HooT7rxY2G(G)D;&NW^
z@lXB{GR~r2XJ?l=a4<47)F-^ucT+LR{c=2{=Ar&g;VJKaX0BT9-!7&k;H3BD%(u5y
zpJ(+wT`3UME8P8Sqg8@<e9MGYcP}J-o-}Wp*df-_%rD-}yyw}?nzrJOhH=|9*R$+v
zVzwurxc%>5xh5zhFr1hAD>}(;r&8;^dGG!>s-Kw^TKJ4-i$J3Q-|?TmjDKruOBCu`
zCnRmG(fGJx)3uTtpT*B!DZL;gq{z;tIJI=)G5#|K)m#hzw>jwX+6b9OzPWyDr#Txa
z)Eex2|IO&q&vVweTzM$gbB^uqZCkD++)9^pRA`C+`?oCSjQF$nP3N5?M1-<0ZmpZO
zebv5)n$wLf0yyN2uDxP$+F`13s74}mUm{z;ai`CWt5#HSC^9fGJkR-ZT<7mjQ$r=e
zyOI-Z^5rrWTNoP!ggle_)2Gj{XTQgt`0*vTj%aYk^yJg4&ChAJc!%YgNbsCfZn@p8
zq}Z~Kje%joMfnbMO%pDYx;ozL>z$<q%EdsXSaf!F#)i`ziTU~WeZIwUTo(Jc&-Tfy
z-rZZQudHk-$hTOWE8xVTsLjB@aHypzqVvX<N8CRB%I%_?6wQT~=*RzCw1($X!;Xal
zV!w1>z0O!Zah*!bltaSLcWyZ}dv8i^*uBnm@8r}4549Yg2{MO)p<$x*U(vqBx6~~j
zS>`<F%t%bGv=m_~lvms%vZdN#`Q~d|x5(R>%&~o|;^fiU;r;AU%dvFsmFf=<9B4S)
zI^hbR69=e7xZUJduP}Y<XBJR<EjIY^r+Ezy9Nx_3Q6HV=p7q^&v^6Gog2su{vwwH{
zwg#-f9&B7S|7EvD*27!9j&tYES7`A8xAxxLdeJ}apGU}>3orNsJg+A3&F9<l!MAoV
zcQq4};-2ys3%0Iv>Q^WVcU+`oJ$aYxruA`AulHWPW`A>s^U;f(f0@f(|N5=iBEqpy
zo0)+j;|se|i*orqhJ#Fwehv=V&df`ab|?rq)z;U4o*TV*)4?L&tY0blRm^1qPHLi|
zrS&_`ZfRAvQnan%P%J4|<oWg?AyJ-zfr0OGM)G3&s9)Zp7Rih41=IzL|Cl&#2#DB`
z8yy`id?m?4fMemh?cXzB9u2(t;O&hWDV+`L^86K3K7G1+yZNMh-G{Hqf=*d~7!;Q{
zaO`9%Wno~jGyBENY4lRUE;}Q!+MAn&xluss^6hW?{(U(ac=N$g*=YXS&-%NzIJZpj
ze7$>{ZQ}39ITP3%I22oyne$l~7CiD6%U@l~)LW!8SG@t!miqWf)r7gQSn*B8zct%3
zOjJ`o75lG?JQ#DU(dk4=z0<7%r;7gvl{pk!CJ5Vvx-&31EViHUa_Ir{nlmd@CK+pm
zUf*3lf%k}P>xG1jwX2@2YdW&{jB=#C?^5ks?i|Hj{*hPqY+@H(cDUs4-+kO+(K3-$
zPsLgUoKEC_+sFhC=oK@MTkJPh2+>m2eUq2nT%_<$xut6Ex|i2_18*iodM!E@?K!>J
zOmWGP6~VfFI(D^;P8^CQg$w!^5^k&O{#8Ap^6t(H{uL}?Kdc%HS{JEU?OML~?$f<Y
zjRIM_cg>5ju-B5_Be%{=q}KcTrsV?9#OFTMXaSc|p6i`CEV&dtO~n=eyi?~;yduc(
zAf@*o!vfR9?Ao&qJAx`b*DiaxX|)$ClVVQ&uPyIfK4y5II8y(Yf7gV$tsjoe4C<a$
z{`y_BqO$+o-6@4B2R{}IIQ2QrD6qI(<52J<eqU5<?A<R)^IHsD6n@Cd$t`1Hu25$1
z+y6yeRj4TE3wuM9*2Z_{0xlI*yOw|o!%e%je}5|oKe+17n?pxG&*Z)t$?=lYq5GF(
zoOw!$U*prWOP_nMcjU0-dN}co(r3nK=EJ`Jmp*)9&2ODx9pJt~nV}~83%kQ6nYrpY
zPFuEr-})pa*T0{82Md#;%!QYFtZx?`oc^7yaLd7V_e;jh|9iAscyX-GmezUYUUtwk
zjpy_$vB1#J6)uWjX72M?f8Cj5{k=Wu7pGa<*CicGk<l(;R&23yl4abGzj*(m!u;PX
z3bC5o?@kvx;xns6TiJQ})lcCn0vw6=+xs4+dS|MXEAA0rZ?|U3r3!W~#oT}|Gq+uc
zv2SupYVWzTMf*z4jVCj^tE;Mg+wbm(O}m&r&nCM?AZUGkx4C-4>wWH1x1N`d?(&;<
zfw@KCkRfA!ixrc}FXOP9#@~#$C)he>zJ71qG1F$|mJRdUqdFWo?wi}3`*E<ntx)`s
z_U|Skn|+H8_K7;3TJ_ahcUIiz)7Q_;_|=xa<y5-eo9}NGozI0u2IpT)UvWT9S7_Hx
zfuLzW^B0Ooewe$z>eiZg#TIZtp1b;jpCKxJ+xh+c2OC!gpYHDZ!pvL~$id?D<I%6J
zDJvU}6^I^c+EXljP5#fT_a>JlTPB1p)tPm2&eHv&BJ=lFJzn=L<6n=Zwoc#9y4U|M
zG+D{c6`L;8$$FZ(>}~f=SsCx{-jv{Xnk~;lYtG!R__OE2{XbtPUCI`4TA_SJa7X%L
z`}CXNI2~35WNf!*TrkgWE<4DZylq9kTEVhYx&^|X$!JGdOqYDg<8<Tt^108q_X+a9
z%ef)9$Xw!#|BkxT_XPX@Uc7$ZwspcZPxE&Hyyekl?|S7VBoq`=%JVrE{yo^-_rWdU
zx?BCZonP1;*4(xBZ)l0HTWL|u7WHCIqrjzaX|F^N@;p##d78OW@_zMYhUG#|Uaq0C
zpI=D1i~ZZRaP8j1k8WnYk~;H!x)aCD7r%b5EIOm#{V%EZ^K{k#+3-z{QVD?^r{%+}
zR|>3RX;N(2p#%z5hsE{`k5c<y+As>GpIxP^YkI+nrRj!6`@Wyz?uu{na?j4UpB?vH
zuVwq=q#1LUUTeMg?MHq2C*J$4t1WLmxVC`fmei?xXCLjJ={@74fK&I&9~V4ZQ#f|b
zJhT5%oA9CQ`O%fiEq6E>^EO9|zUpwR-|}Vp(a&!63<2kb*#9{;F4<YUu(f0D<Y&f>
z-2(g8RxJ7WZHf3!?uSop8{7A#=3G9t#Q)p2Q|s?vz3Y5e?ON_V<IH18MgrZuLMytf
zek%KUhvwhgc5Jy!?5?cK6RsYTulXCc?!I8{1A~@=9T#+^iiD!}Uw!>`k2p92U!BOl
z@PfZ#@w^u{4=YT(r<=v>=gW7@5lOq)@5&*4ZoaQbo%4Ed0=oSA&r8?aj{K@o-|fD9
z`xaP!FuGiR&hCn>Kd!K5>Hc_-7#jRp`?EUR&Las1H81}BSoBhLs&4K5Yl#WAoR@yB
zJDU{GmBtX?DsYdZw8iR^Y)B2G0{>j~Ic+BP`=6(#&ahAl^M846ZH`lh!5#me^tgvg
zEuzPbiqn2x(l%RKa=q-|{pyxnQzPT;5>6bYN1FTmc%}X_KH$6Xd7UEDi5bEZ_tjKB
zZf2ihrxbQ(GPmks&+BJbd@z1}{nG!3dM&A%o|$%W+qOAA%6#c6zT+o{?tyuB^_}zf
zn!M-qJlzIP$`k)DxG4XhQ6Z@1oUot!vi<*8XT27=?>ynW?cKws-RV`{1tN!{HwK;*
zYLv|}2>h^h-S&2ObIFCVJFd*DJN>R8>)Lw1QwzElcg|Wf;Y7u&%O1bd{Ze9#WLd!_
z(OvH9yx&Wf?l)20R$Ii>@K?x?<xJ+*55BRoYO_xKD7N)6t@AwnuTo8U!nS8_DH8kN
z88}U?-m(4rjLl!RpF8L8r`xiSiLv?AIS1K~3zQue+y7>ASmeX?wdmQaFwiKBw3NYJ
zmt&Ln^_4BNZ29cmJz?+L+;zVq9XP`OY}@<vs<c&$xzh>Rsb?F^on#sRcDi=Eehm7U
z*lNPu`)>^wgOsY3zlHTdr^JWba&vooljq%0@JKypxQ`<-G_KFPjz!>*WO3M%bkSEO
zR#NY+oH$CiSOvJRNIsFU*nX?aoG-_>`QJ1&`L)@QA;8*KLcD*=hP^v0b3RM6?A)Y(
z;%Dv#lLB@BeEmz;{w>`0@8nhK@^1fl13PDl>Hz0}=g00Gx_sry<Im6SLj{~pFyyyb
zJ#su=uu#EIsc*WM30KbV5*`MTs_KJVD_S7c|HVs2w|??A@w_N`Znma8O?t_8_k5xG
zB9EG!K&i?}c4qGUR|nndx4boG7mc68#^BV-)FJkM3v3X?EM?2zE2m9Y`s7NeKU%&2
zeqXoYi?8bnCJTZp)K?vMSADt6v9Mr&gvpM##Tzc(ciA!jGm}G41k2G!%37T*TQ<D@
z`#aFLMBvHQ=1onl#dD8?M!c$H`@YTQXc2hDk^e+D(J66FM2Ux*Z>UFq&|>@i^GRnm
zRI)N;X<GSzm|?JUkBZf<-FyFXHx=|B{P5@0(@DD0!6{Del?h!jC5f+>iHEPhFuQQw
z>}Cg!!z@fnA`Y?(`=;IL4-;B(vU*a?v~^RS`viz38lA0Y@R+#xGs}C<a4mh%kc8Xy
zTilLc{{CHiHB_ZNbmz@2v#;=7Xnj$%*7RygX8K-jj+Ouol@pwnLa(|GNH6UBlBVRU
z^eSSmhWwpxolET*Vy2fYm2rA1<x){KNi1vkE`#~b0xXi-1&Y{Tag=Vc-xm3+d%9;3
zyY%10m;4OdmC~84{C9{1-n(~w(&Vjo@6NcY$kBAem18G!ev8#Dd2jFfi}iWG|17?E
zpG6gvMW2aOR<m*kWL&x0@$KWzsS_7o&NAHYEWom{S-?qluE>hyB_1BP?PhlAvtD_5
zFr8`HerE=T7VcI9jp-_BpHeOzs>@JpQs|i5D)1_!enFqf{BGHpU)F0T$QtJTc3Etn
z$H4IDLgk^QH|<kT{eAQ1-}(8mdAHgWIG7ZVH23AL?EAvDh)sK+%E_fKy&|VgUnJ1`
zkAdN_f}>ia=}sH=Wxm?_T9^2F61KG~a2!%sY_U2deb`s(@5M{;_gq4LZ!uzE=yhU?
zFA~0DoaVqS$l`dTWrEs$nMSKa(reppZabf{Q-`_t-y2p2h0DTo)$eq-L~hnPH^=bB
z*W~$ziX2T291Hsbj(>D0SBp}yQV>)>u|(>q{B1k#4=3g~GcW`!4z!pgJ;@~9FE?}L
z!Gr^U_#Fj~Yy+obHy%AuQ*qY8-1$2reif@RFl-UDWtppfXX=y6&mP={tS$m98~X$f
zNiXaxiH-Ud?0rPDNHVnM<TAJVh+oB33=DxvCG!fhA^olXyh|;h@My7G<i_W_@ZX(p
znrB@W+uvhiuuu?m?sE9`>8bvyQwFjw0xV81`W$54Rf-C3r~jGX`!D0R`l?zchM2aL
zog!987<6-V^p7tQa1`KBEQl{%5^o%(6XvaI;(Y4E6nW{GU)B%b9-aGm4-*5!rGHTw
zA`L$E|F3V|Izvi{<58KD$5DGXl{;G-tlap_D*dN;ntI&~)OY=tF!{Uiw?{jK85kJ8
z94Ow<eq2Dol?Buh`YX=jD8RAMGQi!gO8N2=TUWo^cB02}=c`v7DxA&8z|eYcUP{BA
zMyp-?us+Y>8_U8tniSH#*H!q(Cb$%v-1lt}c=dwim4=Yy_S#FA;%5cby*b~dUuIyw
zLRp@Xp@oy>4zIwg7kMn)t*y7WZ8bGb%zAz1<*QfwsvhTgMfqL%CsG>ZR(9~@ueS6I
z)06Y|+2#H`oK>9lN_w7M{;NMfI-lNXY;06?|GRzBvy+#PUAy+(YHr`@tFPtk6Z=vZ
zZv6SQAbml$;bDtQ_bzfOZfO=cB>mQRiie20p!%ua+jcXT+B1|s;bKq-(|Po+^n+XZ
zwL{;giAA(*c3u5<&We+>K7BSyyLEO$L8XJ|OVhn^`5zsg-0V)<<*oBWFG5&uwntq?
zT~4|G`vQ00c{_h>_pLVS6Rmsk=S0!hsjtf~JP_>c@s@kX^V2nbW}=Md-YRLQ6XA*}
z4OYiGj@F0#o^rZJG(Kaw@D;vS91Ifb?Mss09bzjjNe@Z-`0>C2{`GMORp+S0-nGqU
zD%)u7aNt_)+_^g4u>yxC&e#?(cg8|<2@5X8!~FZ|mb9uo0rjk}6!y4uyRt8xwB%ry
ze&n&N`DQo1aX#o}Xb5TT+1=(S+vufaxj3kFZ#Dbkf{G@mB;Vz~xA^TiQ-AtW=<I#J
zGgrQR{ai0D)t<kl;8M>~<7ewk4&AX0&ai%0;Pk>cS5emV>GV`F*__kwKAfLlD&WNN
zki$V%nSFb0(B$ujn?>V4ZFqaR&q0=vVaxrxEnTdoEDM7)GZV|BrS}{PT&RBc-+j+z
z`dW6Sj@R$!{|THQ7G3r8*`ulZjolhIa3>y^R=dpp*OjZWfwA&Sx{OVag|ELKC32{;
z?sc#JrN8-=U!NVBc}Z2<d{&mkTkBNuL+a<HUTOw(UvRg)^IQGAjL{6Ul}6A1WZu*I
zyxH)+!0ASTpwES3N^4lI7$y~fx_e6_vc9C(Gh7j5m|z|#`RHMyiiCr#yYmjGKq1+?
zm+$fI-cWzZh<nD$vYJzY-G?Rw7j*rb?d>a-CUN`)Z=3%&A)Z}gd!47XD^^!kd(K&-
z(c%*l`0>n)HFqAramt7)YAc&L%j)6XP3<~PKc3~T4$TXx|IbkDcmL;VOZ&D}OQkKg
z$)5hQb>lRFOYT19S1&qg2u=LaJD)??VT;F-X&t?{?Tlx-)t_T&uwr7!2yXLI;E?2W
zlUms4++g0OJ$3q(tlV&Mm9z5}HZ3|6vU|ywUlQjEp4a{Sw&2A3+W*^~i`Lz@67v4$
zH06thlCAjmqPu)ilTGAYXNMGX`DgmptXcc_@VyPpZYQG7`U?rpPWhwxa@xz+OG?i)
zhB!@*%dEXFCN<fC|MA7vW#^*qeSE0@zE^AICCRiik&gDNY3E`k#U?wXTCUY-5e+Rp
zGow~8OV8=Vk&?#3yU%RTskP|OiaWL<xIXepzKnl#+)Lj3^&dL^YG}n)e|@$$*Ky*P
zg$Dco9ekqv|M<N~gX6urfj|DvGrfKK%$YMiiD`as44f^`oXO!ZE)IHZpl|%SZrdln
zyxu3BkIqC)-jP4I)uYxlLbUes-R0*$31zXg+%9{Udu<!L{5mOp>Fw{_GPVE63ktMN
zU%1$R&my~-l2dB?R_OdbGdCr5{<78Vvc77<eP@~W&pLVG;)RXJea+X(SZ%qs;eyzQ
zWzlc>?*4ASqdJd~b?e=$wf+0uwx)bI`}fkPS5{Bw)jd^aILvKb`)p5N{f!lK|6AF#
zl#7X#_8Y%+l-{e!cSzJ_zMRRUWe+w~bDI2&iP>Zn>A>+^W0~XUbJJN{($CkHb${k*
zylukh6p`)mk;T@${<8AU`v-dCYkq#M{u&+re63aDE16mc#l{U4XQu4n53Krn_t?g+
z#V>hV9+vtRCA+z;KjU-$V`@m<JC{3lXFncIxszcOd-m1rsWU}HOiD~jboRVlwso=l
zf5&|qM^A^{JoWV*uSuqP)CniQRTZBPKYJIK6S8CBb$QS0KLlHwJXwEyz47_|q<!8>
z0_WmmxKeiUUtDn1RgSsA@{!q(Le1;qQ)X6sG9Gf?xVY=!A$1jjtdE~W!*&(L&SFsX
z3~vo(Pfp2xT=wzjBxk=pg&7}@d~i7N#HU<;=Dp+b75!&6a}@tS*!6||(5|MwDYf5L
z7S(8;Tdni^$j76n?0lDH^T_%xQ`~v;L1fhF9UoUY9bXikZ>r<-by5BMo!7N<lb7t4
ztLn50l2H42Y+ti`=IP&Gqk}6v5AjZGh%h-n;gw@K_tcg=wdae~WHroLlat!}ze)w1
z+57w4-QS$vN&>3{ro1{bvv~TMS^G<#&hm|uSo7js)RUbTPrBuGJ^yg!e<y3SxE23;
z8IG0xU!{B7*qz*5;_ldG1#NLyVX{6cul_-6;Nx@|+q$k4wXiK`Vy|d+<v%tv%em;9
zKELv-a$UbdZI|r11BuC=W?V<F=iibO;?P_ydOo;K>y1jT$HNy}ZgyYVmGb45+wr*2
z=6`!Ooj-MD{@stWecJk#SuL3O)6&!3!r9&V_`UM`dov#$vFGIu-uA%ojLP56S><+_
zuHlIb9-sbs-md-rkx~VhJ1Wd~7q6Z<fy-Hnwe+K3EA!(B@1qk=GCB1YfB5cpsP4%`
zm!$i(|C_6)9a*sL@|>__g)3JRa*k#=)mA95q>6^!$ge1MxUunfL)_o)zf2;Nxm)W0
zd^|3!zi<7FNuRd9yD6-G{)IT>y&8wW<z;W~y+8MQdD)e_7L~_p=GMO5t9GDLLSfJM
zjok6g<#t&so3os+y7F)YclWu5_UStpZ`#TKp>5CgvsdPyOnH%E^l`gG*M~Ep4E5gj
zd(Ldj&+qp$@JFAFKjU=Zkt!d@R9o%%t%`beXO7HlY*CIDPpzJ^W#Q5by1cw!KKrl=
zOw#=HK6Z0mH`6mcosaAWInF-><v8N2b}O#GF09+3!j`$Tc=DpNw?#9PD->8VM6c~C
zo_~6-v&Y$#qQ(hd<}$rt`@-HMVe87+?AF7-#%Qi#`o{g57w2v%d=TI&p-}T;=Jt?9
zYwn9Iiv7QMzFolG^_-$<Y2VJClbSQzSV_NJr}<x=&Vi4u>+DnZ)~iikxcH>W<6}$=
zC#URkbANoS?)%;Jh#9+9@?3fUb7R2NuDngIrBzo_*rY7A{<B$CxwrMtnzO*uNBgDf
z;znnVDt?)j5?r!>8I4Xad}V4Q5VvW0-@h|b3=f-BQ@IWcm=-C#F;CgT^r4OSjOFeL
zYaZvBYI>&qcYBp7%HY?|=(H;6?#j-JO9A>)wgPP-vlc6#U$W`VWX1QDp{euDpH%nh
zdtTVu-3NB#krfeb{w;y-lNToYn*O-xUalXJ5HVxX(H<5Jk8LuInzBJP_Z+*J@BdoS
z8ZV{pkUwL4tD?Z4z|6xT%nK!SK0NA;E)Crs_26?jZ|>e@vg>6yDvh~+^Zj>RH+wo~
zi^KFo8(i1&aV#v+DgLvl&3LE7jXkjonLd<o%CNnN;;pn-{qyN`{<?bq2k$wG#i#E0
z+n(4kq3C{k{BM<WG95l|rseKlucy!>C)>R$sD1`xkIspsA5(AjhC1Jy+*;q(r#888
z@yc^6!qeC`OphrwiQJksq0Q#skAIUUiG1a_dFT~$wq(Ug-~Aa47IsQ9oXV@%_v(I~
zU0Njlc@eAAud_~e^~-LzvOCS=6x}wjB7>v1<=&P^Zu|d_w2!v49eSX0V@c*`CG)8V
zojn+@@`@MUR@>Y7^-A$B)5BNKZVBPBbC}NL^p&gb?j~n_)*Zrj9{-o=3%H%=l{qMO
zNBj30nJ>#Xo!6eWaPi3$qY{&c8f=HI&gzlom2J2Cxg;_1mDsd}dcu=zzVw~mE9}i5
zRL`lh+rxbAk%JkH0?IPmwe=5vo^M-!bL#G%O<6oGQ$FpQZ2awAzbju$imWKZp_e;e
z-(0+&_wJH7qX{ANUZ+U^xZv#_uH9yC&m)la_GbBt*z0wltR|K6DnwmxoDiSI{w#(6
z^jXQd@2Au*b34|nHu>a*izYVayT1iq0A;ivN5zv@he_^Vn#5=+{#WJnwF>t5n$3+~
zZvVN$cYB{*vaWf4iig6K`<X?J0!0C5RvJHdviW<Wq2TZ|*>@T4KJkm$oKkg~bt}Kz
z)RffNw6rGV_|rG9))h`p*GynIdhB82g_B~J-fPVczOwfF1uL$WWG*F*-zFs{Gkx0n
z)Ux~+9kOwD&n}VqdP@8Fwj9Hj-FLRuUbo{F_^v<eMM-|I<?`|k)$bQtonYB-(0{09
z7t6IN|6FG-wcc=!U-!<J>k=F<+e^9)E{kz+F8CE<*xc6tIN^!Ii${`&{|fJZV8G*i
zeC5M0_0uCdnGZ293_JSpak+if!`B~Q6u-X`sGuU5;gbF$!)PXtY<B$Q{1g3R4|!yH
zW!?Awdi8N_H1B7pb$5UBP1=5t%jiP)q&G8X9n@f&V*F%RuXy#|1fj2DYCd;s9+$~I
z%6K*3>cec~?nm42*Db#luuLcKq5RHec}kb07!_qF#RQ*mj?(09oM8U{>-X7O3=G$1
z3+M`b3e>uOJiY4Emzz7P0?Vt8yebvn*;lft?{bI4bM4LV9ei4seYgL~re@Mu{K3@S
z<^96Aii9+2qcyn-I%iIF1ovy0>{2*yarVN+6eCIVYx`b!zn{Zak@h0v>Z-^0E1$pF
zS9`3wQ~X3@Xivp@*WXHRe2)$v^fg=lOkc0|(^CEt<v#5mvrAh#MVD7|g_WGYr0UU|
z5tE-DxL<JH&nI(OReLPH`yJKl3ljHgkY0Z%q(xtYpOK3xVHRhgvBDR1%gP1K8<pQh
z{_BwEdGEZIQE}<iJ)9iJ=T>%m-7b6C9KGz^syOo~g)6VDE2bpPxOrj@=ldVw@%6WN
zl$y`2`np%GCPhzsm+)I_QNAgkwcf5=@~I^2&63DlqTiWaw#PX?T2-H!GS@U;(?6QM
zQhSPG&F{rx7nu_)zIx1?Au7oEVFr(^ubQ)aaR2Ld&78t3CZF74`1OT`j!pT4hQ|5z
znGt&$3^wj~Zddkb%kJ+_R&JIl+52x}UE(JTW$lzEA@hs>e#_S_`C<HSlghyZevU7<
z$yPHjzjSh;%S8QsS08va2#8$#Qt59atgxYWdtE}0PEa-@$6=qf2UdmbUc~BTTWrqT
zG2`!tQ`WsP9jRYDj!t}BD19(Cu8;fkp4<MRwTw&3UvGUjy=j4Y<Yr#!iS|9(s<jVJ
zn*Vs`xGH4hrJR>#mdoq~ma)jPr=`0#8LBzEPd=IQ;)c4m@GEY8P-Q-4k#hdUDgAc8
zbi|DRaK{9+>|*&FBrY~}>A$@pGbdf=vfS)w>6thqKEmZv-LeF=p5p2993GpW>8l=$
zFjlyt^z_H9<8@a%{@LmjFJg5v+Gt(&UfrU$As}_TKtid%wEQjI+s*2XpNt!ig?Q!F
zXFf=&++HOnYY}qL@fVNj8@qs>#S08fg%o<?_8J>McVkpnd+Y{spoNOMw#_F=D=DjM
zeO9R{XEH85IsN!}F9Y-SYqHfV#6x#4sE)SZQlZoldiPlVzQ26t9;zuz%<Xgh?uX0x
zb~b%r6@00A@W!fSee;D&F8QV|I#R(f>5X|dTT4`luHPIp@kd`5D;$5iHF&neiPH<$
zP13nJ;SuMLzZw>I8!pT?wNHEGqdN2JpO+v0yxFYJv|VGbk8jSMj*jE=>ib<*6gB_L
z`S$l*dE1=_tv>Jj?E~Xiscio8gZq7=tcui{ZikK^+LCHKnvYdMwQ<Ue89JiRpSLZs
zc<knU++)Ls)sxkG86HoI+T-zSVyU8UyEsQ!?;Zbk7Y?&W!kc%bsNQX!(HB$19d0LL
zy({S}+qRsWySi`x%2NLSv%TcPrcI_X^Tl?D>?x>{<(IcT=*?za@zckbWB+wA`KJeO
zJe(x@dWI6m!9zD5R#u$ecGuf0?33w(?F}rKU5?h72!DE-@?+sF{;hrUZT6NO4m($5
zsu8=lyHtu}`JEr~)#VRwpO|`}@Xx=w$C%|dJfGILs7QKg)20U!E^9R&ZFrh;J<@BF
zkK)WzXU?2Cv*paHNv(TkJM6r>=WNxpy&L!2*Pgz!^ydlV&oPw(*Sh*xWIH*`-+j0{
zA?_BN?84;s%&^<H`0D=cOz7EY#rBZzJm+7r;tLZOC<~U%;jsC;mmQ=g_3pKMbt&KT
z4oa+k$dITv_1C_*rMX3yxnwwGIjw{okE_l+x6Jh+m(?UCF}b_D!wrsQ**R#$=d-N!
zzwK4R4pI|%&!cos`91w?^%pBtWp~GZUw7|b^6&55tjRr$hcaG7Z17P{JKWnM-I;N~
z$a>bSx|{2@1g##q`M$XEw(`3;*L^ulB{BPB5(*|fCl{3^+f7}y>VQOv$_oz{=RVm_
z{&p`oWWO#<?tkB|GsmVX#Kr2EghEea-_is9^CQ51$^Cdq@l_I+xzlluQ~HsgK0J8v
zWMi_^Uy0;~f{i6IXLo!&-1$Ms(S6ax9&LTA+?O5~4ELA36pr3DXT}_nPsu%uPPMn5
zX<Jk_El_rJUljD<v^B3)mR!l3=xsVF4?QC^jE^xS-ZMB<RJG-zXS3c5j~x>|Jny<`
zO$ohwq`B|H#t+Z!?X8W9in6?PERIPiOwkul%@&<&<G5qu0_BTdmtW*${o2>Ji^J;C
zvBqc5#J!eYUhc<vEW($KLwV_AEmw7a0gz9(T-)ZvuBY^3#eV69k6(R0-#@#x$IxL1
zht)IR$&=MNtb|HbRC7ymDp}Mf_FWLPTDSkrrtrMIrN6#pE==n&bkGPieC;^vM>8n?
zxBc$3dAmTl#79q-Jv!>%p6~ZwzRX<s5EL5IyC$o5fP5)+x{B*fyY#}vi`t^2oyEBB
z9+O~hiMC-?_ZN8RcBnUm^Ut~vug2F4l;58SygqI9x~lIF+gX!&1YTX<ko=fSRS@K4
z%fkT+Os_h+zu571*K51FZ;=Njm|Lv29NTuGX%fi6OPW$kJP&s+SnP8$>EUwyJqi-Z
z4FS1-mvu5uaREge@6xpbEuTuS#a<A!diU%0{e4xBc|k^SX|vb;5x)#plUsKAlhm4I
zt4D4xBsP6`z5TvekD<egC7hz_{sJIJSUj@+bZm9Lm6Q7miGRVz{{Oyz_x(O?iR1=@
zXJtRQ{N^br-SOD5QKI6MV~6y@#bNJHy!2Rl%KXlT|C9Y$l6eG<T}v}x`(V*DP?#K7
zohf%$lS6jlVkWDybDKUqcs`#Sl+YF)+%ikNR|sU=jeM!7U3^xn_^rw!ubs`!ZQu99
z$so+1xuv#kW5Ul0=?#nvXMv3}omR<aBv^8!_wKe@_v+slZL3`#gJLOupV(JTtIDR1
z1<DVP_4eJpdu2;PY_DuyOW)pg)%kkmIrr^AArN?B<B~^DIF*#{c-*dCZasCDw_Do<
zK`S#O*=pPOjZP15A8uz&=9E(~@m=}o>7xv{gWYbO9Sf9uQ}<42`sC>Tf<v}=pZunR
zPcH%wN~}&6Xglh8{O!KOTh#;|-MjV|J!n7BZE%M}_Vtv$TJLE#Miw00lFThz7d}>N
zpRC@&VKr&ir)3*0-hj>dJx#B+==C+>$&;H5**MNG{hB%ZwUd(4ixo?na_4eCS)g2U
zr1$UX>Fqi;GdaYJ*f@Use&+eA2})%h1&dc*Tb}z@@I-Upj==w6|9_r8-`6u|)-0iu
zvdIkr`}ReJKXqN~;&LI-b@ts7f32_4rSp9+OkD7I*0X2RPd&Z7+^=&<zoCPKv21t4
zgbog?RT=5Wcps`umQ3L^cRIfH`FwtmtJANq>p31OE+|;iv%m8Iw`KU}1<EBYea_S4
ze%)HT-S4o|F@}Xcw{4z3Q<a>Vr=+CxBH}R9esiPW58YmH$hJpE-P`p&&d^p@BDvuM
zPj1O&#cxlV`&?WuYz+H4J8j99W>8kk%gJqR?O{A*y!F~Pr$a~OOH`B&^=4lV<H>36
z+oQ~Gp11eas_$}@E(XU$nhKU?{>%EiDmrx~qhg7QQd8gIK3VCLU?<&PzxUhY^!cJu
zy@n1N@%1TFneFQyIJzq--FjxZcjcAyuR4uhoVdGc%i~?I?P~v3E_^G&-16~qq0;N4
z=gsbTxVR)snu{!`xgconbUe!R*Z2MPUyn&U9X4d+c)a{E-+f!=IUXl_L#Ha7(PynI
z+}1gB&xVgT=ZmLn7q_Vhs_qGTaQZVpIFqn)@2`8Udr%^n-)U*?+OyqmnIHdXpTB*c
z`=R-?uWo5Ys?w*={Rw?Ap+hL@o`KT_O>QeEcexUurCtC3zJFJKU$kdq8|%Xj!txw~
z$xp3+_onatctCpUhWROrBiBp(5M8I=sS(H<v8;&Y5h#Fn^DeG>-22=9UxdLiDZUoL
zc{YuIpV|HT+_ms;n*Ay1v%Au7pSWp0?`d9;l9$ix%iC-YgM-R&!-oUu^Er=2oORrB
z%B239*W6t%W&Sq*J@jn;_sJXLP5#blZ9Klb^_RQL>^ob+>YDp5Ok|g>)_Hwx+qUNT
z8bu{gIin<6qT@N=#_{S+_HSPIKl?ZSP2rA>;<A|=zuwDb%jNQ-l~-c+-eQq0R4#e5
z^{w^o+x_qE=}IIUHV1IZ9v8E!WcuCuL7IQ+)C0$u*Gv7Fb7o<>i^;^VPF!AM#<B}R
zNzC&0zSVpG-nh57$xuw1W9o&%-S16)*v`Lt^ZDOXU3TBQA1*%Rbzotim7B}d1JlbD
zN{;k;J<7Yf=lR{)r)BT&k2g3b#_x1G%AnQm&KoP<5+j!f|6g?2`=9(==M_|tY)~?#
zqa$oq+BpL;y{S#0RH(H^e{y9;Lc*sLf`V5im|He$E_@ttYu)Q)xjj2K-#xzB@FTzQ
zDR$Y;jNDs%d&3VGB$qh4zqm2|?70meZWu1i>0vy?@nXj<qt`DF?!P4Sf0BZUPlt48
z#*Ii8j)jX)El@6r*_v}R+1Yu+1jC<y*Cj;W-|lsKmE)ttfJxQg`cGNS6tEJy7<PW5
zx=cw+-;#c5?$gulx0b#>dD8Qs#AMcmE~{Qd_~-~}IWCj<ksJ`PYvY>mtIxXmt%NRm
zT;o1E^+Lr3K`W=@jiTCFCqWrf%c?Ks&Xd?3?EhH!VnQC@k}+YD?OY*IQF(ZR&hk`n
z65o3E?D^ild9!8-nSx@IRd)MNPUggycj5%Re$}Y)$abzcKZRAX<Vf#@z~|TI*8lT<
z`sroxa+YKteF3j67k$;AZ8h{ZdhE!n;UVh7A=~+7MMC7KOW^FBb?*VI_?{R&|M_;h
zLMF!;9wt~xD(GB)SLnzU%X^?ec_JUL)ix&qw});oJT4R_d!K&2{q8ggP}#<=<Nd$;
zLDGZ87WXW?E=+v2-ZwAG_U8g+ek-Tr9Jj9A`t@z^_pX<j2P2xB4W5KWIKH29$DxC*
zayO5o`y$zW(pIbDKn^g^+xMtT5@g;}?G+hLtQ;2={Dp){RHRN<E$jm|5`Hav+?Tz+
z_Wwk8mgI&2CDW2SD_?iJd1n}$QVVIGus}Ib^@E~(NlPEE)A702<Nv=bKF@iKA@Pr>
zSXTG*jLLU5`4c;B?kuvo<8dWl?MA{5L90tj5kGEn>vJ4qSQwUDa!D#q?cV}Nu00#?
z|4w|k{zKNxTW%L7PT78Kn}bwIj)|4i@sIU?9=|rf-@?Ts@aod8Eo*Ndz3=kC)ad^+
z)*ULw*U$ggDDM@zDkz(I!_!&+#f=&7Pb}=L|C9Xvc0My38^_h{x3-y9mt1JBzi%%0
zk3aL@W#8$sC7+*8zw&3k-Lc(noK}-wZL4Y!09B$|rwzRR|Gq!(`@Lpf9s#X&OD?Os
z{!f3ecW1WOH~YT-&f5zY<|N8SJ6|ifcK1SQ{G6)p?AazOx!?J9TOZY)vUWOG$mT!$
z5`Rgb%H%vbbDp1&-RC{?W9D6&bL#5#xyAb?XVpfT{D}Cs*U0AmS;N`OeeYRk|LXj4
zL;L2;?R;`8?231-`w{f>U#<22Uv~^|Jgfb^piW}fWKIbMm8pFh%~x5}6fb<#EPs5b
zqvOrX%dfq>4h1krFeLW)Jx{+F#654W()7DB({|T?xuwn_`M>CRuiC%2Gk@Og+%e;H
zq~uffZ`bEo-wp}8RrdVc-+f}WeZ?;l5`|CI_XsHN5Zq~yA=22l;BoV_*Iz4(pIw<g
zwNb$TB@@TfONDDyBiMR{d=I~T=70a~%ztNlb!TT@?*DN;;+FXTf4|@FU$^d^&Ai|L
zFMisvf9J+Z;aJBzEqV<BWgI0g-2cAsx0|hR&tl%xCls;c=lA=wwX_*Ibs7pBUhcS*
za>Ve<-&6M6et%z6{yqPVbo9O1oBm$zH*)6-_G#TY<=KaW_M7BuTY_r%PG7!R_+YyH
z&Ddp0#i=U!e9A2j$1`GCKKd{D$<f&N@auxdHO-9?H)29r{Sp{km_v#R=GZ*s$Yc5S
z=)MB?NB!a}29NGPTPd9R`hCTjNv9=WKK=bIY`*Q~n%$4ieSQ7Ae$L?qCp;r9-plKM
zobu;&^~e25`3tY#@)nOh@5=cvfNzdlhrkPs-7d{>4$TXaZ?IW4^>Lql_O|%>wkuZ{
zL>KO1aN2vX+>z;!#a=!2OTUh6+NyImk8{;s`=ji&AM(GK-<Ro*i<$FK@AmF?xBVv5
zrff02a=*T0tGTJ*e+!PA?;iD?x8J!wYogpu`wQX6KYm##=d|E)(d0x&7nl2;ANfmM
z79>mDS-a~((oI>}yVq`TM76wR;;7v8a)##<VgH6cy-t7rUweK|R-W+g=aSj><+Z=B
zF8;Io<d5f%pZWW{v)4XZq}&=mzj1P&M(*16;k-^!CD%3BdfTcv8vC+!)i%vfC`hhg
zw`%I^UK^&*J$n{I&xd%1g*sM~j&l?-&o7$OQ}XZT*)6}P8~$-kGy8XN%fj<>V)t&^
z`AAG~-S^(P`{w^mF0T+$Fm~H>ME```|J8d7;#gXiPglKMYLH>F#F-<{XY0(PjvQ8t
zmMdN`O#ATQucv43*|Q05Cv+MN!q(R(8S30D@!5EaQBnJHp6Aw?HR?Zp%zte7r+BZy
zlx_ctj_=!-dCKM1U+Y~Ji5sogrX2q^$8i1EDbjo6JR;v8m3aH3wCvY|`ALNWmozT!
z*?vqT&r|pA*3Wehy6bnomgYX<sPSFIt3}|&jJ)kX&Rbp(RO|`w?d;Nu*}7`+T3w$b
z4Xgs2mRv6EJ*pzu@=~Vd(9dO$o&WjHd+_xBBG&0KnW@!f;dAXupFiupw##bY&$18K
z=UXb=l;`{N=kVTJQTrU9|5q}<q#av-n*Fi}yK9Wc-344NTWmz`Zr0*+5@+jGYDsY}
zEOa^IG*3RHS=!N^#p)QJWYCVP()1ad1h^HZI2;#ETkImRD<`dK&a&KDKk_a%?L2y9
z|J~iIEdSfgv&;Xt#D0!X&-0X|mfIhXE-yK)!91_a+U9*&=)0L8*Ct)axcFzMQgP~w
zk4L{upD!+F!X=>8qT;^!?1{!kQ2OL3@u~QDbg`yp?Ax~u>|zcYUdLS)`v_QVWl6lZ
z<Kp#C#V3<lEdS5{yL;B`!|M+?>?nM+`)jz~Y6ivKIqt>Aogs!9CBM_<yBj8mo!u#D
z>vy=zaWRMDN!8gruN*k64)t=BED?&Y`x)ZawtO}Bp94%BSH+iKPe09^xGGKIjFjb?
zM;{dL|9M?}S5NEBzK*+Z&ZeEJe0;UOUu@%RmR088#H>2+U97&45j*#d<6;IyCy%1l
zXWSg$H})-1W|E!U#;Yv0>HlLnZf=E;;I_L;*%wxbiKKKb-s|Y6kzcp|*rlNF#er|E
z-dz3rXTs~*Tp<k;_Ajk@Kktm7e)alm{mpLE^^cwu=2#ezzxV1D{b}H!H`lBG`*m|=
zWrCuZ!wR+KDgtRYb)_;3*mo-ii#~ku;Xv=>`_HBq*#x|PxzsZ@H@C#}f9^^NlUe_-
z&6u~lFXZJqS*2#TlPfGLnG{7{?aX;rw?yg%hn3Qnq%SWX<=(#WKkm?>Nt}l)_TF>f
z=y<JabtE5$^4h3|3zC_(lJc*Y#-_J31=g)&wm(<M^C@X+^M?oe_LnSMR<ZY9()<=}
zKf~>M;`G#unPN)KZrSJNJ)C|B<az;J<4d>R^DxUADzh&PO+MDp8u7_-g&Ai_jB4hE
zjAd*JC3ZWWoz0ED;oSV{U-N^KBBk9@>UYkax6j<CYLu}h>wQnYrM_fL_p`ssW*J))
zA3uH0>i?|Z(G$*=32zpa3U((rT@Wm}qOhgzP|ND-Z!G&|HZVB-EQ!hEk{1x#BEeD1
z-~Vy%j|G8zhkOq;yY=hM`7Y2>W*l2~e7QU)pVZx7|3VJNPd|O_`?CTwCl20_PBz=d
z3;)HGE*MUD;I<|4(vsP&tq*nhbs7TZ^l`d1FG=UvYjtUn_qi+Wa@;i+eFC2@xOhEY
zP~OCA_jH+-FSAUuBC>PWa&Ykf`!)H+`%_s$b9q$6oH%sNCI4Pmc+tTw>*&5@-ISA)
zz58XGgElZ6+Bdo4Q;VB|&8~udhy1oMNt^uoBcNu!&GUt<$*#bh3orKVt+}AFTj%G7
zZ+|QW1?ENW3;9#7`pJK<g{+`cMsI6lz-I^d3xXvs>-g>W)V`Bh)5I$9EpXQo$HjcP
z=M?Y!Jv&`V;R~PC+zZ(kGKv<JUs!Q`aovR%x09zfyOrnFEB&iFUcW+mwt3h8bw<i-
zEk7~I3OcPc`^@l}KaT~pRx%=@@}ts`CRPEvNr%<aFRZw{j+5i_v3(b>-diWul5^q3
z_gWsQwX0u0cU&xe?dOB}o8ngQ+!OPsT=lhx*9AevBSp7$nSHG<2$rzO2D-Q$6ORuO
z6F;mQ5!GlAxBmU+9SON}mrPcVx%EaMh{a&r%w<IvUR+x8Pu|4pv-L6Wx|@e~*4tle
z?2nYy)%_a2Zpz!cv2Xme=lq^tyutT__|s`zPCEn@r-)`wJ#2PCu;j?yRUXSv&$Qe7
z?wRikR&QYeE|tc<O@8wVZf|8u{Q0kzf34_`UDK{#UvTmC(WGX#=h|$&dFjn=wIAN+
zc^|&2{bh4Zk!8Pbq{sF{mnx*oTK}C&H9vh->P3e@*X7qKl{_UZvX1Us9G0J+Yqxjb
z7Lm4tllYxFOJdYAFJ!dcT_nh%Zx!@}S1L5`*GA<}-LaWl7A}`C@j9>i$-MO5-rEIl
zwLbRSeXjVj=<fZxsh^Ln?*HJ=Y;T>bW)Yw#E9i96?eL?H4s{mcroI^y7pE?G?9{yQ
zLA$)vsnd#*IzJVrI2~tcmJvwHVso<k?w_*GCpdDw<KpwKvHB;TD}4EX(|+H|h{7iV
zoEy~Na#V{42d{gUBK-eb&G*uGFT&^U`<ZV3`4@Nln~#Ai6Z<$8PE})bT6p9ohq+RY
zWm8{w&#|@p|KE!VWj&wZ$*}OtrbDlvbjHTlE1G0%+1&5Ac=;ru9}6xX|MnwvQ*QRR
z)yh-uud?|6WWG(KgL_L$RJvg&rvNx$E(9`*g@tn$FmNlFNYsc<QJC^oCvufpaca@=
zeSQ_7<YE8+K;NYLj6=uQoV#|-`uh6&RuvD5+J0A@nPhvvcJlvc67kFlM}DdYOp9IC
zBygu=!sWcUHJ3l0$h-t9^DYRMuh!cbReomv{h(;=1}2?`fLfs!GqQMBPgY-HZJs}Y
zjaka%l=-h3eyPwk>$Y99HeVMmW99M3T2Oj#`Y-d6cdq{bezMK8`0w=V2`7t{(v-yQ
z6PQC;tg>WZa9B0<T{OFW@5PI4$J{vBwG9N+BzU?Wnfl4JWa}<7u&!KGb3g8Wvs>-`
zpOw1y;f#lLgVnd*S+`(+){eThk3K9sE%{RYQPQ__Kg{y)WIQ)6yMJJ@_80CyH#BDD
z%I|Z(Jr&e^FpvE3E_#u={|PyhE(iCPMOPa^p?0xhhhRz1w%dDka`M`WH(Y7H@IPgz
z;UB+w3o3PG>a_Z5mw%QMIk0%Ak;=xV@_RK(|9^dac7Dyo!!KN_AIaMu^k`2EnQK$H
ze%GwNyU({DlKc6&{NiMFgK)N!%aols+4d^@ba3Ay(AXz+*-%gGl|ztFM8{G~j?{~W
zH#5#i<~(jacv9Gv`&n7_g~uO@zjQBO-0ZhydEtWa;$p7<KPR946S7S8zmfZ%Ge6z$
zJ74X5T(ZdaV}I>!lLuSAYj&iE=?L3aGFi8Hn8^x8<(cVSeEG{S(`<)eNsF|j`^>x^
zd7~u-Utjsn3T<pv6>gEbFwsue`qC+r7xj-y&TPsy%lNYTe676ei<c_@rrxnD`r%df
z?BtIdwVTtP>^D`@&6;rSPw<|JEERcQy{u{$T{^wrYgX&y=K3v$Cz4Jr?Z0zlkLQna
zRsp4xB`z7gM_oPyi@xA6_X5?n!fkx4+#5|87QQihs|9K$<ec@Jx8S6n*T1RL?&;Y)
zdK&L^XWvcZ&-dj{|5*ODKz!ft?U|3PU+UYg{}Cl_w&t_fdG-GhJY9d@-(b%^KVSI&
zy(d)+iaP|CMzA_^Sb=SDJpN>QoYlNZkM_>gwh<F^c(EzEBbRyp;p*!veqQuZD$Kj+
zT)yRVnU-PQ{W&vP^ZUJ}g<k&OTt7wNf7|{Yskfdm+n-ac5pw)*8&$G?+p?XH#2ly0
zPd?aoc0+V@?dSF1AE{?;F*i%=tMC+A9mL+N#A2ni{q7_6ClA~%fWo$UZR+8+x#v!N
zC@F2VN!q}0h&ODrh=A4JFF|upt~ZhUJIU}(Yu>-3$Ky_(Quw#^&u@KM_k#iM(e*js
z*RS3?mu<2g%fh=p3U~f}WZ$=Z;V(8tU8z#xOX~g#ELMxw9B>5Xgayi6dSZO?emZaV
zJ>=$A@G+67;9PiFs#`{2*A2df(>Oo-@BF>J^3{>Q_Gi9*(*Ml(Kkxp#v-Yg_GLm@z
zF1#_-&DqP6<L25W-?OrAEMLj|aN+%W&aacz1(;+5=fuUNE>KQ;a-i44NH)AzuGY?8
zUMGcHfoBKH&9w%zmo!{htI5H<Z^udZ6ichBd3pcd?5Upq`TYF!|2Kl0zEr(FP-o@2
z==na?hZ~;Vi4+u=7rQg&%M;Ew0!k{g`!Z%;6p*{eEb9oW2xDy1d_Hc=ZM^rVl~v%>
z^5jVu6<Av&Cx*Q<e0lN0^s~Wg?`9i!zk93WSN^=Ow%P85M9SBFZns{1{c=g=*6Yv3
zU%2CCT1=SR=B1@bJ*l3mdVBj_{+f^Li;_>LISN=AWQZu<%yU`ob1Y-7-$fyjP2d!N
zq44aE!Z@)c#ug!=1<7L8l}QPwd$xE!zTf@-{Qes+PD|!lH7(k?Xwl}aQy0H`pl@%;
zUL+v*<0bno#gqfVGC41*H}<+%y=apAnfy3q$MJLP<5%;w+--K#pCfKxd8qnD#~uNv
z1&^z`J6TrjQspRNk!_yTr;&PT$?EFwOdbr097h~x<V|OA%3AQ_`<-Veg)`4R|2RW+
z%kOZ<Kf6o2f4DDuweRQV>lG`EPfy?U{Zs8B+4*&MV&cx3v4!4wSh;@JEIykjds3$B
z{&~Lsx0aZ^$t{;=w|Fs=g)st3Ee`I>&+0H7TChy{4u_S}h6{$NUYUV{Ggt)L9Q<Zm
zmTx%gZh7m;1)j#}WxgLjou3+3_+r8I`tR?4K9H}Sa(qpxuD$<9i$}*e-(L}pPqJ>&
zGW%i`71gI3cf#SsI?vqSFPH@dF5UWe@wcLFhKM4I)w0`bqpSk<NrR%XvF}~K-LBeq
zG8<R~*h*io<!L#@dUnCZ?!FK;^=I21=Ko!7Q`eI{q0!*^*6<f4)ujq4`3ui_J~wW*
z;COk}I%CVOD3+G?|37>mMDYDoaN%g|vuw^atlInS5-63NIngNnbn}K!e<~+vo^hO!
zVi3@&cq40br;ho7Os+%8-eMo!fBbqj|Gew$u9C%?lcjg>z5F#tBv*PB<HN&_i`h51
z@jgG7vb)tZ{X7S+RP0u#58_V`ofPI!yjkL7BEga%W>w;{02E@cN+RRyB12<%ELtr&
z{^}cMMCBPxy1=%NXZO`aWBZL)4&45EG+m}8>&VlOIkQX_F2D2QYl_pH?<bx6kDF`C
z+h=^KIe0t&+nv%SUfXg-B~7Y|UyCIQME$vYv3HA7%LK8!n7l^{JpaMXKNeZ>mtQN5
z)2`gz!Dz?W;^^Z3OUTm5VTR;M2aS1?`gSgk|12kY-t2OSj#);@gs&4F7u(m}kBXLl
zU@F?|cK>;BR>bq`YXzlDsy;R;aLDqsFmYZIRBX96qu0<%R$Gcy8=SW?4<7n;DM*1!
zfk(`0(pfgSmYe*~PGww~`}(@vJvFHxR-0=g-#ae$eVWQs@z*rt%ZdB-UA$7cr=%=n
zcv_z2F#hhmEU4HLv?gs)!UEU!I&cs*^>z0i^R@qXBOr{;i?QX?%NN_CRczc&lyPib
znR7l*O}$iMPuzs}FYY@oE{}e3((UPji~RS+<xGAxK2S>xTVf&*RG{p1A~l%V>4IP$
zi>#rtI?p4WJKv7WpA8LV5OvTnZa=UfaN?X<jUNuRedV(Lx&Ow3i|@Q|>fYPa?B>2w
z+T_%Ir}hWSU0v;rGD?1Um#<!RguS=RW%gmAjqFxREt{0qHa!8Qm<xg>Jk5)I)shmq
zdlww%N)(Xl?brU{xZ_^ZBqpcp%-NZN7x&b=ICwO>8OPQ1HBN||+q@=E%4F7bZHo+(
zXv2(>30r@ik({{G=uxxV<+oxxyO?DKoeHb=T093A?MLpeN(@+YbyxPkKhtK-3Q!ev
z(3p^7<z-pfRFutjC^o)MkIAVjpy2b9PJTy;%*EFye@p@u5BGnZi?%J7)s!+>l{AMZ
zcEa2hj``v&3vcUHwhNTFaHvZ28dmL%e_66X`Gv%{#=Zr~YtC-dS6jArqu~)776CQs
z-a4_Cl9;q9#h+YurS%Iw+xJoHp>N8C7YpO-%lJOkRm-%nA7$$`n>sD;{|n|_e7kjC
z|G9P5|JnTIyYIzsfA}ht{eF>%MJ1Ex5@n~1r8iw}2=kY)$O@)CX%Uuv{H6>%0JGMB
zC9&X=p>@!$lfqJ03*N3evEbrn?P;IA4G+Ej@kM!|<6=|O-|6QeCD3dB|39x^y?3wj
zeVn_ucXqAq+~mN@M?a2U5&3>$g+t%dfM-*9oh}F}ZaJ4FCa&<J!@>Q6q0Y-00-~iF
zmOJ<El)S@LEpTdia$D@Nlftw3r0(wZ&baX67*m~QS^IM}DU&MCj0-P5zBtO$@@CeR
zZT!m&6MsFEcbxL<PR!YJR#PSFUre9hvFvBE`|dWLcR$~*Jd^h>nc)pX+XJ^28MERw
zaqrU$lwWX|H}&~H?3r^!(YY&Z{kx28=3NX<yf0r&D*VLql;f7;V)ef7h8bT@B$g_C
zDJiR9@7)!<ZiNS*Q`K2H%ROrsE>!=2OKQ)b#p~-#pELfi`&;>Zx%~5f>BmyPc>Z7f
z!KSSGultmkMXQm!1&fuE%jLCy*cHJo)CG@&y^k+h=-k;lH$l;1MWE&;zj+(7Sr0AR
znbhp2tz{Hf^KYW#V&}!{o<1uOVEgh${`S%}R+UX5C+D6l<Mu9pw_<n2!z{mVE0?t7
z{o8BVwl6II-^Ux(zgO!p3Vh?16@1Y#f#HvXdvBBU|Ngz73%XxL?f&sy{%(uZo4u-P
zZpqzyT`s?gP3}}%7M=8-cWR%4f(A!d>#_wQfm8JEGL`Y(@A`dj^5c8$i8G83pHa-V
zfBi|}&CTa?K4$&+x$k|Hi~FL*?M08@F*2`XWm`1Ofk9coDzd$H&+dp%E|<*XXEHkN
zd39z==cbD<uIbLYxZ>~T`uw<kE?@cQ-#LH6VXc4GCzpu^JIbFwoWCl7vE`lc#fdLG
z0<G`WpJ%yPnwqC#B_yl4Xz{{td{QOKCSQ10iNvrtrDxVp_nv3*^`rX%gXdDc%htv4
z<x2#rZ0W6E^i#O9ZR^eJf(ae3?qB`-T4<TSXmfqq2Y%@<zt8RuJoqn<&8bNF;>1PY
zD)!zFv{AMalI`phu`T+>C&!~BQrG@2p2bPUe2ca}n^U=}f6J~b8DF-2?sdE9b&Ktv
zEyKU7PgCx9_MN)9^YN)$S3BeDE33||m|$n?Ytz(J&*eGq&9nSZu|kg*=ZRdLc*i4<
zeXlHw(;{VdS<ND4?>=_>pDOlNx1=IG6huBnl$3aXa;a#T&)w@bS?H~aROoDb-d?xI
zYCZWUP9NU>;18$Kn$stLO8+l=yJJ%xuT@CupWqI@`LmDie<$ytVVty2@a}R=?&r#S
z@_mcb?y2?^?h?Pz(I;|oqSY(y9yiTJ$`>cTc(I_PuidR@$J7Z5buXT7(h%4sFYCN3
z=9A06iHBcFEbOYEm9qHa8J=1f7CXka*r=^awU7B%{5#t7Q)fxOzVVOcC;k3-#~FOT
zwamV&$uDe)%Hei5ll4ide?QLNX@2UggGb4djy{nn(QW^p+i$z7XB6n-4hq>96%|)B
zk`|UWUikZ>V$o?;|Aspz3P=9uJeHrNm>|)-#lfV0TS&O+ljou=a;{!2RclVZijTfO
z^<(}&`ycJIE2F}%-#T{6cEkPNlfqLfK~{v!*uQ>(-Df4Mq6-sWc$BDE$<4R;=;y`7
z+3Rq_vGnMZ&Liv7wkLTy3JU$Rt>O5ydVeJ|?;`VWZ<@Y(U)mmjyhm2{()#k~<5qWn
zsn(o0z}+pbv~8cp3zy1Il_g8<R<1QQvAfz5pRsx3(sW@Tb^jeRXK8>!@0YO7a~na~
z&OR6SManxr9(i&y_2tVaCQOO!B`0pL?pF18>6OUqso!b-{@AfQcQ*gd|1<k@>6smd
z3;+I>5QuG<Z~0n$>96ant#|o+?3`lL$ndM|qyLEwueWa8aN&ux=%aUBimrJo=0QKs
zPq<v!f9FJA=pyBv6JJP}R2I3Wsb%&$WK927z4!gHC!Ejw1+#XP+S~H}Xn!TI<J?&P
z{CUl1vH!nr<^5~%c|1Sk-y31mPr@-KpTEa*`^&7~Q?c;XCsm7s8J1!Kejc|!>{W0O
z{hy<6D9zb_xr4ub29r~{bZ-#IQ(N!f4s`&9CnyVqyjT-yTHy9XNno4yAN8Fe|MAJE
ziT&qU`Y67ip=738?Jq;GzM1>~GW}^jt{L&g)3;ad?T4RV*UmOo5D9m;OI+>jZG75M
zj%~6!DEKa3vU>CQX;u^{f8AW`RiYwxO-y9M9gdc5BJcPVc*-ROUL`+$yZ&G14viVU
zS5Gq7U;M-Q$N84av-SH$<oI=%|J~ig_~){MZ|*;r=UR1<GIDK?7P7VckT6?eAD6+#
z5tytZ0P@4)rJ^rhzb)bcS<~4ka`B`6|IR<(Ztq&8^hvt$g2y%Ac?N;^H@_8Gb!;E=
zlb~>&=FjRM)<6AMt1$EL=K4do*<u$*wX3hwuv5Btk4NB{tX0CNT7_2upz^F*^v!$b
zcuD8nr5$}=PAFOl$<AHn`+jeE)yGH6E(Hb2GzMHNv^Q7v|545LFZ1mD<#s<g)Rs!_
z|0iSl$GP{8OQiny19sIP{9~Co1Qk0h-A;x-yEoI~c$M4Hr>D-%HN73}9WU8+$D^cV
zwbDJQUMmGqiUX(ZSqBfXr>3rrVR7<xuid+Q#>Ev2c9eZspTB<p$M>frCHMbndE<B>
zG}h10yL9UV^P0ed1#B%VPfu48iPOGtbHB@vhmSvPD&Cy-$~sChh0}_yrO9=67uQ)P
z#fL3QR=0GE9?yK}9GvFk`?sp>(GSB%+81l9W~CpJeLr)7<D$jRO6HrQr@rvWyYuF$
z=>DRohr7DM^q3S&E-YWoxX|!l?H|FI2&1}t5e08Joc`Q<6n}Mg_<9~`qvG%Hr?v^5
zKl_g<K%L=yBcJ~Pl?g#cQhPuBjWXV6<Z-3rPliV0ghd^F>n^<fw|BBy?YymZcjrEs
z%xih`{A{WF$A0dq3XA{$;@sQg<=%4lw6wZA{i64=Sf8CD^L@{Mxq!8wUBQ(=XP?V)
z-Fx?*Ut6EQZnZI^3yYJ!esUxi$M?#e>RkexyVp4%+|c+p;IH@pm&gAsX8ONr_G+Gw
z=Xd=4oENiZN}8Z`olkON<D~NZct`$oM*j0+ZvSadF_E&*?ebh4Xrl~vpkHu#{YTF?
z7aF(wvuq0qz4dQ4hx|NqvzQsSmwmRsa+KFs7nTLpP9-VZwXPQG<Tz^2VeWR=as2e@
zfZd{%7FN4hd7NS+70=w<c=z9p^3tnu`<F%T@9+=kUcIa6CZocYxFTyM8M~!Y0$f?G
zuDzOzFUnsN=FseV@ggSn|I6dz{c<;rPxgG>vh3NXKbC2F<yX!>KmYw+cJSOorJ($}
z6IA;BxqScspY!(inHdJ>Jy@KQD=n<rewMF%!l_aFxL>MgYj^#tLk5Z&zRKoX%A20%
zxwp+`bo!vOBFIQ;?b&_rf))qv>Io9LX!vfi;`C=VwY87i-o%@!`AVo?WmZjH8~^*+
zQSP-2H{MnK{bR{+>C9W!pWF&2x}e0VWF;i)n>~Af{i|uZ=jH9qc)eJh#7``}^J1FE
zE{;I$;@%71E0fjT#eP{f`cy5xm>q4l@U!sW`4(3g6<m(5%rfb^7ZU8YxbwM<Zu^8q
zD`qs-+O|kvo~FC*tjG0#r<h*au3epb>ip?nb-fS&ZC>ndmz{Cp-@L$^?*mWH-F1d%
z&d(2JhGq{OUie+;d{MVoX5Yzx`un->_b#7aX`x~TDhQM>UhLV%&hn?X_3YUvw&jcq
zr7s9xJdpR({Hw!sReu*gdA9SS#tt0E#YNas7hhysF5UaiIN9Xaf*lds-*>WdXm)wY
zm|G=Z?K)IjttEW^U@mLD!^1;NY9-+(KZf-4e=vM^Sn>NJrTJH{|6O{<k2`<HZo$M?
z*_XrhE?-{o<3`AY`MYbidD6Dz79M7sFKzwm%<;pI+<EqYJf1%@d%v~qf__Qy%Woez
zw7cY~SncYQ*5tDik}d!Csx<ZaIdNTGu>(d-3oA=(-n^DGvv_#Q@X)eo*Z)1-Wi^af
zRTc+6n4`J)BAfE!i>29D{(f^-dsd^=##{F0FQ*}Ii-_yf-21myt@*TL#*T%|*3a1<
z{G0Ua>~zch|D%M&qU!(NdR$$;US}4+jdr(f?&AFnhnAaf&*^%1JNSH>L*&Z%FPXV-
zpRyLm#-6<M_Upc62al2xQ*%gY7M8D%lVs=HQ}u7oo9kN}0t6?iFWU7}^7N*Y!X08$
z&hT4p30WLyQlk`quW<3j<^C5-w4{6e=H{?*FwQI#wl81fB#~w{b>5;CYf7`@Y-$vC
z2Q6KGwEoY+)%vn`cUuR^M@=n#+#mnBJg2&yK~!Dh<H^;_{U<H=zt|k<8PUPBJ^hi@
z!mXwIw@>H1p=`A)29)?OPQ0^Yx4(Q+qB#4Zz4zi6>@OE7R32(|;5aO5oZPaZT5yW0
zoz?LSlTT|ezF^;XYvV%ZUxyAXTU@bHwqrJrywL?ig&vL#kH2>;TJi3m**@;g)6z?~
zUYdW=eS5dy-Fp|gkMc?u6n^vB694Saui|5?o@!oReuVE`{_aa1DIM2O)z4miPTf<`
z`h`^O=TA!?MkrXter3;6S-DpI>eZdMw;ijul9{_A;Lr;HpftbT2H9-Ocv(*;Rt0QY
zQRv`a!y-_%#R6QmgW4}U@-HlS-PpMPqW2<QriXD0ro@G%IX!6flqzA6JsczHI%C_z
zYGa2E2adfLHBMDI+U{1gI>aLo7QdHil}LKlmd=juzDo<f1-Lq@$Cx{K1d2>J^Nnpr
znc4KIs~jro9#vGI^Z!v&@vL0?y{ntTlh}HuRek!iXJ6!CV4wbGeqGNi!Gs@0BFypI
za#`A?4>!a=x^ezouViOjfQ*JH&&P#kZ?&{~Z#9OCpEdu(&Axf!*{7*Yb{ALP3kqyZ
zcQLcI3VA=bYtOEdi4rj-5sh{C!X7#-0<|+iZHRaBHb2rbUPym^p2)N?x6;n)&~x57
z*G@WpI>NbO8t+VoL&foRiI*}=5`Tr<%qaORUoYMJ@9B<<8E-1CW|$l^+*1=1R#tUJ
zqj1(tMyIYtEQNFbz6ll(JjQgf>*kc{?Q!qfTUp;u`P#<2YTt}YQ>Jt49rC#MwDSHj
ze)+8HqSb6Mv0D~sX$tPse_JJ<Y$5PurQD=_H77qWb8~KC-XHrTX;+<bp1-Z+?S!t+
z{0sUd`q-!Yq+VGX_wL_O?v2d9E#FKO{&Ov3ijujI?8)9YVOs^P<Rq*_B5p9I^D-@b
zzBoBxIrG95!c0GXPD{uJb{l7!RF(d<VqSc)s@QGu=KT|T-M+uyYMk!$eqyux?tjn2
zUTXXnb!1zxqI{~+*@Ok+Tb?aqyYeX6{Y|27&6QKN;bP||`|Y;KW{a}w-OOm7H^Geg
zo6F-Bb%{L!7e(Hi9IX4iv`YPz`mg>8AHrN6uRe^3lIV51_Q)I_)N+!BixjMGv4{zA
z*mBA;|E;l-=TMaBZF(BBWZ5F8Vz<S==jNO2N}9Rw;tIomdoQZQ>-|5Ws3s6JMYwcV
z{`#=RPaEPh&NSFPck90rWf&^e!n-of;wsn89_g!Q3-~lk7tND3W!k$;YtKQcD-&EV
zHvF1iwDV7_wcq!*EAMx5x-Ajh_FMdJ{QFN2yV>~z;!A)0z0awz#eZH~AEf!OWF;qS
zxyeFt;oSM#Ia}uS_qDfP%vi2{VyZ(#nc2afi!b&X7y6k??cG<pImg5*HE8#b_J?<$
zty=YKw)v^a=f!2Li@tSB@*U@Qdg%6Vk%;TokkD;f+@i*__b!uPa98B&(K+#E_be;-
ze0wDtxT!iKrl#!4@iu);r(Y}V{yDaX_ItlSxKL#M)qP5lo>${fR~^sT;?HlgX4Ute
ziThu~-M!+i>=<Xd@F2_LsGHtDo-AIob@jwGHzrK(?OxO`^0-NNs_2fx$7Y*L73V*a
z*}DA8wS~-l`+t5g+dQ4k7Su>~aqoKJQNr`<&*w=~M3@$~mR`7R>mc#QOW}-l#;J@g
zdg{NQu<x^Q*G_h;vsm)#lWMWsV!=%pGyd=M&&vK{eev4Wpub}O&#8;D&fT-^W&h{m
z{YQ5s{Fval@bB*jPZw=@5wKZf-qG71mK%00%KET8I`XD{{uHjxmGN~Ge_hpit3CaB
zopRws2B#f6C3Z}z`#n`-jpx<<T`k5l68^;BeJ?E0+vQOC^~si{-3Ik5WFurMzI@%B
zeret;?dgy0<<c^oK6{-M-&e2s^^Cjoty!yEl74+}%hXyT>h1sib*jXH3j42%4(I=K
zl>ZFs*SYuob}dn{x}>b0acRk>EhbD0LrYJ|I!I{Mq{b*-c3bS9m34^y>-B~YDGl)k
zJ#L2&izsZ#{^sxVzCm5Nou7He%ePslgwEUUD3-puKl-5Khqa#b%+=G*q#xKnp>A(;
z^>>a}f(pfRqa;%PD7enN_V)4dsHv>?#d+R8j6UGHwxuIV(yL(BMU7SIuRbUmsVw>Y
zanh?PDO1@Vo?zM?m|1*mm1xkRg*W1B6<MF|u9tXU&b&DA&Z<NKrDLpDuN+zS$L8Q7
z*{MgS&0_CQwtDqCx9O=(w=|?f>`}rq&t|8M^5b~Mmfw5!n7rM(Pl@Ty18w1lUJ5=Y
zxh7R*$3iYFU~Bo&Q8hQqB<ug1_~gXIH#aUyrEt0ON%!1J&e(rXac?!tca90RMH@ad
z$1CzG%L?mBot*z$a~1DGi5tu2cTGB1o^~VQqt=zP7eZE+vBX60_p_33HBB*Fp&mca
z{P>4Dt#fJ;F}qfI#n1PNSCj5dGQD@gFehTKLGr81v!pVOHN<DO%g)`tXIq^vPv#Ow
z_cI#D_=+xsKWmxKAF*1y^98)8XqO%4o0oT;-D!6!V+qg3T^Cm<1zbBV7VNe-^Y!)4
zb%DGb!P9jw_PE_XYJbF8`TPb&{q0JsKf^o<&V92N-an_+Xz|+H-@YFdZ8Z_ws_Vxe
zG)0!@vT^32hy^0g{wA?~yIODi`nRcq6^jAKgw4eo5%RAZ3~e;I<9MztycuMa%_!hy
z@?*slzCDRN?=7?MN?C06IKD`){O|Fvx8&}yy$JDDu(5wx{MA9C*G^}jYQKhkZPyR3
zzuUCApQWvf>pbYxAirv2hQ`qqOTLvQuK09qqI1FAz`yxi-`<t|FxNP8|8v6xP?c#e
zB&(^On3!8<*C?=w!HVtY&l1Ua$==0MpFW?F=uP4Zv<{x|aOcd+@^^Rt7W)>r%CvF&
zkLm1xwE1}3>U~Z%Rjy!n<CB%Swx54hy%g7~^3@OKe`bB4E*kKEUW}v9qoul$5gV%0
zLyLsg1UQ5#%opdEU$j@4xsKPoXbYp|625I^HHx2OXFolCf1~f*v)cB;>XuW)-rP&P
zFsaJ!<OK#cuX#p}MuJDHK0jiu@X0s%wO~cSt!A|#)5T6Jw0_p?c3Zq*ucM;in_ruL
z8uA^Vpm@(Y<o^YY+tWm~u6;hnme}-ah7!}CvOWLnu0OGb7w-GM-&<)}oYmdM(K4^E
z?|9AL#k=lEJY2hA@`e{8thT>p-M8j`f0U$p!p8Vxalrfo_B@hI7TWqt82)eCp0{&D
zLEW1jhTA^+H^|$)OljO@9kOld3O>!e6Ai`5Zb>4(-s<8Tp6E4RyI_|2n}7GU&oe*2
z_J2{gWiGphX|A2d33o}~-7-9uS8wjw)l<Ur>7>I784l(d+vYJHGiWdr<#_Mfwm;dV
z>fnJ(yoO)0-nE{v5An^Iuxh=z)Y+KdvL|lVai=;q&%D3Z<mc{fzyE$O-}60gw~{cV
z++4KSb?eu^-;>4l^LCZ@JG|KWqT+<_N#Tj>7@Yzyc+dNM_Oa1pKLh92;wyiCPW0@2
zA#zniuO?ytn)`J-H)bEd|HFKr?4RJ-_IH<hJm>8Yl3i&m&$rX$`Rm!U|7&pawkdM0
z$~|G}pu1Y}cU5heTEfbud;Z*Ndw;hm|AX&A-Yru4k8L=YJXhS|-+TS?wa2?vUD>~<
z=l@~+J9CAGR8_m(>eZ$OQnKbzMn6Lu1+JdnHjmXMT&y~3@8_<TiXP=#W>UJGoJKOw
zcYnOCuRnWs=;Dh%9y)*RSH2bS_K&;C9(##YlmFG*?|U;W^c0jm*(>(IZIQC8PEA0V
zo5B|t*$<zx*co)Lnyxzg@9v$=t3|!<KUw)`{v_po4UQ+brn|VeetD@GetTE_gM&Yo
zpSXWpv&_-Oo$GOm!>n6dRv$77SJKFwdi;3lKUpQ74Li4ltb8M>|D(7o{2*UQvWn=m
z4KCfwcoVHIUdRw(6#b<a#`8?_U-Oh(MyoiFI=sAlY?riPo1us8<CSiUGk96ITc??H
z8J>Rb>-){+<$*AfpTbFpF6`m^T{XKM+>TQP4Rl=;`gQrXb=}of?N6VwIQ3uFG{5My
zLwmQ|;a}f%ttw;qtKEKtcOUtA>PolA)P}F8kE(V*vXkfj>>u)<B_fLLzlao%xo@+J
zJJ;V92geYmi=G;yw?p?_lsLTc=Kjx<)fwhANV>N3-MRC{+RAw1YXRd0{=3&7U46lC
z<=wWZTUAB-cWLU2A3gIwDKuh5MdF<ejx)@B{#KdUweRiv<+EW<=JsT<rGY=^R(xhl
z4LbQGSkhEPZ}EL8ncH{e<tO^D*tfU!_cxE8^!*nzPW5Q|XTMwRyP;}v;GWwCg0A=2
z+Suk_z23a>qfp6JE{-E<Q(6O!TtfwF4@D)fs$~6T$<gw}4U`L2-B0a`n6aa-wm5ff
zYh%Iw?dDtjCrxcMxO4w{t*g^?fr)KdFQw}<{=_Tay#FISV!@;N*ZyS6eTa}&F^>x6
zn%uzlaM8_GI=6i~f@c2}XPT6{F0yqB>z2G%=N*r9U%NbGU((9n**^2EJVQ>Z@Ua|d
zSlOUg!L?Dcg7c5FyXu~lE0+(rzG6NYxcRR8f#@aEKIO^Ub%+J;UA*!@U}wntIW~Ou
z{)dwT`$NB-j{KRC!n(wBdRwN}g<BiWtd_cZAkV$F`eI=hqiao5kINLRi;1&sQWvf8
z+2xTTYIr^e(u;cG5y>aJ{pSw`?&w#q*K)UfJI(Y$;*FgG&u8&g3-KhyXMZ25^?1*)
z6TPPIu_WN5|Jr|!)0R5U?_f~>vrj;F<)sxKTRDS$BMu78m3zKH=y=_-dCS~Br>=<!
zt2Jchon~>QZ2t4P4<@fTDtT4Zp24SU(HuK5e!H0;!WeU<rYZ3*XKZvZlgY@@$p1b6
zn?!HYAOBi)!wu|rjAVR6Jf$ZJT{?Tf|LTPdk<AlxC3@9X)_#(35eazZ*82PRp^OlH
z^M^8^(U&|GtDroG<8S}{)7<~((~^Y?vzZsNg1h^FR@$DJT56fRCHUid?<;J9dA%xJ
zR?M=RGmbAfp=O%Mq<*0;ve;5Ic5cCvBRq0<f+tLDxaR&x=w;=J#m@5;_vP*W#*t`q
zUhZ^!uFpm*)ks#GnAqEEYF+m7v0Aaq?OeLZX)pJNnIG%+8b5FT*6ViBCF{qOtuHet
zvGYVl7*5x)ol?Ob@?Nqg(AKzob&83Wu$_clqEG?bsk^%*&(42jezf<{{U~e3M!t?0
z9;KospoxvnKI=b!^>c52`g2j4Y2n=>GjqAp$ro1${F081H4*;7{`kVW=K8LtzqNBr
zxxEBs4Rx2L3k60V62DsJvhp0;E`e4HX%mj)Q|fav7i?<`s8K5OvgFm^SNiIxyF2k2
z?^AboIm@q$5??KN8{R0flu7g2;@g`pYV3)Aa8&DESkn!6RaMsNvcxo@oJ#c<EOFXz
z17EM(c36d>E@O)6mII8dyQ5Yw&s@J<e8z<UF72|&JQb@+(%`{d^LKBqz0KFD`7^`e
z1zU;8N#VSZ4o#=Ub21g31!W(4F?mhw3en)PS~`X0u!Qq>ah^8|b3)6kq&nX|@ITB`
za^!5Y<=36uE7(_=%~lfGxR@#C;nP(cmpi*H{<<>$?4+pBi?XYd=7m*lm2K$=nzwMN
zx=iqYr^9RW9!@_oJ^XA1%cANvAMPtO%;zkXg$AOF`=ZD1;`UxDdtZ0)l9R%l5ZMnO
zJ72wfe{TLf<{H_;=?nkVIt5CUXz>QQxJ&fzsr$DlbbrgyrIlA?OqqD6X?;lW3gGs3
zkYHYw$a{T#;<kWA$|h^(&Hu8qEb8gbmax>jc7iW%?2V1yf9^oWmtR}UdLs^QTy^oq
zSNUtJ|IFE*yP9X0Q?CAuFAUAMxmN5js^{C~=Dm1v0vq=Om+-Yw{aai5e$HZY0uS$d
zl)S0B<MH<GUF+8m4u+qfFU(=>FZk}?Mu}t<*;h}NIK^I8_L?Ytd79p&f7h7hxh@!K
z_V6wG8NAANk$;fs#v?h=!Ey6?MI1Svx@=7q**3rLu5{3kE0^b)Yq>4{mdf_XGjN%)
z&V*N+m2wyqs~kV_B^U{>fAxv$)91pT*E$D!A>9`ht62vR+0{0*uD53A=4@Hmb#Vpz
zF`=O2e;>*`KFk()YUzuL#Aha3YX$vOIv*cjARTO^^D@BdXLD1{-<gYoMO4yu{LHIZ
z;rO98X3f6Tkh=`d;>YJnolkwSs_Ouodym`W$0_1--u;uR3{#soRq4UfZYI{v=KmJ#
z+a4RL_;263<<_7=_Jv2Did9r7J3Ie5KAxJtk6PIoA2R0WTc;{2fKpSq#LR%H`}q|F
zj`;B{v0|4!Ut_}ZcGfCpu21)+i}R<kurI6?Y0l!9xPM<E^Qle)mz|pm<bni3{$1ow
zF6FSA{(wDh`lH<rz7g}D{MjV<ocYxSSuM3kDk)4sZeMu>*vx+JF59BT{oqx>_9a%l
z9j#U>_XO7F&D@y9`iVi<jVJ$jhKaGWs^{O{#2*_9{>RDm&Fz0b%|>S*>vfqPoky|`
z2NtB*-g+u3m{6$z%EKpnUEE)vW{Q|0E%xo%*X(Y_g{>Dp?$|v^{X~mb3CkZR=RdU{
z?G)x|8y%QlyKq`?&i{MU_suGO`TC~e->S$@f+8kHZ*p4ZFHbAv3~RAfQ+wyoDIsE_
zBd657FEmp3=~EA7kp&s&opj&bxe<6sl~o~2VseMs=`!1p7Rz3hDe}B$V+CIFDISZJ
z7QB-FH?iXUwu>ur8>L${U+j<By*FiXAZV6B#R@d8zv9(}3kwf8Jv^SKtFVQ^O73f^
zzJONd*MI-nzBM1Hvs=ix&tr0b3gd-MR>mm|N&;R^O#x3TgF;pREn^5ixbCv<_u_Y(
z{Vz|~)4H*h`Pza5Q(wr*mwaKF^3p_R(u{yM=howKHZ>gIMVQymdg|SyczK_y$C{;^
zlqyfT1ZEw6qFD6yYHmli_=OwO1VSqQ9{>94df?p2|Cm2dzbKo;5nz97`j?*)Q+`~D
zZhhSS*TUuD{=D7y>*IxHg1Z4$pmCWtE3+gQ$C52wt=HI{wl8|DD9_L2#8GlZ)w_OS
zzB<Fh1(&C;aa_5Y`}x)+P18k73Kv^{HrrGmbAQToZLY{$UeTK_G%gNGKkp*ExT)sY
z=>q9BN%t%_@BTlv^8T&*Sq+8`rb#M!vQ`bR9{ucm9NKlDoHsstX2rWR8xFpzJMv=s
zQJ3VydxIyoNeaE_49yQ(8?-1ov|4o1-vIk7p9>!M%Cs;(GWlKDVfAP=(?VU)v>~K5
z@j}9)DCOhL%|F(gHD1VkQK5C<{NWiF^iRy%w|LRJb}RK8`brC4KNcvxx5BN(z{;er
z>{+hDLH|R>CMnB&W<I!)dHvejpRd1W_ny7g>RftwYGv`4O0$!b)%WDo>EvFUe<!Aj
zUy)1We(Ku4dX<-+KiVo}mT)D&zO((1PFG8tIh)7sovFercv_DXFLqB`6Vq0CwEgJO
z0v1u@I<3hGR)We+ubNlvcj?-@Pg|7LIfh$zO;X;3A_s}+f(GW!J{efydi?QX_v{D{
z1(Ver{c9pyfBu&F{ypRT`Ty7c-g^}PWWUh=6&8yPtQPPcdLiTS<H~*(-{qOzVo&n_
z3-6n9^`xhGn$K3l9UX0<s=ogw9p*3HRbIYjww>0_=Eb)T+b7pJO;cd-v^J>wapCxh
z-Ql32fDLEo?Ykzu|8G+d``_Qf{~u1Mo+Y_5&|UjXW}I#1qBxP@da14zneP{!;wqUk
zkK3VJD9QEE%ro!9vhr5@ePmkN^ru!f&87%CE@>_#>#XLxYxX231ru$FnH6iql@^>%
zzHxr~o8?`*#08hNT@;nKm9bvX-+R)zw@D?>#yBS+^UKPx)Tu1<b6#(mqA7f}ao467
z8tNsB^6oSgA1FHX?eo#Y>>bQTDNd$)Kb*Rg|Hb|8{uztjwWMe6{@(D<pRta=o9k)g
z$-wyw-l-q^c4habjgRc*u8GY_U=j3P_2aGcGwWlT#sBXxiO+2DZ{N+=zQW+Lg9m6r
z3AAEh;}Z$1R4>=6s&s~jj`{D)N)I$~2|2u2>GVFeBgyQs)wjc2o$ha|bt?&+@6Tn>
zrsnoVW|8~GUrt=h-k+H>ZGY|S)6ddg>UVejuvl>Szn*x*#6z!NUtf5v_0rA7*4rPR
z?DSr)8<%jRg>`rNi<@rQjAtYE9g*Nz?l-A`!=~)*Z_{&CyM^5QePpb;cvnbjPg9Du
ztv_xy<JtlD<%;UNmo8#jkdbk4((csB|0W!=-F?L=sW>w8)%19YaLwOe4!9QA{Spj!
zyy~ZNbiSljfYypdeYYw;x4oU|R_ggQ%(Ln0$;`Q$pL5*6sR}e46PS>g8aC~BW59{1
z7ZNX?CwD$EDTtb|c|$<>ci}hfyW~Hv_vX6Mu+fBP`N4%ttbW=YyBd;UVV>1;_<8!;
z$W#fp^0FfZ8yV+K_T6dD`&K)#c#=ihl9C5E{oAj{cuj2(aIW?JS=r{_E;NnH>A8AO
z>8a@JY4cwl*w-{SLGg0dmUnYFuDsuGQ7rYULThIt)93e7`u5o>)>>=i*uOS5UNXHw
z?&`mwJp%hTd+g5;XKh@svBm1{`*w@;xaz$Qz9OK-6*3d0K~s_^A~$D!`gDiC<(iZG
zM4LoWS1uzLZOs((-<_A_p9!6;i;X)ee4P2xy+`pvXSA+9n!3wn<2l1vGoHn}i=!RV
z?#+*0lJ9vrZ^M@(2j;aTdOkkh@yuuIo3dTu<}cX-a;}(lC(k!GUAX6(XYiEfU)(iU
z^_Se9e*CCMb6-ZQDbGfS!@3&;=5F8KFUzR7IN|rFkI9F-;(u*AnyaWi!@mCcH}+Q6
zvrki3EXy*DKJ#zkv5v%}*{`oJI-zNCttIAA@0G-S{Y45FFYW|Q?tvCMBqYW<Ho7)m
z;C;~{9`*70zu<ghtwZ;d<OB>QE{Xm<<a+o0{fQqPRBLSB#HFxA3CNya>Uewk=3ckg
z0m9B2tt}>P5gh+^T4c9{{BD}dv%+naa8egP@1je*A@h7EEEYefy5Q-i;(L`A7Z!Ae
z)Na{y`QnSISKl8AQ0<A^a(tt#$BMe`KTasVbm-(<T>bBFEQ9eqpC2C?uDD7qdEWh^
z;>`7*Zi_`OPL#6*b!2RdJ{VS=oAWDr`x=gxJO}rQHjaT}qEh;TG521*XsTW^Q)p(E
z3D=~98Va|9-<G^=u{`yY^YN0&S5HZc&GGy4g2T;;ZSRpe8Xcw2X7h_2S6TQaLqdvW
zir0;{s27u0c{T5;p8eX<(QXot>YvwMN>=kel#2=kK}&Rxk~`0yif&Ii*?cL8Dbd==
zR(IFz`3o1>#EG!#d$H(lxwSXo;Ngy2cQ*(;kz6pP#m~txvX9ej#;S`e-0URsncp8w
zV`I)aQFOt~!y=?4VSb5D8*^aL<TAVLj1w_io#a1$U$V-J%cG&O_vdz#W%>HnZz`EC
zw0F)9aTIr+oy&Uvdg_wb+oZ)g17EtHv%ck?n9%$!JW%@0DkZD78Rk+;JNn*)saj2v
z*0kR6A+gf3af5Fwhl0sMjp9Wsis#pI)lb}_%B^^#{XjJ9PNofM8#ntbUuMc+wq?nW
zUu(|nPF%<_%Xy-g(Q1?RdvZ5j)TnUV-G1k6{h#9b%)b+Ne7t&DJ!_)CJj0-g0wOI&
zi%&&;y}n7MJ211s;NfF_Upqk`m%#7Lm5crcX`ec{&y_zd<6;Z9#;%B^w}mf$_$bf2
zQE(2&_Mjsk8NU-}F0Qw{x3}%hYxDm<c>l{E_@}48NO{c?&q$Z!egdFAUdfWOA3x^A
zZhaN#+WOd`;>2<HY1_9iYYq#W!0g~rVxq{E)-S0&UG&}ESUGWSVZSMF9`rON-8${w
zKkw?*N7EZv{;bU2GqKqE!wQkC<yy<)^<}QE(wS5FvHPW7o!Hfkknr!pi@qHQX_Ms9
z=wNKTa?^vyEvwo@eA=5{`;LDnPv5Uo?Y;d_=FHcbHH)m(`yXoveq)%n&d-z0Z*d#v
zm!root?*DuZ?NH=ZU0bX^54h5%Jdr(?I$KTs@>=^E<AC6zqC|O;gK(?-XHv#Z+uuU
zbg_`X*A28hW#S!=k~cbUzkIdbpXlrzJ2z5ci|*-#$qUx^cYo-AapDR)quC2Zmdytl
zS@+F)u!S%6_(I-Kb+24c`nw99ifmF`%9`yJZY~oi<hJ<K<Ak;g8$JrDEqZlC*<zKJ
zX5ihPRVyz_U()d^P*`#O{JfX@Su31B>^-UOq`tPqb*p+<Ra`GyW8XIZ@WgrbJ|}wF
zYxZ!uid>x7+~?xHD0z9(!uj$WK6pAeuWq<d^rGU(@!PHe?j=hM7PcELP;|ZVa_1u6
z$BK9P9yhgx?=-0Ga!E}(xbE^*KNW^O$5mBdEzMpZmw9@o@aL9Sbw13;c;Bsm$L{+0
z=2EM~j~A8md1DVP6}#yaIN4;m_UC6FOVXb^m9#KVU%X<mfz;Pen}S=E(mP*xfZ9wh
z$L}&Sir4>qnwh-#cjE;Wb1PQa#WG5Ui<Da@8myFC;nu#ou;#5^qf(X~;~sNiyPqC=
zx!CyRMZ{JeXP9ZF*v;>z`RcE7=z87tQd>?Z{qoZlTIMr*O`cm#lUd>N{sj(CZ0GqM
zO1tQr6;xqdXnf3PMS->3zj@d0xK|2Kp5GVSx2W&;&o>`GZ3=dAf8KQm?4&2h?%v%M
zdvDj*pO25fV|V(#C|RYVQ^{)E@*@|OFSc}UlCE*r5_%N)>#+LHX!Arl9>?O`y<9sB
zqS6;<{aVDk-*#6l&x*;?UZQF`{kFVZTT@L|O?erk`^B?MX<psbd0khu>auKw4>!I#
zk{m7gvtU`Ev($&OgZo4N>oJ}YxcF|0dXu6S8;7Zm$OCoT$E&A_@d%5_+xFa#PyGLQ
zhKAOS`{GNUm)tzxE8<%6WC5tjvtxO6dBVf)XKAaM7FM=eKGJqBt$lv}%hK+Izx=oR
z*;`o;$q9SE=U@3;SmJ<0UrS?<3s3Ww0<{F8a~dBeyBP8wo4P}(Zsy)X<~drS=Y>4H
ze+Hi}F|ZEQ|M=rx?AK`px-4cXYh!C)e>nJxTXTn)jNMu3-c^hrqncO$YD<_Fbc<i*
zT-4r61@>KwIJ~EL7w_tq66pH-Ow_(cqfR;DSI~xP^_YSL<K`)RCA%JNm*DT_TK=tX
zrnqY>>yMeo?H4Vs3<Q<!J14%_vA+EMm%F>;w`}<%-Dq%Reu;a@7w06$f9Kw=_^rtM
z=jvp2Gxk3{`<uk$eq~KNWxPQs)ZeKz@YYKIj2$0epI;Qk@oeHc)-#9MZf1zQn|q4s
z$h`kGKA(<!EZFM!gxMzi!PiB0Og5QkD$X-JQCS?Q6LS7Sb><HFkF{r?re3N$<FJT(
z%UbUTf-DnmpD1qE)V^cA@#agRr}5W27k%ehamM*bUMOf95Y+ek{{3zB+Xn~3yZ9gd
zm;Lt9FyuPJA%!rG&c1wJV_AuBlcO9C)@5{Fk?($CKVinNAeUD+3u+h_E)>7`p@_kC
z%UUhB#i#!Z>GoyiXH|2nx=-QtmF&HC#Up)NNQlDMdj<BVvUh~OTqv+J(YjLq`Stl<
z-WmN`YI(Nf3}@G-Io~R)tGRv%f|i!D%XaonIdG`%Z$s<)_&ouQ8)_p3WhdG=3MpGH
zN)}GelwIn0Rb-2mrKi^Sg%2;B2;UquYg2IRrg<ehzTNu4-~OWf&_vgzM%KPY7xP|~
zEDjX;(jvZM)s>sZq5H+&<bS_A;hD<P(!cFrpKzU8WcB26r^5+I06bZsT$=LX!JNm(
z8(Y;HE-1aIIC6b@jcXoD($!_LQzyPUD_yIS5FDrH#`WH{CG*<!S57<r9G!Xjo}tv;
zU6FU&CWprRhH7k;jC=ZN&U#gIKOWU>R$HVtt)IP8psC{ZrOQ{6FP3RDF{_5o^>?}(
zq?A<?_^LUSRo#Ef>8|N3E`ICiRtOIeyK0zd;w2~xYENENb}g|ntEmX|>ETq^!eQk$
zaqhpbO{Uz3gm@U%@3Tw(DJ0SB@sK4lJIr(9(+1&0GiGU_zt2{8KigmTE5!EatzD+C
zKFoXduybykWOLWWj8zZ)7OSsXeg2HYT_MFc8E-^X(%dY#{?2(7&FHq*Ai2wKp`4j+
z!TS*H)z`1D-~8N3;*-gmrbA2J_DmK@bxq7kTt9t!?nF*-ssF+wuVlRs!$Q{!hDr@C
zDV|5azJI%BankRvyGj%0clk@?cgvfd*zjt`=ga+vez}@jc>buEaZh;Z(n||2gm0<O
z|2<7Nd%ts5YnQ{+&h*s97lS9ZF}IwTl6v*;*!~OB`~P=U+Mh8=+F#td##N$smAU34
z$p?a6QZL^=KK^R6(MRvMyQ3JzO2hB$pR3r|Yo5R2?gopQ0gjR3ivR2!?1aIqY9Z}E
z7N^Txi!Ww8U%h+(zv<82c>JR+)@R(GcgJ`Cd`TmRTQ$4V8SLi${c%{kc>l@Un>asQ
zo-vtMYe&7}(a7(`yN<JK+>|_bcd33{!7lfPUz29U-4(EC<XyG&RO`ygi%Q)VGbJwx
zl@o7%f9qPSWbphu>&>+GiSC=-aG(3A`B$L_p%=Hm3|i^7SZnjj`&XG%1fDcFzsZa~
zD!1h^lk!q;1pz0EF9B0TMHRJL)LcryOTLPfFJ4^3(Q@#efs`tXTAx&4(I<;vf8*@x
z{_y)wovz+1w{oA@julC)NnhqvRIfB%zR)pbFBezLqjRALosKbZoIb60cHYXjo%x3|
zwmkf0`u4^Ovz80R&Z}oX_wBvpmvB{Dd2!&AXS;XJ{dDR2W>s(Lgn3DOllOco&pFH~
zduZqJa&MJ4KGB;dfC6$kQ_c6v-SZeuf(F>`fEL5dVmzd5XE$k=gaF&modO)1A^-Kx
z&5$zRu%0JjbNZsI0bB3yG05Fi<#B1o#5Pd_^?T|Jp=W)LAL@yT*4ON|OP#^d&)|^D
zFZU-eW5dLY8CPc>{CnFqqd@tGSMSm5<x8D3gVjAl)Wn{>i;1=MmNNepcvALi2wRxp
z4-KxWOH8|&o)w$_Z_L{8_V86DMUF`SW()cM?n)s6)2=a|XN4?B2aUnWS#k;7nx=a3
z;>wf4B2t?AwLe`C_T`>1K42m%qrkeek#p(XbirHmrY~0$OVNo=s@Sy9)cewnz;nAk
zvnVePTr<mi<+0!PQcO|7zg1?R_PSr`{OgN>i4^Oz*g1Af@9sX-AY-=L^W90|V|$(N
z=1TM~+I#J){pmx~j(w<g-edR1f1*93a<IduG#lnuZhH1?QnEY5W_2+h{<SPPMk;Kb
z3fHMiR*xRP-MPda65ETEFJ5F3h+>m1EWNlVJuc)?`h2_mj0rawX7YMOg`bX}`dsMB
zr|WN%-IIQQ3-Ygvh{&*b@co@e0>g>mm4>&L8aMx%E-l$>x2xECTfTp(JsT_QOpiJ2
zEy2HI8F#V0th~Q|;xggTtBqSlp0RW=E&qD^(QN~%qo=JEFAAy#e3*A?(MIOqS(RUA
z{P&q@q_`|z|9AgY^WAEFa*;dA&3AP#{l4eN3B^Y&sim^tMfVwjdWYb)!!>rN*Nc*;
zeC~0JR9xd{mv7N2etGxqEs?L6woF$$^!I^B=lu7<YW@vJyQ_*^Yvv@{KfhX8{6S0N
zjLGzAUHWz>&NJs)C75tM_x~#NB0KcBRB-xPfsGYe9ZWu9OI9DwxMC0}uy5J6e9r5&
zAu(&>7O8z*<h6O#MUAlHm$vDZ8*gddk-ej@$IdM?<;^>mxjS~g{C>nxdFxMy_R_>(
zA|--{x46YeUOm<PLu`$Er|^`olhtd!RaQ!N`FMcZ65s|!<A%u>4Cgq!u(@kj#nP~R
zlJo-CTb$pVpBiMoN&hAj&7ti3TkP3ohjPA(doj_wZ(U$yRdr7+p0zDOFG!4GT|uAV
z<-%M4_Wu*#w|v)<dAWx(wkYXc`=*;(yZzFIU7J;2v}_SJy?W@bHP3OKqYjI`TR)!e
zHeQyIyeRNoaF@nmsmK{h>_UZ7DV=%>T4(Nyzex{DaRMb=P-(^4vP|Ta&Ei0=!^yJ>
zS8RK*rBl&%<=)HlR>gj6d;j{<Wx45hesaIQs$IQ_H_oP};an*DJDIo3PUM=KG&m|O
z>=j^Ldrs3$bt#v6kK58!E3-^iaV2zqbbVX1R;SJU;h!BBU;R5H>do8hW*n|3oWHfZ
zrM)!jYG7!2y=l6W&W7(V?QBm7#X6ZteKmG%c5(l#1X`y68gg=wcw@6TP^<RkqUXJz
zBow_;Iv3k*{HV2K$%30gXXk%E<UCou=W0(}mR@|;+aFA_jZHEuN*3<YkWGCtIWt3V
z)~}-_k`qi8U!0)ed@kg4r<87d{Qj`>bE>4LZcCGzf9+2A`k)Qj?MvNLzFG=PRV+4>
zxV_)paS?Z?+hPaP^OxefUYu}r2Q^KuG<;am-yat%#NjW%F;_k0WP_ELRlKE*Yf6yR
zh2=j!IG(wF&?-nPEAy(lg!e5k%kX_)*Q^t>n>Ky_Pa%;f9T#6*)qW&Xy{==H>Lk&C
zy)A-#R>og7R!H>b8JS7VP0TUjl9yU(q-M8>t>WeC$XjMNGqxz)zmOqvf9tvjq1sX|
z58pA1D@ojVWFD?kwqpO$K#^2m*>4}&nk$!efO;Fspru9s?gz%l?>*4cw#md??zPiN
z;RQM&y8`+St7iqzf1N7R$dE1Oyg0DLRZ48@7Nr|ox87gKdWDVAZdYv0^NI&&@7L}8
z^EGGXgJ%sFGj6_o5w=_W#OG@V|1L6EaYAo#;1tHCUTV*@yp@#`Zmkq$`#PVY{njp*
zKN}p|^3!77toCKcE{y5<e&mm(i@U#A>6z=nji6EHl<iusB}-TYtQ1Z!Tpao_KViT3
z=Jb0%zN$L}h6W|orm;Pe4A6A?!RYorAht3lh-v*4KXWPHppz_RIxD7n&VIOM<s_l5
zsHlwJSAQ07x#)OxH5<1^#-lvZ#epI!Q=R6eU1(~%bgJdYA=}+X({$fmn4u(<#M|pu
zZ2oth<-}(>cN&&d-{^Yev|~j|xbi(Q-X*;M=QB(S(Z4ujvTl-%j_POTE*JMxUR<9(
zzvMarDilGxqLdpiTzVmqsku1NBJSRgRAnuv1uM(g@108ax8C@xJnzVdvhAYswrif9
zxX;ZU+Ur(q_HV(jtq*nzweeq_XOexjYxU=SN1yMU{XbwnUv7)qJP%W;zkUoewlv&H
z^J}}P@!(EDj{r+YoyX&QA$R9Ch=xjqBpV+%^Y!{BgZ9eL{qYy0IyWg+&*<!%r>}M7
ze)<0G+v9$#OcVkQBrQ@-)fD8od%Rceg5jC_Myier6nL~QdT8#>({foTxyz!)GUS!f
zG~J!WN&>M9&d-(-G`v4$dbE_Nrs^SYCcBkxi#xcc^tdhD;`;fjLNyELqJPT{@xRHs
zvYaJg>u-@~y>6ek<rpQNRqAn@EVFsF;}O?$=cV7SoZ7hrl=>t61R0q)WCcOX<@25_
zP)^Mh<gn$Cb+(n}VC_xN5hyjg{bzxZqE|uRHO2P3d^W$<?2A+Kd6?H!Xq_<Ib8%or
z@}lWMYiGyK$$PM^>GaC}jza6t`RlVxR!uWMn^<#y_d&<CvXLwP9$NP-&gI5b%lPij
zQ+hgGcRXZ2eB3yhp|cM%Or&Hb#1Y%n=NQ(Z#3HvMXPJ{if{#}5$|uXN-Jf)<$Hh?K
z?z|UfNAwvL4SWr4;<Hz|lqbD<Gc#ABH*A&LV)11@A=UA-i}Jm!FXnaK;W%8*ux{Qf
z+030a&qVEWHY~iDarSA5@$sYzA=6{qemPB*Iodws|B(|*KgGm`fwq7>5m5m3PCzly
zRm3VF_xY=+)vcwahu-HqWJSO8FFNcYQRT8U#7b}rL!HAX$8Y?v1AUuRl@IYGWOsU$
z|Ck~oZ}nlxu3wV`w>dsP-p`nFsKV|2btY+{GhAUuj&l9FEX-{;-7fRgX=nQ-bKMrV
z^)B0x88};=yZpVu7N?7oM6b-?@=fb?TfF#+_kxJ@OS4pS55`PQ+sfLo-g|e~{Uh10
zuf@zTlk7d%GN*oON8gpec*d46Ay6mA#huS8=-M=9hm7d3=f@o4;{)b%?v#;zAHQdT
z|59Or(CVi~KMo#S9q_`r(ko@IbP$(~uBwIO`IM6<A0I3AXyv@PF|yXq)2#iCWP|=H
z{j>MCU1eMxxR+&_7x%RVdZtoGtFB&}WKuR|=48Rc8i!Oi82sn#m+VPWn*ZU|9?Oig
zsw@7Sb}d=b_q$R>0J>^P+0~Mv<(jMeMc11vH{HMY`SQd5_tRc923%P1K)bz_OYu~*
z(4PZef-LHj0tBY%u9zYE?p|l&q2=FKA6(d0ddNGzPI2cv5qZm$?H6CL#rWl36meTT
ziK{HHeCx%GYp<rZmFY|Lu!PKBX`5ENUC1=3<fPaAMH-8gMRj`IbiunW?s$|e;b;kS
zKYk)l@0h*tof$i`c1E3YR+#sb&vVP{RjdxWmu1wnqm*Qr*c?kT^g?HDP_ol|xVT)#
zC9!o?(!Iaknm3lUZOh(gddn$$#lt(vzb3V2z5H}B_qkNBpQHG?#LCMbKdnD29wc&c
zBG>2dwh!L&PUN%%ExZHmwNnz<#Vb3}=HW~Sj?^^~S|2%o2!vXHzPl>HW{Z(j)nq9*
zzOdygt2eYfdiZpGy7!Z1QoV=lkKM@FvM0t=igkwMu7*_(9g~&`cXF5i*svm?)~)6D
z!`<ryTmzpRJCRqnz|k614NL-!p}TiEybvmJG1+jON%4%$)kwP?M;Rt0{r>L8aM$|x
z#l4y3+qLfKBz{-A+41P{+{ed1#D>18KEg3)*5889-{Y5B&2GGy;o3U!;tPYT86u@8
zwyjCJa!6V1O~izg3%6chv{(3@&IX>+3mIQdrG6Ef@#}DTtV-9Sj=pb;6)u7{)PORI
zCeuQ1kvH$lckSN4Due&RO@F&X3A1ml=Cl?|v1ho)RhD~viTozsb?f7+OAp>TeZQ_W
z_1<=e#by5IqBg%e+RU!?|IUxE>4#S-ZxRsbUZ1vRx?7vKbN?!3jWv-0mL?mzJS~z_
zOm<zqaAULC+f`NDD=b$CO<T@!<hs_18960Oddp5U%(~KjNKBM{+VOek?*CKgxV-e5
zzKE-!Z2ylP4Q!o#&yG5}gBm`~eJqC#)bk3+egDk*&vH$M`0Ay5*4*W=W|4M~613IP
zI@FQy?wS38$+@EZ6VpC!S>|T-yfQfXTDdk){^K(j8ow(Y3YA-Z{?wEnx7Cw`u3DeD
zpO;_~wWWT2<Hd|A8!u`IX{uEH@!r|x@i^eYWxa>z1W&H;G1wIbatL#6Z9~dD4NwyY
zoH~R!-cGrC(eT3g^DF|pWMmBwFJqi=ro}62flTQA3k*6YHrFm>i1;p)JUw0Fo&DX-
z(f6*MZS$;6XXC%{-o#9*mm|2>ZF7B0ze$;OuiM0`|1Zwvel@&WQ7&;i!QM4+n!rUv
zj~}NZB3#_dR)c1K--M|OM9r68yo>RMjhmOI|Agq>Iw>A)D^{&kGYOcJWU^{&&!Vuj
z6D`-TuMcMbS&;Af*zNW9yFZ?)D=)steZc1Bfi13|d3)U^yY-u_dGPe#$JxIcUg>))
zD{q*;NW;71g+vl!B7c!`<Aq-@Bm@<@TI5#EkvCsaJL$)nIvtkKRSo6lIxa?1N3}Su
z6t(JB6`B2O2(*3qr|r$_jLlc_tFujRt&r;Vy1ih3ubZ~W;)}1cM3{S5PuaU`;h!J(
zyZ6`W?iENq+1}d9p?)T2V~7fS)jo}`MTeMM*7Ja}0i?KLTKM~dpl855o|cWZ)ywo}
z@t194{@=4Yea08--zVFJ;#ayYj`%uLa?zvZT%9$qQWK9T<uae!8X_gx>o<E%#Iu?k
z6`$K?t)95kYgY1<bMuQHZ;!v=$?Y%IV=DIMR-@VVB^wvt+8X}VAyCA1?yG0z7jEya
z1r1O@=6Nk&cqo`G|JLhf8*g6!f2q+wpW@7w3F=o~H~1ebSP^h-s%5<Q^4RFTL8eki
z!`H2i%{>wFw9xR?!>1b!FKsjHb(^jmc79EVxslY}-PYUU^D~!+XdQ76?|7l%5;*r~
zdZQK3J!3`a5*Sd9<7`P2Rq1ilUG(H*a*$e||KFrvTTNF7Y}LNC{rR<jdzT76Jg{N8
z>G%ItUr$|VG%mmV{*q;z+v13h$K5X_7vx=IGT74p;*v}AiY)u!sU_zQWRx7=He;Xd
z(z9)Di&y+U%KPg2%#U(U+`6ppK4$iLwdm0N&!3Ndp5OoSjCZhmZLQ1#J5YAIy9%^p
z;i*ZUih!KB+v0ia<>V#m_zoTpHkp2pn>$d_U*+8D1kV0|ty?;Zlxz}&-0Rl7-D6U{
zEF)s7!TZSCxjWV^d32b)x5w@9#INd!qD5~LTW`fwt^af<azgI2Q%_F{A6pqHIagtk
zvTN+mZ>#@5J@V(~!YHMGatW~)d;ET^ba;^lo<Vd6=c*s|#~VH0YHr}x+%-GF>9ls;
zivzb-hpR|be|{BO>9b|a=Q9iHW?ft%RrF)k&Yh2ZVs5_FxN%IO&*}Dp@7o+}FMW^`
z__IK&*Y3o5>+dJqFP+=*Z*Q#pE02;lzZOln$0?t1=GwAz^Im>X{PA4kVJ1&@($=~a
zwQ`qNOLKKfIJLD4|BJET6&o{mQjh)DAE%FRd>wS~-@bWn4KCnf2b|;o$#<pAy4CLd
zdhz3x>zG;!|5k~<ySI`@^k1l0sh5_P(|4!T#er|8So=-ge572ucvIt)thGW;yY{jz
z;^22-e>wNSVu_?9=O?c7c&1<#bY<!Kw7r!-gS6jSF8h(#oPBxSBY{836Xpp8FY~#O
z@4WcO;zy6dQXleHpGw&{`PGa=On+>;UxWG%ppA2#eNz~m+*2Y;dN>%;N(866x+YBu
z$YNntU9>Rd*3AFUr-gT2)bMzp7`QORc*?cOr%o*~R4#0?%H>!nG-F?e<EbU*&)Rc?
z8iy-QtwKGM?S;#N3+|g1Pd&An^N0BS=f1t)^_MJ&()bixU{vICv`xEszhJ$(jn2NQ
z+e?MLT2~q`SNs!f5yB|)k$wMS@uf=4I+2Q?6b)`{IjlH!=!L|yk8X>#&aGsccQF6i
z%fG)@J=T!P*l_Sb#+H?yev@|8XqFzk63za7am9*x&2bkl1q&{4Tx<5i3N!%{lCwWf
z<AQ39#gT8@b~OI|v@LI6>5BuZ?$K@^+kbh6hOXY^P^EfMJ<vuZ;8uk)dwfkmgu+zb
zL|0{>{`WHcB@bTpY_NaxxY%P7XtL~@C}>FmX#9l5$-H2(^9zYbHv?NvbnllInzAv+
zFyO7c%bUBl%br{N&bTSPkNv^Qhr;~%qI3UN%&2<vbbb12x5WjsEbYrg_End@GuJSC
z^nCyHv;BoSYON1ax!Qar%x;LD_b5>@587B;z3|zzzmKaDME_+z^9+4jAKUc*$63vb
zf}M-q5^k(FQk1J-7s!0(S6=F!2D?Ym96bl;f4qKvUgy82-3J|?AMa)Bdlf%#YgX%z
z-K_QED<4$p>xkTUsdv2eVxsK+XsO;`OiZ$Z9gw;jw1w`5sf$91z7<<#S*w7_5Bucv
zRTc+B=2~;RxQJ)GduGq|{Y}$kmVH0gtn+*ISw#Nh<Jfcl_EK`)@;^Xh{UzNmow<eW
zW&7mc$As{JB2Kf#c8Pv$$o!cXgCZA-y|}Q2Q~KVS(9^D`Gu%rPZ>5+_Wcsh?H=l`r
z`K~RiH~r18$ncpjm%qB6F<+hSxZU3P-u3bS>w2rA4z813WRp>0d}zs+%HZH<T}vNn
zPx;IB<t+mXs0st+q@5F$1gzv`{eM)Iv<hf8WnJ6zMf9qENW_6DZf(-@G<)2x$_s4F
z`}1k?3fr<KjYZ0d3lff-o!$KM<K0QGo~W4Ar>%{gYE!u9Z@Ws32}|tatIsDhq}>u<
zzxJ=+oSvkF$Py7dO>5b?n?JVi(VZ<PCf21b_U6vN|8M5DmxnyPb@cDzb<ey5Hh#Zn
z{q0_W;L)xwui!U(6=X9T9U26x-V0Rm@BQ9av_JmF_kG_h&ZQL15K)_Ko2?&Sao#%p
zoX@j+rFA#YZ<fy$6L{6{!n3M#uDt%l{mz9i0=~B0SUACMmGGh7^xxTAe~F(|Ji|Xz
zy0_2GeevRp7hiA)eB1k=>5Z06z?tVKg^lAYHQlN-<+Fc(U3t1%W<rYhJJzWRS(387
zeLGjKDP8TED|g`L<Mo!^yUS;Ozi0hqU(fEx*Lr5B@4NNw#yY9?`h)KBPyTd;G`y}q
zeWsbSTV<cj?VZg#7gUSsFJhSLF{6Ov){$u;Q!7j|Lh4nLCb=kGT{h!?`j77~FJGB(
zxNeP#tN5aS`RwMGddkD3B1#VKRB-^i@de1OQ<(+4T95P|_WC5we4=_m(HcLsD^}Jo
zdG1&h+Dx5aI;|>6Q>EEW(=+#8Z__ik*D*d!bAJ1^U)@`kH{0grhhwjLru|!axIL3^
z&5ozXZWOEAUt>$2z`MHY-?FK9f)c;!tql4dza;ZRnq}kiKDmX5Y}hJ{Z|_^N>eGuI
z98rv^A$_|(UAp1Tuzh)-%tOr$d7qdX4%D8WRy4&!i}~Kotb#&2#)TIzzR1Wkv67Nq
zE7P!n;X+|SVcd2>xqDkC?%2QoWOauP2UG9g;`fhSvwwY4`_w3X&}4aPT7pqV$@e`w
zx9~}=?&*7W?3S9tf+eTLe|z&Tooc<z|8|5~&EpkDYUVA820g_cz5T~+LaLrmD-`{z
z81%|jR76Ji@g1wgJ#pLrtU5h;rSTTk;*7xQ{u@lTo{;Z6aD8$+pK3eTxr(2xImZ&5
zj+wmPx-I2W!4zYO59h)TbIEbseUVXOVzn#k>Wd78Gxa5BKA#k3kZWChr~Tvg@-1~2
z9MaCNmp96|+fcXUbif3+j3Xz!^=wXG*2*Y}R>~-Od*t_fL!GTLlClqN{~oB`zak}R
zHv6-^|MkAf9ys=*?BDJk+0Rey&hNi>!MLsQV$GlP?YuKe4PWy_Eq0k);cxa~LBr$&
z=QlJ8BzT!b9zW|XFFEVVs{8dz9UgpG=KJ(|jG$Qf|BI9DMGsbNTs^7m{QTvSf;`(e
z0~d+3ZaTs6>&TN|tGD^jT=O95Qb2OC{<e_5#}_`{-L0Ls`((rP=Bj_M<M*qlxPYPp
zl+244H*R=&p>RRNhM67q-#%~u|7(8xf{V=AVaFQ;&IdRy4(pzJvGC1V^9k>~zn12T
z-uk1O`Yb#5@V~<Hd)u<#$y}3s9&lUMzH(lGYPH}0zvjvh79a7LtNvP@U(ToOeq*;!
zbvRc>*+entOpQ0@FCVfWezZt$K2ysY|Jq-jPlC;+@J%&d$tnEGb;;Wat_#d}${Sp}
zeSdcfr}h8p*6aCFra`Zb_=_huyD1*{Vq_&Hd$t#p)-PUkxN+dcij%^+zE8vBb|oMC
z^5pEhM|$(EGPbCme$lZ|{9jnnid|K=r+BWe{=acY^z*0ob^G&Q3aypDw?~ri%D;=(
z;}18mi>>54TlcK_^|h7P&8^n+{|cI~*gD-fu4<mh1>VDL?;>|JIDM1~uqkNRfA@;3
z$dtAF&fJjrcD`<LY(&a3*1g?(WE>ZtTz(+`&GH0M{$TCL@Aq;uPjEGIo%}mfhiB%B
z1xEgBR<_w5K6Cv0n`fF4t!}&TT>0MgIr#DXix)w`zId^;Y;Paip<@?2CQUohazkNb
zoQvF*c@INoL`1FX>9c6LKKaa&PbW64;0oef`}TTx?CvLDvSh#a|G%oSIQ5OLd79<t
zrhY4?iZ?B~54CkKHLVC-bdp_tiDiK5vYW1w&mZ<mpD+1XD;8_BE7^V8F?+s=d{ROI
zEA3Xu+4Z=x3H9xNub1}Jf5(5hgh`XWe$c5~W)!x3>cgGc_hO_3c}u@uY*^IB;sh>T
zK)E35E9;?u7HN{97aSs1Ex0JA7A4UC_Qt{3_sarPeN+|~cEl;mezN%`rd^zT_Qqbu
zzYAogUbzV#pLD}PaM_;&1ttI3->?3i=XP6s^Bl=9RvW5JZ!`FD1#jipcGB{Q`jW#N
zcIEuIw0?h!(97f98!`&NWiMM>n140N?@)XtQ(8gWU+rnvb@-%av<O&iZp-nXx5Udv
zM@UKQGJgT<w;zrdJU(i<FTVXjMbkg@f1+(FuhzZ?G6C~<UIgV|b8vBEu!`yNvBaag
z7ZtY%XGqE#cQFM{E%dAWwDC#c2H)8FC52h7n)UA6@=_-<@<;l4Z=a`>@?gt{JEyAO
zEpeFQTE$)57O^R1${VL$nGq^>A&!f!)6dEj7J3@ReYKZuzPoFKvCg^w4{Vo-eEQ~T
zrWQHnjpV8b>8&zXq-Oa$WR#SEL-B>1ySBK34nv7d%$=sZj<<|aXSH2BjgC&W|9@hN
zebkQ)n`S?7P5-;Sr`T~h|Ku;M@r4{rbN>8Lj#BIiaa{cRpUe!_+Yj_)Y__WTRc-Oz
z<5b$J6;eE<$t^QaXaBcT|8@U;w04tUoNb^!+5hJD8p-vib9yFD-`cmXf9J<rAHU!C
zJ-H%q?a7c24xrea1+Lzh6YCZy$NA0Mpp(7ikfn0we4g*wP1ol-Nj|@|b<dqw_I3TT
zv;O@tJ`?`n!aLT_hZi-uC9}l_DeLE-eIntTu^`CAw>7Iu(B#yciaE9mm$_Wfa9ud3
zQfude&gBo%^H#1|kP@Q0a_4E6@cgg8uJ5n%N<*Y3DUS1;R(u8m&*tlJFZYw#v9;*V
zqI2_oYCjpyx>jTzdeil2y6F_x)H!?dO6IP!tg&fb$&ip(d*<u)9Jye<*ZQY3B_$UB
zkd*6L@?U;i>Dx62-}S6LKl4;pliT+<4^@h-w(xfs->;o5+ADU(qHyEN)NiMCKCL^?
z&U*Ru3#8a!PHbKT_5SA<Qm1Zh&(U0{mj3m~#p^MKUsoPqy{q)5L5hKz#Q)S+zivpc
z^Zfax>;JSuxrn`4pOSOM>MnH#`P&>2{{4MpMb7neTmSw#GWX2=x{Ds2h1>7VczQ-)
z*`X-4JLTb<oJtdy^B12xk$7W)Q}gt?&!G`AwRf+^{9mzJFW769*yjMZ<NsWDGJtEx
z5)&&>)UX|5o6>0TJ|*%Cuam{1^<QTF{x-YoPLD0$nkdVaXa8nOWoSN5*>G>av8~6H
z$Qv)4p9G&s3cT>*%r^Zr%gwjGosg0(|9v)6E9A2Fp}O$1dH3^f75fXvE*83wrn30)
zfkoU0wiRnGUJS_}R#LLOElVrSx-M*5^Xk&VgiFgl1!guE>u3A^=~<>}aJuo%IZ^w%
z{cm=!pZTo()dj_C{P}DADpwu-ulrbKV(RG~U844X4YnVao-*m$w)uX0l%uzAsQ2uD
zxAkr0x3AL|d1V;yvitYWI%MIgQn5=e$G;ev^I1N305t=4ftmxLywO;YF^{!3YTDK>
ztK|}e-bqf`TK8f8lAgTzR;s%<Z(o+5|HnM)S;h_S*H6Rayi}ie*8aALzM6j5ZCl<{
zyNr^u-`6k2Xx&p*w!OK(?!ti{=@VYIg$ef3eL44hK4$H4Dm_%M74rFEvbmMn-nOYv
zxCNwSL4|Me;)@rp*4GD4ymG0bV8d;W&u-HWyFTChTkNB*NMe>>)t8BXca}(VZJ%_@
zEK|w<zF~6JQC;(EmAqT-{axO(IsClI^_a@zYkS^b{+Zk^!MJ~!zkaOE2CK(MpKp<S
zde!%-@>Eae%Vx(H_I=d}GPNq&W`FK{@FHU?DcRVyStVPd3<Q>iGcqJj_6Oy?Go|6a
z)xSC|^Y{5N_>{=9zpvM=S?=GxX<Gev-hJ^;=Wbs*bDifh4T)njPgdQuOTF~acQ%v1
zT+HsYPm6Om%~9EI<k#dT+UUG8i<jkI+2uFa<Ci8(HS<stYub9IC80s_SaPn6^{-pn
zvtPcSSa;&r?moBUc4y@|K!E@%m$D8zL<qdF*s!8AZ=TNSq_!jTT)CN-1fKDnqTyS$
zSTBDq@6__UW{;OXSGO(MAHlc7tN0c}%aPR&j=p@tsN=~V>ZWmZcIiB=DTP5CQP0yH
z*QD`$a$4Re*ST}n?&oKp>Zb31^Gv-oO3uFT$Bvk_QT|`|Klo#R&i;RY{a@|gGc9iJ
zpon;pk(V>gVMbi5lu1@(*w4`EYu{e~e&pWX1fi9>S6Z`{?3UB6|GDzds?&>qTh7{-
z7rg4#z0maLr`Px;T{K=SG2`E0_we5Ch$Ab5eKJlh2)vZx7GLXXb?UFho{5jEzZ>kF
zS9i#Depyn@qI)3=JuiRYmsdNKeoDB1*Ts$VlrlsVe6%-Q0M!&$kQAw7qHu<}L?$jM
z<k~BFsl>>z=B_jTiostyf~uZxvH1Hl{m=pqpXD$9^`;(<RC#Xv^ykd??4Lf0a9JF`
zSCJdR@6a*VRVY*I_v+Kjxuil}vu9~tW|c3U^YasTR#FaU(y?P7@9zHD@oewqh4Yph
zS@CI!2|QDR<wf%-Ud|TguC7I|;x)X?E15WaG#4j#Pm8sa;GExk^1adhpsYvC-%m;3
z2{N2!w*Q6VEY6qj9$#2@bF*7qRba$&-u|O|y;phg`UV?$X=wcRT<j^A>NbBy@#h;C
zuPj@}AyxbHMxX4PcAnRF)@;9g$;JHHLSE?~9n)$*huZq5mdI!+<fMT5F_89^7k|sk
zP>UB9ODt6X&6JK_p|dGS<IokBGTR@O$G>Dgi20S|H$y;LmoY@ud;gn*7Z=~&e$iG!
zqkBi7>A#cjRtJB!-q+23B6yP7-D{nXuikb4tu)d2=6Pker%9U_7P@X*wW!>TM>6Jo
zu%xVaw5Vh1S*K@ipw!sg=XTs_TEm9GPz{HS5*?q&GiB>Niz|N|e4=>GwDaNn;N=}T
zH=`{1L`1~oqW1T3T(C+GKk?_vvs*8mROep2`R>W7IsabkU;Fs|(vE_dB{{ZP!Hao3
zA1gIK-kEUj*qX{^UQ2#zoN&x_V@vp=w9#SqG3{e{PcNrEar=8dE$_|Jn3+zKK&2A6
zlfv6_mRt6}ju(H9+wn9V?~T(Au|0BlR{uecbAHs7H!N%_M^@X)@8O^AXJP(xV*3^k
z$>(>r-?Q0}X8M{vZ0(tUi$t27Qs3BYtdGyFHnE<UD|LLiWG$DJ>LyjysevV0K6h>F
z<xbAOde~c%^`QMnbx-Z93oT`DiLXlCp8JU9-h;0Bbs4k5mncrQ7f4vjwSVoe1<Ci*
zxLVeQnL-K?Ne*r{S@vgqEpG0se_mAZZAh}Q{kA^B?)~0!vGUhz7M-fEN)>MoP4_Y{
zS7qmUu&uCT#mUyWc59RapWR*`dOq^@lU=o^r*m>t9*wy0V%EL-B{j{L=hb@kNYx(D
z?V7VvPd4mp<@c`H`5GtU^$wc-k*nMv^3Ci7=gdBjmpXrZKKLKw<+gj{aY4h!V@8&3
z{AsCx636wQ&!1nH=2HvH(~=yY<z?AL1O%jH*G`-sv!Z0$5|L{~zuxbcoKaViY|8xo
z#2=L%PuDMY|HzhoApg0a&8`zHKUY7rHCr!zLI3ehiGSxde^|E3KYaf0Z?lhof0LNL
zX<x|tLnen9@*QKOyQ8(V&n>$C@tQQ_RNtqI57=`BbRM{PThriT#mpz>A2%087GIlk
zTrTeG@AX}Eyk{5vDVx;%HIx16d6t|7w>QtrKmIG&VMZJzse?1W6o+(-vX@Wuvt!Rr
zu}$GNnlLx8?!nD@N4r<dc{0!L@d=hQGM1%pmhk#?FWF#Vvmov7mrTAuaV`D8<VT{%
zjXwUXZW1<q-dh%+s+;nAnx19tD-rjVZ|7Wj_Akd+@!kH}XSe<gpA%r)a%H{S_38gV
z#F}JWY5Fx|?RtOB<f|`cyk75low365>>`i-FFv?NeLDI)$>waA&4#K_g~P(^-?9(Y
z8D)t4-ahaBX{n%^YsgK?)ejpdZ1P;0%Jk5HdErGvbqV2sz%?iKRtSsKs2ydoY1`x8
zt@6<7?{qFtGnMw=b8QL|-uPb6RP~BqQ#@tIxs0IG7vJ8FOu1p@vfQzL<METt>@V$E
zWH-m#?=-5)tYTXHdW+GjbCa)}iU{DEamwmUWZ~)FH4(4bzS)27w(S+1_4oBb`^lb`
z6P_H~B<S*{fXh%$tZ;^o{l9tEnZieH<1TOi-XlK$vgC$Yl7|%KB`lt-o~M{ml2P02
zwsxVaYp-i9B-6jhDA`iPa7aYUqU4Ne#uX#0q_dsf&-VT<Yi@U&biT8<S+nKvG(o{e
z^SpPOKU%I`<CpR%R#;lg<GtWtu=(H1@fBvL*nIw6mfaKeb<wIlpUq}gSo9_q{wnsD
zzq!Y9!~85S&S^3KpF2D|(R^_6`h7}IUF^>JAL(xM58(Dnm)gSFDip1C!qacVgIH$8
zh>4Hnx%>O>f4#5nr}8#_=8B^Klb-H=vhTxJf%B((R12osNYn*z^m3JFsy;o<W|gHn
zE5_@ofoyZl!7Yof%s-oa%2Imis;~9gebZjnHu@YYRs$7k;8BmL%*G7?I|~c^a$BZd
zoVbwV`1fli#|2LX)$gBJ<g4MWv141jJa6&y!j#i#Zo3|zKQc$&$X;Sa!{li!HcQ*`
z<gD2wIR2KZG;P}PWwo4S{M>8SeV^`U9MLG$KlN6nkM)vAeuA3$1IM?qdo*4e8eLAh
zmYwU%TH3|ub95uqtHeLd_a&eH4LG~I`d&<5(y><=3g(eDHrIG%795oRWp{yn#>af#
zOGnt>Jv}coC-?OauTT-=QiEIjIDE7+LfVRJQ@&=pJxB+&)plNd@xslWIni-Za^7Th
zoyCt^s^2fV&=>vo>fWkrpF=7vW}Q9ocI%BEcE7$H+rKiK+YE{){Zv}@<?xZqYdSRh
z?H3*O%#{l$R8y8TVtV*$-u|OaZj#5h*L|3u^@O|I^EZc@r==v5yWp`KA$F65-$feK
zKR&T(RbFg?<K+_0sF0#n$NT&9ZZGL{-=2F}JlV7V{5gh)Z);Yabn`Vzc*+%4dyV)1
zhI8Q$t=WEPwwrxBz|(VVi{6h1f7`gEw*C?qHDQFb{XlWzFysG=8MmKsp1#xJy12&g
z*2XQ9HczX&*<797WcA|9V>{_~fqZwq^Pk@DXB9c$a?pp(F?pFxnNsqdmuHh*SlZ+Y
z6)tl5v$3_=NQkyx@|cz>_4}yH#R3tb3$I_P8gQ0sy<!$klzN=V<YDQh9rY_HV($G@
z{~{Y-_?%wgUJ`o#{<Ho6`*!#}-TLtR=`FPi6LzJFb|)#Tw|l;e-{~aVkQq09(S;A}
z9BcN=8ZWyXbmFIJZOfwgeVKexxl0yYy!U+m{6J7=YIP{65f{E%ieom1toxHALenk^
z>i1QbR6Q*C#^hdj->0qp-Id_3Q|E)*`5K#8svn3Q>kE3W$q@1F?)8)Ea<?|vIW#Tc
z`?mOf_cY^0%3E{4n1-)-$^Gn11>=?JTxJ{-L~^}aF1MTt<#FD{9(mA($#shJVb;}`
zw%Tp_P|6vTDxn;*j480fE~2>G?(Gr&8s{(F3!*F{-+KO6m$Y%;md7jT9<lz<<mDR5
zCc6!OS?qTUo}~Ku{I{e1tsNyx+g#@)?yKMxGRfi<5?D4JRO^;N#-rE{v0eW#r^!v%
z`<&d_SO<mwb1v_jdnwq(E9AT2f=NZ|tjzD&bjwW7n6udA-M8o~4aYf?O;%iQVp#c8
zB}DB2!`DR&aZ_{+XPIa;y%DH6dc)gbX29}U{|{DgbiPu_<(I@?<1H}pfakY}m#oWA
z>WfyeKMu*06O%8t)A+Q+w)FQEO^fYYR%I<vdU14mZ$3v~-mw!mXGxu#tnNJ5fbIRl
zSF_@^_y4k5-xa?!!{8@(tGeY81J9=PMfW}T^{&a6Fk3QDzQc6Qjyg~;+Z>eIp1Cbf
z{@eKBycmDW;Y+N&QDH}WulMa)q4GyqW%bEAo4T4`oBbcI?wBHRc6s7!r>&CuHqpyp
zdpzU1TIE%6GUU=tssHZHhZes!5!>XE8NX$kf0K8qM%VN#<rW*xpI81=C35amc9~>Q
zrN`2%*6}6np5{swm!2G{P&WsS4=0t{XKfX$yTo~Jp~0rW_|^>hebO}>zWlqm)Klcb
zrS<z3tTx`3oBMy?AHl}NNj1VhZZ#Bh8vM3MzOce%^V{y@<?o-FTYP_OemI2Rm-|S>
zy3Koo**;x6Rd{mouVfa>r2;SQo7~*ZeJ-pBjk>f1<X>p}xnyy2nu5>z#?}=JXEt2e
z<hC`>^yfqN={47S*>olNrF*Tvn(nQ7^e}^2rekvR{NPxtFArv2wO;0{`Zch9+LssS
z_F9*pxvl26;&ZFp<vxpIw%LrEd!#iSuFj}<<Xj?rl3Vun#^$M-{kC&TM4rAhTspzK
z*Q!fF^>qQOu<Q;e1r}k>=M(Y{U#<VMPVKNx;38HvrHG2tXD(%|5WbY=`LW>3=0kTL
zhZcNG+N|{Q+mdw>+YO@To?bs=?t*Z)C$s<lTD@b_)?Ukn*TU-_Y+Aqn3fKOsed|um
zURxZsx2c2S#0{&=MKP-mP0mp3iTltczdt;w*S+~l{U?|C#awley6g^Ucx4&uA*N@?
z4hAZ0S;PI`-(Kg%k99FSKCDRGb9p&u@WnRH?{_ry-~Ct@JEQvP^w>3}nNQE#XK_><
z^}T-e=c3o_d;!);$Ijm9IaN33;~(RwnV(KL?=st=v@3W{^YtT&n=~{nQdFh*PMZ9@
zVIB43qr1!^;|cYT;<wIuBlh*#M?*7@OPca?y);4}Y9?}KHQ6sY`@$pYYek@H)1ikK
z^K9$-Z%mCe>MHm%LudWAy*-EJzDE6#J6z(p%<h!%HPuwX)+4{{62ya_`)~<PQ?7rO
z&>EpUC$a9p-kweJF{jGseP4P}{OiQ4|C@?EOJI#BNx@=<Lr%`e9d-3HuFNX<{x(=H
zH@L3yb<}U>>Y8QIDKWd3#@E>WovE&FTXBEN@mo5-mRx>Qw*JT*Te&BC$6kBq?`Yem
zr)t=@XNSt~uOEa=8UkyrzIM7#F0uN*w>-gSkJO0|`>)rx&)V@|f+znS>2Jb5P5oPT
z)`<LXb$+(@Z`zwywR`pDq2Jd9u!lCC-v2x8ma+e%Y{QhMccwpQ>aufW-VNEVuDZLl
zFG%I*<Zm`!w#k{R6}Pp|?3%+XZKh+?@ACLZ@;tfuX7i2PHI#U_?)G`!erJ)(bQimv
zEW`9;XQJmg^u3#9s~uxp&!^D6g3U<1@4Q7y)2sUdAwGs1_MQB+=&Qo*Y0lZdzC2nl
zDl&zsr8iL_nt2v0c$^`x#KbC!%_(HXixVf^r^E!@_><hb_nnqQUhe$3YB9Y9=X~$U
zny|{Mng{0{mo-@7kook-?!43Q-Y^!;$-Sd%uGas~-uQOy)%EtLZO$m2@ZCB0^uAXU
zZM@QYp0W4rd-Z9<jz_=qoi}N?ojoUc*--1J`t&2cyZP4s`S^Rv-ig0_ewbWQku+IU
z;95SvCS1tw^&Or)8z*xmGMP<wf4=9Z)qSxa@@(8Q^{gt7iP^CkXsu+;_R|(&UVU=&
zu9AqN{j2;B{?N&-=8`%pCid7<x{WXFrO|<Y`!hO@eV3TH9$ze8(Rak4wq<2o$jnEL
zhg<%fZ;5kX<@WW`NlvA(!)(1lrczU9UH~_JK;<CYp=EBzo#xs++~lA6M|OMCtj@|W
z58~#O1pMXkJvy(?`|w}eBOUA!+c%d#Vllt)<&$dvp~-XP-!J{M>DtZn#<oHxU8R!O
zQu$YX@1OnqMfBnwQ?BVtF)jW&f5GBDqi?e5lWb4+yS|;6II*)Sp+QSp{a(4a_Rf`-
zY;}ijn4bA|HoP=%S*yS3Y)R(~vGUhv6x|%#UIiOjnyNZoTp#F|x<NADe%}O>m#v!r
zZ!h=dT^8eJI4xkas#e}kL+=Y2IYuhtJ^mW{A+a4*FRpg#bVb!X&fDF&Lt%Hl?;6FU
zOozbp5}>LW)Q@+#ap6V8tp$_SbtIB+hR3hy+O#pW^7q+0Ym%o2>hAn=d%gPh$_0PA
zypyV@)!d6cy!ATooAU)6U6vmYs%_sX|Nh;3<0(5HG=F!CElRwh@9?NaAY|^jd7I>)
zZ>jgyK56EZ<o)DL>O~gT-gzGvbhIdbWbK&y>xXhgO@-Z>!~DtXb}9wGeJ$&=f5DH*
zNv?Kfx_x_A?ARvGRJTFE^OWQ2x}TljHY`qGc9l^m!0R%9X-<`+1>=fsAz^b2pSE55
zsngJVe_2q9y8Sh^HQGhN$<iW1t4k!8xxd=Z`R}53$L(z!b1eR7ZsX^d`rq{b*mvIO
zS^1f6_b$JwP)aw^GxENWu_Y%|X-Y?e%07=d^Nla?dRS`z|182guQ>9sSJ$tY0!K5|
zK=??@os5#42!$<P(k9`@ZrN1|nJ*JDH2cOqapj5)XEVB#9e*B(E4lsU`MkC@97&y5
zofnzztzIe2&v2RR>olH}$%RX%zBxB<lS9FiN$wwCSRCQV7oC!J@rAa2sI^i!)7E2c
z|70V!2HkD`8vf~tmfPHKR~~y7o9_K2FT3*LlfA*yPO_9SB^Tb_aOlU{)_uFJTC0z}
zkJ`U@#^n>7iMm12hn1!-TBYh|_d;vQ|H)wv8iL7@t~0o#R8vLbqr~Ea5+||nndz{5
z27T~sR+2QhxZvWGHv*ZDn7>bQn7usU$%4QY>;D;n$8kX=<Wy+^p_P-|T6tTX=W1VG
z(6n!dA?q2buc2nWI*;c`C%!Ojk@YVM{^{|@>ZXOEnvdGPGc_+O)5<PSTza53DY>LW
zohd<Q-P_yNrzMjd7dNDS(hz2{bWxNKG|UX(UGZS)PP0ocngVxCv(@<I-pSv%5HQE=
z-7{%}SqfdfhrO?V`IlVy-2a2()0JkyOCKJS)VEvi*j=?EM)-ISS9EQ($(sFsA6qX<
zZg~9QzytPGu>r;ms+U|s=Xa`l=n1N+$X59@EGgW$ZSwh-7vd(X|4@9)CX~T+p4<29
zf!+{trTDZ9AsaWI^$z>5RItu76+CDH$_202Gzy3sSn;it<ydPN9`E=>O^?g9E%V#s
zLuc#1=kg{mU|;`nkK<k5^*<i&eqr@=@gd6@>XzXXvaA*ax=wny(EI7Et-T_Wsy~dw
z1GI0>we1ObTAcPrBSdM(hsAvhbM?K~X&NxNIxOjZb>*a5t_|ZBZtGf(+^~Cf-C<Jx
zOTH%j|0KI0cCuMu-1ILCZY($dckcF!Gf%c3NZ<Y7a37bKVp7TNC!SlLtlZg`6)ko-
z<9pN3Pa%hWPDH+q6a3vcH&Ob{a`Cmo=ba|YmCetx+sKuD+sE|fvQL4h<eM@(&6YY(
zZ3#NM*W~^&`)r5H%#bnrlEsTt)uvoxPE0I*yx^9%n{M9gnf>KyhrYg;;?J0A(i43x
zOsv0e-TqgJ&K_Y$svD04h3Q_hSl+_VGx^CySNZxSKZ`2jFDm#7Oe}KbJGu36_>#5V
zcLK#;svJqU;`i(C4!NTfm=0^swY6d}?i0AOf?<wEQR<~F%1ISMRX5k{H~3Y|(7!W(
z-@OOw=|LW$*Uw2T?@B(}5!|&*uBNKSaE7K3_rHsG?6oSA3)iRQzv`Z~=ZcQqybZnA
z&c5g<+sB}Fm#0}ngsaQ;L{-rX*2C&Q&L#hEJ9=t&-r_}}XII~R*!WWXP~hqW7wzhQ
zOknTkfoilv3!2=Hi#3*=lCq5M-StK3?yaKLbJO<E@Jhby?C06@<wKB**G2Yy>{oj-
z&+XrFdik5>)e{ajoLnqYf2bnle(OFvg9a7Ry<8jEJKVkpr@B8^j9GQweQqPy?1fsU
zVSXp&cJUTUG5<Sxb1|3U<D)B#Co~1MUP}?2zShdY_fW>ZMY0o1&i>jjSo`Uu>psh@
zCy$xgKWALLV~`?H(dMkNtNH8`VXq1MmzlCiT?r4Ieky<d;y;N>e_L}cgcT2`8f5HS
z^KIt8&A0c9O-e5KFCi)s<o0vk=jWoaxhC7)rhC2c_CBnbU2u`LR^Q>Q3<rD-fRTV%
zc8N@2&;yN#%G<t{_OcF2?ZHcXG?(79NwS&T{=h`XwC~b2*X1$}toj!(sJ648SN}az
zQTwUwqv$Lv8`a`3haO(JSW;f{`<ugzXl-pK*AHD;+$#4~*^UXcPI6r&Ca=1{#?{AT
z0k{9f%4cO2%?6(9jE{6NwO3j4%ztvV$gi+NL1p*bm1QnIr=QI;)J_W)PV?&ByKh<X
zBz<P#&p%r_V;7#D=x@EVICsCDNadx4TxCW}8rPjD$oN?vpFN8sE#b$u45^f&1B?6e
zW?RHLE`F&m%6H{U8QZj;Jv*K#Y@65Cq~bN@r&00BUsVj%do&js@z1=my6*qfa|bel
zG{WyO-L=oo@DwzGjF~~Ej?ASvq~&D2y}86#Uv4<WsQleYEtL6Jmy*ncoMXlQ!9|_L
zPIG#!j!R5DuB&hUedF>ClUHUi>4pZrvY9NmhyT0_r@TN&*>NG2fY;O0z8{tQ681KJ
zXVWSt4&VHl1>!UF|4i7j`N}i)xkbEzb`$ki{jB@aBOA3}@6H`(!G(@|^Rqs`DAMo?
zmM;=}+tD!L*X3DX!}H#hhHIxyOMIs}->LBZwNr&kA8sT+?zj~3P;c*=S^Eyi3wE^h
ze%<|UhE=QckG+at)Bksgo{YP!P$g?B^(041Jlgn~OQYeRg)Q%m!}VBvySQ%{t!v7k
z{!6ryVe*t!lUPrc>)$#r`E%#dhZ91hipoqtZGBMV22{>BZg?2F!eND+mPBXui_Y)&
zW6vwT_Y63~rufjfioM@;bDo2Jnwd(oo1?pq?9A$!4v(~Ez1XpLo$=nb$;IKibqlsl
z-u+fL`S^iF#nxM%|FhmXzfm}Z?UY5=SHnXIQYs#dT7C&V7iO@ZIGJg2CHnC#1I3js
zGR1GF^8U*fdKFMFVPUrWlVuT`4ck1&47<Zt=7%3@85~>1y7p&9`u<yGj>pR#f9>y+
zO`glJ@I_tS=|k08uGzEy?x=nzvo9xb_oV${DJ2|VT~!&}R@%Q@nm^?i=j8hAj!ykE
zYqsg1t6Qs^zwKY4<FjK-A$uDyfChj-BPhLnVecF)cC65t9mONSmwV1(#$0~`!v&6S
zM0UJb!x6AYJtVoqGQ-6)jz=!z&LmCuTD97kZo8K)OPyaVnq;#xmd|nVs`)mx&lne{
z)nvXhs}#GiLT<wuA)z<7j-ER@*WNEVKkQD;-X7(9PAi<2I83Z;p2I%r$>)P_Xa2uu
zE$M%VBflxGfGIW8Y|p0z28H$KeCmCb*X+;u#Im{Z+nX6G6Kz};X!FGtecJaaVZ~3L
zMrWhaP>DUu!q4~I=jC(Ep1S@18Uw|iQ#$*!-<%5EH(B_-wRQ9KH;a<3%Rj|D<$w9I
za`hi|rPcM91Lj`@FC&1gS~6I%;bLLIzGtUY0vn^xSLW~KJa!@F=v<Rz{uK!^UvKN1
z=ydLzWGSO0sTd>0chH+ff%EwS+y45Z{I!v9B`gesgm~Be`+GgZQTA<tI=|c#z1fRH
znA@f^SWfxOIV(u~REgcYRV)9iOmJSgu<F3%n>VLA9kk^Z-!S=5h?a-(zEq<qgOo**
z^Q<hFU4Hl~>uIHfP7FgbXNgC}O(s^e=8vWf`^)*~r~kE__E7%S)5q;5D_v9C)3&_N
zFuxl5v6cVzfrYoe{dk+L`fWeo-)TRYUaSo~vu3?gro+j<UKgG+dS<Ea{jjuh_LB~y
zuqAc%ItErzC3<tDw;02QF&0mi<KUhv{aJ$JX`$dn$JDt_-?FO>n))lI>U@9AurMsd
zVCI?^m*w&bo>sR+7th)x(j#cQkjb*c$#Y(d@thmGr!VHVe<LBL$vS2GVcoh<j~Y$#
zzHDUw*qZTh_2ykciY6?V3iSIXOD?=wJ%hy|O*24hDc><gjd&OSJ06A&tHizrZiz7b
z->_ax!>>10?8)JR#T&$qDEYHK@6{3Wm>nNxRQ5Ed*-g>>#GDqnHoXZRBKs5{mHqo8
z__w?HPu#!RA48G?|Jfb-9=7>M=p?V5`saInH$M@$FWmR2?)v_{+a{!zm<UM8LQ8wl
z>Y^`30$xgDt^uDGNKH;;`|?uv=N@a{!UDdpbB=^O=z8%^vf^~d6h)I($J`6y#}-+4
zW?rA6wWEn~GDqf;=>F*3cej+^om$mXD7(sNYG-@tO3~2Ftf=kJ4jG2cwlma|<7s$w
zt}JHXGS*A0kA*s_z5exmY0gxC&wSolscf}9?S*_h*|J0y|5$FT8}sGOMJ>;#DJI_2
zT*B<0XG~o3XUmP|ja-L3YA1OG1wNPimVb)-fN<Es4RVQLDyDnA)Vnsx)XN0+C+UQ^
zEh?V6e9gbd-zWGT37@ik*@qdHZ*PBGre<5P{!t3Y@~h&UM{L{Y@4t9aDrn7uK+xg{
z6L4&^9V%|`JN)@aAJ=r}wE+%Mxta<**V{x()q7pVz8XsOtlKd?K)~aZq6gboRoR6F
z-n_-9k^@hw&Xex$5xByY(xG_LD_7E>r?$U$bNero%wC4`zs#=`?mq9GoVAiCl>cUb
zwAQh<jRI`@P39Z-Ru+{wmNe!5FrB!dIh{j8E1tdJk;dG{ma?GuF3*m=+iFj#giU(s
z$kO}jwbz}DS*IIp7%RRdD}3IXSfd(x+{&e>XGXAX<3V}0-#?wQgc5vMZoKMNZ<})T
zti0NnuM6Ts3Rb*VoZh8=^8BBl4`lu+=`2pp{K&dRaM{F}7hb%`3I!EqFESL?w9m@D
zpmDZQ>IuXDgyK|5#^s7!HjBdK;*{pr$pn3Az2TF`UzVgZxovl`?4o9ED?O*H^SG^R
zS4=(0Z@(gJ-IEQDOD{Ss+-Sgmk5zP@&ZD;<v?Onztl-|`^6P~AyRQqG?kVUAgf=z!
zZkl-M)V)K;Bg$&ilbYo_{?57kPL%iIg2buuORKz?eLe*~)_67Z&&db#AIoGlxmh~T
zii#;U2ukHTc6^7d-4*e)Q;T!AEZSdtrQq($U`ck-EHxJA|0(%x_T2`2a_s^2><^{)
zeOfMG5nr_VscO`-W5p{TrWd7N0!OVCsH(~<F%dA^(<Un3oAcFv>eHD8t{S(V_)YIR
zu9L?vacu9VszoiKyBgb6BIkTP<-M_?PNJd9cdf^rl+)Z?oeHZWMOC@}hm><EZgAS-
zb}T}?(#wZKqW0?3#JN9zR9J7aIyqyZx^C1Jujh(_vNEAc9ajU)6mIzJ;!nQ6a&2mh
z)d#Vn7zQ)8_7#f3Kj%zod&GP>Ny?Ua|J)R=6)w3OWGu~|2$-BY`OxHC!)poaBd(8l
zSNT}|y2|=H)az7?z*?342lkkJG(Kq)_wP}{A7iU$xfe1npMC*aOCkkY7I^$~n}}#?
z*lFfN3z-g;WL4!IS$)yhfVK2y^~R8so+aroHXOPUXqstK#I}8c?a2bZyr)n3T7Rcq
zT{G#VAg|QXx`l7ML=Sy8ewG_hwxY!Sk_+qVhrKKA1}<&e;T%$7<R!-++~Ae1q#O4}
zN5%1I0~hb)RTpz}0(CiKgKactPj|a);2XH1<vH7&?&Aih9@usn|NN4CbiU`~>95o6
z*kfyI<R$J&oIAOGw)4dWfms2US$c~kdw5gSpZCZreGi?u@X5XpWrwWZZU1NE_&DQJ
z%aTr`xJhzOhPlNPQ%htbu6)q|`4h52p=9f-27|p^QnKw&7+QQg`Ydej94Qt))6@PY
zQ~QJH?G?{cO5!Ax84EQtm3PfN$fFbF6?JuM@rUk~%9f@hTE>Obk{lP`d9D4`Wab5r
z#`p!Sc~2+1ALOh$;MBY5-EYZ-jLae_50=}#3Mjtaz!euiW!F!h%x{<Pvuf}^yM82r
z|JIWglb00wg&%6m*lMufg|%1B{Z*@RaOuj%HxC()t)4dHb9++|Yp;;Pl%+>aX2qN`
z@&3!(v|qNR)K0@<!aTP_?FCZ}w=CYV`hwJ^DLzJF2NyhEu#6qLGz{E_yv&@){qUGn
zwl;rAbp3)&aS!&sk>iv6n`6B#Tm698yPY#5PCUAHs&HeBn49~Fr_z;$onozXzlgQD
zNOtc0d}R$2&qXhr&@Ueql3Kz!?<ueMd!}9+Bgq-o)A;&?uRSyW2bJaa-?uzi63|+#
zU63SH^*4=e+J}!!X%bZqrtzG1>2_{y|BjbEns@Ma4#O6P<)?1vbG933i3*C$eQ*B%
zZ+U^BA!qv5TEoZQ!MbOHuZVlqXmD;{(z&W3c;mVdwf3_zK@9>EbxZdt^KN;<I5DVd
zSMH-0XKAwwO(#@*ZtyEyxzN$DPb!_iSnSLf`;?i|?BesAR|SF!p{uLh+)ux#xHsWZ
zQh@IME0-D#Hf!bYOWfV$HeHvuTe4BW-LFl0`;UbUll$yaGmohCALi70d${pnSkvVv
zZ*+e=*t=o*wgrI)8`}I==uW6}N<47!?d=Zfn+8ApQ~&;cC-6%(owdt)^|upCBD-FD
z+dkPZ%+K>sV7Jo6_~m&)8S~rDM{sGR>9li*@OB%=SN;3(?(VDy;$n;UXK?f`e$CDo
z5S$@kpg-TzM>ZsgJLb5R=aS5OnW5XyS#)VhUu(XpC9>&NcYCw1=*FH?6V_x$vbOad
z?wYN75w@NrQ~<QRr?2m@_a||V;{yK-3mneQ{oeTZ&z#ifbIR6dNHDxqc)B(^bK)sm
z0YjEvx22aK{d<^HSiFADrO5UBWNsf*H1J>E>#Mk&d*U_|zSbxgreu@Ox~KZ~oFQwh
zT2Hf2)%?}EMC?V!#hNCijRK6iNuLhSHhXw|;^sqjuXGEaA8Gk@!+9H5r`;Ok^z~-D
z`vpHVS~6DbaS=PI>h*5<?=NRw=lPg*U%GNiag|lFY%R~PX2p-cf}ZW0<k|fBq<Gt=
z#4Pux|4#16<J`37p=#?J0dRTazIbt{hC{@Q7ZJ0LJ9JDddB1AG#ms*DNvXG+zTX!#
zJ5&FC?FNY^xAgs=f^z=5tol7I<m!Y2`TGNWG!}7-ww+vX(IDHdt<_|qVB(<$uBE<F
zna|z_>Tz!fjMkoS_ASBIs@{Lz?T4>k%{c3Ea>b_TLWQl1R1|0KZHWA|R8#EgN)g?~
zQ^H;MsAW%DXr$y|dBinsPSi;akEOziJZ_Sc?0pn?cc0fgy~%CLjHeSWf@f_PFP{3}
zA>zWFh^RT&9Xh_c=g0XPoNSjhe!ug>{~zzQo_WrxJd=B0PiEG?`wK3v(wna~|HPua
z@0$8g*k5r@u0D3Z?6PC8o{Uw*)m3Lhp09c^;exjWXBzWbXE$$={~yvccO2coy7MDL
z=zPg}a#C*(?0+(W-#6TTN8VhwUD<jZwiO#Edz_LCx}&jm!NS#(6PvGy2LGBZbEe_`
ziv30bdrwMpep7HX{n6F6TJ>Jozv2~!*I3WLy<m6td2-~nhDD418A{$h177*P^I}#?
ziA{b+VPTN7(drKu3nS{76^}hwSo%8T%JkIPpOOv!9*Zk>jhIvN|8CdZn9Hlv+t`jq
z=Up+ev|ZKC<M&RoH1Ok+-|wW#KYy*Xo~gWB;!vaSs-PQe;W=}5we5U-NbqdeTJ;x6
z_uO>KL|^yBvnx8JOmLg)ur9dy*44G*yWT`BVKTlMv0{R#;?t(S_ibMS_i;w<`td{}
zm_g=QsNU~Y?4_#$l(r>aQehFfxxPj`=J?s<Q#+mhSuU^L?K;2YlA>3{;ou7Ql8xso
z9!A~@b94{ebb8Yod+6eJ(D2!5pBYgv8x8hyiO7DI=2-dmPPN+A;@3O6Zhh1Fy{SF#
z>~;PZ;x^7LtCekTnC&xKyw&3G%HvlTc(gq^^L&1y>f*mQI<lTTd~;*o#h+cgdToy{
zy0|y>IhAiX$CPl`d(DLh<sW#?gGS!oe0IIUw5oBkldsgPD_`BC6LS4k76l)WFKXVv
z%PIBLb*1mwfLAN69?skUl6fNMO0z%-(=%UYfBa+IWuRIc!nvht#rrAuLLO@TG})l4
zy4cfcn~wI<88#E=F@XHAIGOnbi1v24!6J1j=7Qn-X1A-Z+v<OA+EH6x==pT5x!&80
zv5pf>`Zo$4-uadJcec#Y7pJ4rZT|0&UVk=SZk@VSP`l?b&c~lbcFx?~;c;-WcM|`z
z8EhYg-+QKL+dDkiAb(Nc=+}n3SC$;t`KR;w^~^oXe>NHxuwKd#vH5#FzG>YOj;Vny
zJexJPZhG?holWZr$+O?PJx_F9WY292S62^vET6F7;Pkvp*B)&8^m$oe>T7o1C4Wjk
z9p>k<(><Lfz^lu4<J`s`=oTO&fwb_4ix)Q-yl-~n|Fe0<<`lo**Jl`>P@F2|SG&gd
z)5~uAw=5G3xRTy%4bNKoK-ATJndSjYpCpBEZrU%??FFWLO;lMrDM6^W(m}j*(#G7L
z^d|xbwpG8Asj<0~G)ef0d9O}zNKe?LN8ck3C#(DW)qm4m>#}~n<6D`z^IravlscK2
zEZc1IKJY)MaN3(k%wadrhdb?&dZwCG^hwWRN&c;Gnv<s{CP#)PXGd^KT+2y;t|Fe+
zxWV9JVZ}W5-m=$=B6I(2`11Lk$?rzSEVj!>cJel}UCQ#<AOG$1ihrA3GtXt`W^O#J
zqS9(wXfj*gW38I7wbR@s37VN-TIbo;IYu7~O|g*<{?WMi@$Rz3t*Lhw=*;YCmd`kr
z{EFE<{NESnPa3Ur54rYSc=5r(@>oP`ROizp1s&;uZ=_<U-#%HK+5F`BvMH&RYKl9J
zJiq2&GcpIQa?UH+!UI}k=k5JzZkC9NRJBaZ?y}tb_cq7XE!?Ia6)c~-m~E%%{o1ut
zFNVi3ebf23M0n}8KNCJizCO34{L_MIMgMl^C+~g4s}&L~EVbcTiTd(+whNVi8b)<?
zP7rm>bUUA$J3r25`Zc>C=gICf)%NE;sxW&Kzf;Mj+3QN~r9;ORkJ-0y1kaqdO8M!b
zN$M*7Q|2hjxNhZm)~s_{ih~ifCcy~YWPawxoY=hh@rFNaha}J2weELWFZG!-<7rc_
zgA1F}6YKt`jjo=PwB%<UOM5Z@N?F(IE2TS&e{Jb{z3x$f$*j<3dGo2g66KdmFFId6
z+@^6PHLm?z)Wt9LUO|U99N*M(V)n&^{t2wB++28zR2bOG14Y+Hoq6%{<Bjb(n!lNO
zyHw8i$h;9X*3C3eom;+Y>YwSUmKh}ulTW<J09CD^<$zw#d6^rPjD(;4eA0Pw`gXCI
zCdz^PwU~7Fe_1qB-)8rt-T4|>xqGgkYFe<PW`jwI$+K0bC1<&RRJU!sk#{QZDubJY
zp-t-F`OH)Ic+K&Dlk+8UReJvE8y8h}WC>ba=_uQCr02T9(zDDwe1SdbC36q*Oa0!M
z=dfQVS(jmt=>2+Wg|h2+EEU#ixmL!$Ikn`vyS~!b`Dd5@xV&l2!K1z`Euc0HWSDHS
z!;CoAzCLCBlEzf#0LcfZRQ{gizbAfex!pGdNp(}(qW%AGJ(y$j_T=#uGgRZ%Pn+#x
zY;^E3&a&&2p8MNv_k>f<*ZA(%ns&~T-y{C*{S2d-qGt~Dq(6==_;TQsXpis}uEo|L
z@*|h9nLZ9ark%0nSdoleZ2Z5o;aQBncC82dh2QUUZd(=OE|llssB_li;0GxOL(A9x
z%0FgL)HyA6X^R7>eGTd%xw&hXE9fMYm|QeHapH*bZ1dw8S%2PcKM{I6!fK73y8iwr
zhcf+bxXyLjO#k-d&5LchPRd<2n{6hRIeJ-Xo_1-7&w0Y8xM&q0ue05W+h;76#m~CE
zPuBgV_mQT{r&|7hdvmdJ#z#$_KM(%o9N_N}S$1#nGdCr-ojm7`S+CNQJvC4G_qUCG
zGf(<VO!0p5r`&2o<h#_M)UyH8QhBqtIb@V<>FEP4G-%vVu%oc0bKO0roGE)YZQbOg
z%~g1_ChgnZcRxSBDlW28Xa2YL*H3rV`a|;%EI+W)?BQC?N$i)r<w8xL-8<TSEUwm-
z_wL=o)w6hJ{++S&-{*(ymR=q_ZW#~u$_6jraH4*5%$_DU=jY4aIzI&bPyAE(%jC};
zh0;Sm&-YGCojOg#N?=#iRU>mL*|`&wK|AAQE(+{4S|`<7+%S`Qb$H^7*3z{5hGPA<
zPTZ=|H4ARs`C@TjPn?2w>bckJg}w-#UbxWt{rbi3iCSFx{qOH?F06PtW3`^QaCq}-
zHgh#?v!#(f)0XEI|Nhqb{oYag<8j5TCZ|t5?7b>^-tEfrRX(1-I+slPrsy)|+L2oq
zN)A^4=ak|-e`)oLg9~fDR}~0Oum7w1gUdwimU8e4%f*XRD?c4Mut>pp;l+!P+{|`p
znfr0JSvHA+J3Uj?T8v-r+kHr>b=Hyj2`_xln>=GY-XB<JSl^Sjzg2#Z{9QLb^~YcR
z=3B9fO<FSP-=qZrti4GgYW<H6y%be63{+iP>m_-0!T%I@r2=W|Q@hh9%1Bj7WfyA3
zU$c(>lc~P;OwC72qqGf@$M4q_C;oYLTIckt`%gN-^ToQ5Hb2`Twm=>Z=>uIGpY8j(
zOYK=UTeHjg*<EIarw%1`ys)W!(6H;%ic2w{kH4SNFz?3h>7t7=R_&^hDs!4~CN^d6
z-z+H~eJ4jpyR5L&`nxSEMSeWla(ds7ISwKJIzv}Pen`kV`t`a?c@l$`e#!MWky8%2
z-DjOT|G=v~eEBU$ZwQOm{t@Jzpfa~<?#|zJZtkbG0(kw-H@Y3KIt?ja+>U?tdMGb)
z;e?TZ*@R{Ge~(;T8|}Dk)w%gDzu##rPnp=Z_l6DIMTOkzCs}Qe{F^*Yd*?D;JP`Zk
zM`NPSp=nW`>qGbdX|X@qDp)<)X4hw*bv#GcJxE$}u>a7x2P}S-PZZsDZSIhi5K2{f
zmX%Q-y8WDGO~$l~7dN$;7{OcEJ1@SNA<1!hl`BJ{XXM`Z@w$7g-HaOCDryrauJX8J
zDVF(%yZeIp|CEVN7cvef9<aCUHF&b3+k4B2DI7cc;#?%lU$$Bwcc}E)GxNOtWSdn7
zn}1Ah@(-Ok>E)qCY(keFsJBl(zL59zO#S(LqO_va?^H(T#nw;Td2v&lSo{T-6Y0>Z
z)Xlv(na|;d(*?udzRQn3*msiu?*0dV%TL%v{;Djm+27;1IE&*>l%<}e$*Dh`854Tm
z94!6&Tdgr*qqY(M;VVB<<7*qO-52qs#r`@S#y#ICHYr(siR#_mpPar(YMpdb+SsNP
zbgA%);fcpT=Gh*(l+ajo#mFiu%$dE{O!fq1D{}GT)Dj==7TsRyw*qNBudl4IW!ofw
zYlCBk2m@yalc2EU;=h?Utansxjr!ztLF3_^8P$ud&#FJ+nZus%tM_Qm^;<$OHf5$r
zE^ocx<S4!<<Jtb-*W!=&P5iNFBL7QP2cs<pk(;HWWGs(-u}@=GD-P~dbgg0P{XR3=
z&Hc30#TM}LE-6`1nl&s}(8(#0xwy%);LzRe!CEWlFLrThzVq-^)<emNt;N4g*i_!k
zF^tttsq@?OyD#E`#tkuUsikLv92Xx<Y-aAyxp_wNhyIo2n^hYpUkZ*ev~jI8=9+y{
zF~h`CCf<D`<I0ky%P%UVNXo7)R@&!XZ&nW8H3Mo(uC`=M^z`)Fs!<|yPpLRngYm9q
zaT}YigYU@*5vdP;vUYniLuRhA$viW4dXqo<^)=5TBbr*$)tcQjulTU_ekzJebaK8@
z)bd3`Lp5niQiz*T$ejY;OWRuvG9PxEX)L?mr#U(MLGk5f7pHGGJN#r}Pv11t6&z|l
zs~e|Xya-;^B_%tXjU!sbiceqfhIOEi!Lq%^Klr93nOWU!h>E}U*!Yf(;!LYwB2z7Y
zZF2B6-8y%H!r8`?J49x2-t=EATQGx1>ge&)LMC17ccedL3Og~|^QYbcKi1whwxeH?
z6j<`*-E{Nso=QoQlwE6cWx^L|h=V*{oNU`zP?2>eJMu+@g9FDx!|cS^{dN*bDN6&M
zOYX7Q6w2YQxMK1*`wW42zTbTj(^vLyyJ?%hF3WW4v6(rVDHcc8Y||Hd=d@hj|H(@!
zMUGszW;fG$iN5RSMK-y8l-TJMw!nRzL2?_fO!xg2AI|@0?VV@G+jPpwM_IkzOgQqH
z8+-3FuUgO)7bqO^Kr6MkWJTV&p|dgZPp-M<N>#0mVw=Sj4!@nOuDPx_cK^ObMshb&
zk2JoE-J{_Z#=~H<sj|4|snaVp12_4EO*h{^IoKQ;Yu!F~PQmdjnrrf<<0Zu&26g!*
zJ1$OMzjxB}O*`s;8X0VQv}^TY#TuJMG223Vp1!#A?d>6}mBv*UGreYQTytpR#fy%M
zd;Q@%4N5?c5^L>CJ*)V)_2sK>>-s%AYp(ngJ?&Y!@OPg)gUu?d!`pu5@2`CIVq)^`
z?aT=-hguw8sni=ibM$ddSMW<%qbB^yds?B;e$V~#*JK2ZcGS0=GMLopxBn#n9d8w$
zKtrYz1+A~yzbI!+;dAb-nyw+HnlZ)ikjB1A;-@Mc;wDahKg+l}_x?Se*5%75+62X_
z{9Zg+E^Ys(OV2Jo)vo`Qc*pm8=Fv?$i<1*GDpso<w1jMWD%o<Th3Qc7Qk(T*y4ol2
zOPgM`eblq^tDcQV!Nn^rH`j0Dot-Hn5}bHY_urDqVyYVNF6=6mVY;zJ=<CxPXBIx*
zUDnu_7}%+EqxtjwTI;a7%7V91zNP6F)g_zcuP%9W{CoGZ>lqRczNF8)(sd++v**;3
zj~tcje!P>u*)}azQkFaZCtC|BT6bQ2ks-+u=<R%5aBY`+Ttv&K&wM=lF5O}Eu}|n+
zGyPO_{t*e5{|9t0#c%PQsO!U&@_gdj=t)QCw^VlhN@{1BBX!h|hbM0Su~XSv4;J~!
zt9|d*{jR&Ri*Npn-)_58E@<>EYI2iwTsSo&O>>6Vp|iK__7?nqw*RuDvi7V-ozq5E
zQt-WKMgn3yR$LsHSDoA`_}tgT;^)ENo8Gf*G|>`Z*RR~N>a+SRV@4mf&mLFZc0AZy
zzQyTA&$3<avL2j8i+wjfn`D-o(&KXF3$sh)^6dtf7Tj=?ZO*RxKk?%%-P1<qRv9G$
zWivT@!L6sA7w=>!<b;%@I9EyKB$cFyuxNw^d+*H2ob|VdeTm)Y567|=IVQJza2=I<
z60%XwY3cq8WhWGqGPf|*$VF_OH1+EKze0CCUvSHK+||6g>PKVot^H!9Ml*jL4>s%5
z;O!QvH@Z~tuw8btpv8$zI;US)Y+-q_x*gV=1no8vxE61Ew@Q4`mkrlTUT_3Fd^6Xs
zl&jlcb(Rrx=WCz5WlWPF`DgULx$q;P%Uv!>Yk?c9+HH>QJ(|x27Md!yFWXhJqKc#Q
zFUudXx)1-3T}mwB6iRd6`YJyCj9Z$J+hgbOKOgSiy0`a=-VC>CsgZ8S6VtijJMBug
z6fqwXR8`fy64WRl<+Fa7>+y@>TlhMSj#LZnc5>A)mfjW?Ho?eC`kuYp#{HqfCSDuT
zOLCe`9=^L>D#sS6(pcbo{=S9Fh3>Evp;dh*HYp)Y(>BN-e#ALd@&DwxVC&|D-l{+<
zzqHvETyzCwPwVOU^*8yR@16W^f49{c=d02Z-xLfE8(iT(UY0Ze|GC+T&%dP4PdQ@q
z+S~56)b6i|Y0S<{mPa%WsR%rBE_(6f-Q6kuZjwUJ?(EJ`6xo$~s3PsM@xuwFr$O1u
zIn!k_!$MF(E&<J8t=-~q!)WKmHKFeuZlt_8@!|W;^;_p&{nq;Oyp7@Z!>?bneX-qD
zJNuH|Y5mNlw!-gsK7O!kD`=6G_B)ff%9Fe5YDL&4>qIQw7|`N5r>Dv7>-|9S=?Zll
zbWUf<%#{8-=L;+<?_?<G)Ra8A>bNOwF+)*8;@K+)nb|o?IInCkK4v1e-GAN;7caNl
zr=!;Fd3)@}Lc{QQv-Qr^0mWC29<?;FdiIpVy*TIdgj7jcc5!pXeo%kzncL|X845ZK
zrZxiGv>3O{ntm+iV%5v%cmLP^GHEdX_igr}U%wdt`pvhi&A5B()a>>Bf_LA9$KQ(H
zD&f21^|pGMT`&GiZF|2_)7RB<<^%bVGYQA8+ScE;*fT|8j_Ka2Nu8^>B2I5wQ*-UY
zqeTZ@XQrw_wi|;AfyND-7bedA$=C8Yf4ATP?fp9}E+kxCKKI0*5dVaurr|AfOa89>
zQT%Ii|FQGM7yq};w+ub}&B|%&<lA@lf9XCiR)1^dO10t-eO+JU+ln)+lAbs=Kkb{T
zZ+o5%Y@Y#RVim}LAe%t*=?Xa>Pi+PCUf%jy@U^Wrw0pb%EQdYn@9y7E*Rn5UDnB>J
z@a4YUi)Jt1va|l8yX<n?j~+jdss_YQHnj@MUUgISc=>y+{cjdc<Yk%pNqV`>p96o&
z@5f#Ecz0uXyrBH?`m3od>ptyT&L@A*G+V7$f7Pziv`>o01}B2A{@?{UCoGfG<@ydt
zcL2Ou?c<(JlP2Y4eRNn6*z$Ab&-}dybt>9CS>Ag`8lB$%v*^v$>8|Bn4Ckj#tNpoi
z9k0gOUWTg&Eq*TiEml&~o)cO(@7tBf>|yJ<-p{I(4vn?%wM+eHEo-7*_|RQ;tI~M^
z*K9A{)0;kp9X`*-0V#h#eUWS89Iy466EA1KxjOxP&AXSb^84)nzcnxXe=M#v^YY%R
zuCCzBXWZv=WXw{o`rq&0{czTtSoeE#mu0W{@ozR~`MoagRVg9M;^){@OqhQ%j5l=U
z7LIlQ{)#sy>2cgTwQ0?s3C3wsa?c@SrWY?7nLp!c(G`|G9mLWb6;aQlVzVpv_MLC*
zpO&?qblJb>_q9{<`(nR-=HDD&S@=bDZIU#{3Cj&dtWP)GKGuJGbHcxUOT8<)_$~@?
zNM`*?;y4uf@9lMlCnufRKZ+iYD^IPGGBJ;uHdQ~XM!^I+WODk2hQb-|r`!V9VskPZ
z3zqlEt(2^}zqa_>+!BLhVH<v**xwnp_tB4uzk{y+d|Yp{vGn9N&Z(wXwil~EF#p+D
zz37~Z<4Se@H_u<}F~9vV=+zeWZ|_oDxo;cha%~p7&i}&uh=#G*GP`SP)=E;cx~ESG
z^J?bB2pNOV2bp&9;tLIhoM%P?^RgS$+f9D#^IzX1VDb2-`t?5_Z*S7CKEijl;#ue7
z=<N@F&%Lod|N5Jm(rmnUOjh|g3swevv;1|5`*7Mhg*QiBefDu}U2H0TVfFJDr}ZwK
zI@I^xp?}r^LAh0?N0aCLI?=4j9oF0TJYd?>1s4@v1wpk7G=bmv;BaGAs1#!?D9AzE
zK6>`BZ_$uR6*|^bZnfs$*X6pR$sOARlNUC*Wqy{f{dqL-a(_X{*$c-XalaORzc2Uw
zBiBdUcdp+rbZzyn8Yd5*vyY_TP7>d+u|%U?LnHN@Tf~|@FQcp^7(F~neb3)t)y~Hk
zXj1*`eD;-!tG`aa$cPME*<i32R7!yx8W9qwoE2Pj#bn)Qec#mO*dZVuTeBnI(7JEk
z{=)0=XXh=QUz%#AWU>61eW#(s^8f#4=koOR&lPqr{J&|b%q^R$5QaTF*YEf8SLo)p
zuh0*kmdVfec5PHh;oYfQ{od~1^Yuq`e$2<a*WcJ|Eaz`rs<UkR#f>jhBl)CQ-%9yI
z0|Yb#G|zlf=;||G6XLp`9t&LSQ+sgt?%KHaZwtiP6fQ0kez&9bXlB3tpZ<;ScbC1J
zW0xEIf8Q5jzseVOrN1uTDo^@v*LSY+>(hd5XP+vIvUIJSQM1-`Z{7132d}PPZuh4l
ztU|GhJ2K|qSMig7i{r9SFI*hGJ;@-gUVKO2t}CA3?@Vl$-?a1MrZo!$*GhH#>H#+c
zK<(M53@w~n14?9WuDYS&A;5ig#-kM<7X0OpTC6lB>6~xs;j0haqZ2;8)M?6+NsU?%
zrnPRTQ|L0EtJl4RKD11iXjaT9`QP<aCr{!}deQ%u+xgD~{<d$9ud};$&?EQN{~6!b
z-Tt6^vohoEu0r!H9=Cs|USvehvoTz<!(w+4yA5ar0Mr_=in3%#^maKujj<&pP3<|C
zSGWDY2?_oRT+{Qv&$(Ih=wiQnw8BN5C*5s31vkB)R`Pz5jpfmqhc;~8`~L#h(%IJO
zKFO)y?^vGvt7P66lyPb``xa)em0nM!CKYQ=&?|cR{O%NOX3t9zCzk5Hy*Rf~Y{s-b
zk3QbreZyJh<(lb7dMkAoFHVhAh<84DXGRz(x^`YP5|~#!^{Kd(n1Vo)Pq2J#$2GfI
zU%rLvE=%OUo$I%I+l^X7HI_LGj1;<ZC%@Yp+`Z|?v6#wE3tz{@?AO;N-rluOvdQh^
zqZxk>1iHCrv_99$e0Jj5S;_SitS$w&^KWjvbtU1WWBC@@Pa*||Kd0RN{A`2#hv1U4
zlh)1sZ&&!|e&_MNm6JntvLt17wf~!Lu`m^ulAR6Rs%s=5W@jZ9abbmr{*1a#_RKj<
zHY*?9()M^9qCekf=Pi?WZP{gKXU*Km60-iZgoB%%Ow8t}Eo~XBB3Wu5edg9l>2_Qc
z=au^V`v~Wu%ru+tA)hoOroUM(6uKm;@NcM%c>ac}6AA_8SI^rUbubl(eu+AFB2#SB
znoB}6Hc0S#>MvfL3T|I~4q`i$*3)<Pb(-w=oU+^EVr4bcBl(io?=sn$_>})X=l_DY
z)9UWkUh_V0sKNB!ulqIoH-78ow%6K3Ys{YRND;rl`sw0q^KY+CPj=T-4ZWb@u}oCw
zlybCL_C19slDGF~KH=cosCZ-2BA0Uozt-;;+w;BblPZVxQ_bk(y{sI<JUNoGvzO{*
z?`SaC3eV#ipmiNKR%YENg+GW2l-8V|x8m{k{F_2tj*D-n+5EM5{Uc{a<HmiCGuA%4
zaB?!&x0H#`U)fBS-(&uIb@qqD&le~kFk5=|@5#lA8B?~*h`6A!-eY#W$*<I(;kI9P
zY47{*rhRFPx?G^FrsR^7(;MnG8lG(gjfpg#bX;r@r+o4bD1U<nPoEw8?3P%6G*zvK
z^Vo^+O3nqZPdxK&(wH&f;JcDjfrl%1?2_{9zLgq%JX9mu_;KYoojK<Nvvi(*y12jm
z(*wt_1!t|+GtLeyW^$gG&g0^#`cz|W?f>Q*?s7I;68Fw1c)zHXXUhTIJEqmo;@$f<
z?Z|!fBcd|>>DlWSl{ij0wW+O`rm%Q%>eQ>k@E*mTjHe7OnOBP%HiQ<=>u<B)l`GBS
zx`sP-QB+6)_uI;YY*SoP7lfAtDjMdbwJ5lsoDsNCZI0&Y!hg~ES1Kiq=T}ELE`Cyz
z#v^t00!M+K&MGZYk)EwaOfA{fU!SZ<m6X+8z0u%2bO}mt-?WAenJEf6Hi^?a7kjXr
zoj1ei;kju3{55In!H+fHtogM?I8xs_{hY<F+UP0AGgwn*%|F*O{luwR_I0a`SEpU7
zEe~9H>e<?<qLR&ShPvljdi(n2cl~?y(%<gXhHBm|5kC%AhpbrDbY;_>7a5U<yJoj=
zp6xvWDnQJm*bdnQ)G;N-9p((wR{!?S_gJZ#>ED&dLl(`fx$v(%;p!<}(d4lI-;CEb
z@8~|om#W9={#|$Fsy#1n^*rZ!eD`=<t)#JfmS5?sE5{O@H~f&0K4Gc(spr{|3!WCw
zie^sBOo;>)49#wz`(J=k9H`(j64<7ZCsUdj$KLC=<8NAM@+B*etQS{~-}0&clc;02
z$}rj5v%B%ajguz!cWi!fdOlksBT~G6+vLfPr|Oz)%Y9~_`r^dfJ3;MEA@{^3*2{dl
zuFbu4%4406i0Mntkd7B$mdnL|33Oj~s#E`Es-*1M-fJJyc)`aXfToT>Q(G4d&%d`5
zFa724h4m$?&|-m-{Hsba))v0EkKM0Y%yy)?@1_5~SJUU0II%J3X-V&UbbEbAT_b;J
z#wm-6EW5>l^8@6kt_Yc__ixMPp7ePF&bwHyZ0hL?%aaOpx|&fa#S6|_Adi9$e~Ue9
znIUqX*IQtJUi{T08>>UElB)X4`xwqMYlmk@2TLw6)iqjSP$_42A$rHUc=<L-x9h8|
z>esMb{1CAI;j_S0ms=*UqBrZDe(_>KV8Z%D(<?^M{UODR8wyHRhXwX-%DR}rn0T*y
z-F^W>uZJ3+fBDU~S~}yxgNvHKT91Fq-<R^i*}-d-vuBy*hAPo^g##PpxPry^{Jz%a
z$ox`kiLStgB@9!QF4<K5o|d}v;zdyJ%N(2^-Ly5>6?|4t<7hd%_0dF;nKv{#K5oCi
zq_Ww@@6GMw=WlejoN6hV`F65;)*F`|PSM0$Et_;szsUG_I!gxHmIKB7RAzx~2_-qx
z93rkhogD1m*HHNxbjZ@HFVP?0UY|0_job0(^EP|-GqsClD;NI!ET(h1XzQxbTQ@Ay
z^Grb7Lhocqa-84D)ADt$Z~fgr+waf$92I@Xe%7xUkJ%ZGuKAmIF!-!hT%>Pjz5eiP
z<9T&4jti!N`mK9-q|QoDhHM#<lGSBS<aRy&hfiwm-EXbI?fi%9j+edt^ZG}9m%XWw
zz-4}WgOED2R-MzEdivPF>xsZCY8)#1u1;zY2%qprqRq#E>(P;Ww(YCU-^??feUQJR
z?cz*<|L5<?E?BkExlpDo+{iOcl)vKjo>13Z?%1eo@1<W(eO=Ng=WhQ)S4n>IANRkW
zPRIX*J*~+8()>)%s^p1ViHrNw#tmCf|2-mV_3qVT`Pp?h-rxTJf9^jk4Nw2cy>pcR
zJX)x1wFrdFk2y;4$+pi84tJW=(pRhC;$Gt7Uh>2(wZY)t97l=#+jCVoW#6+pflS>p
zvAORRlcH5#bZ2&fleyQV3m=0e?|J>)z57tV^hH70i-NL^0<yP1{ad(LW#Qvha*h)G
zvKIqioanvG-tuC{TJtb@E3Zjv42o9E+WPKv^i_okEPA|+xBR-SmDi-Yzr7pwyw{bm
z;sP0SQIJDDLx(fR+1>L}r9j(bH<0yTE_{r+v*U(wT)d^i6F1KwdnSmT7X@XR6?(P@
zuRhV<H)+bHRXoD0_+@tr%3i#f8(P{d0CJNmCkIsR$IMskidI5WR$f7FuccTO%@;jB
z>*Sv2;;!)ISkJ=1g^N|zo;Et2`J$umg+@sad&^12g%<*=uKlS@3O%K%RuU}=GCB7N
z!^2R<g*yT-&9Q1U5U^ULYz_`g0lz8s{x)teG&}|W9d!nWq>KCZQ1SL_N^k3z$Fe#t
zT)bq?waK6OWo;p$Tw>E`AZHa8AZX=vN=mAC7BATIfiEOp#5;8K-S$#&a`$vN(fgtU
z6keIBO#-qDonB~YF7*`$`3K}jLD}W(isor=PkG$YV0^gbJO?<yUv%_oDxBfxP%WAA
zY`3;>zADH%7x$7q42KH$1Z1z55%7AUVJpGWzJM*hweJPkhFxqe^N)Xg%=g~uxFuh&
z*9#3sMXMrE60y?aIP@>>Os{5oyypvz+*c`(L?Uf@X9b_Yv&(`Us)dUiHcTyDdwkQ9
z_P!S#eRh_Mlm!+&UdPM1Jk;}r#?_~R&9;TgR<E{|xVSSWR<##wW?QIIGQ}*nBUnJT
zwXgq~TZxE(9jEMfP3OgvE(ESR?YmYy+F!sb?HI`COo!T+J+3=b>89cNVui0Rqp;g!
zw-T4*;rrHh_1)R=!>I51Zvk(sl*WKbI|BbIxPaoa<jcuGMS)|^$L9#oQ(3t9l>y_2
z3*h8=G4OhWfb8V5R25FysceU8%oiosfqc)=@`9sfQcIsh2gv;|I{Mc0IOW;&SUNAB
z)Y4~V<Ozv@7aT1Y^Oz3JDz2EMQWCQEd9o8fIKD3Kc~$Gs(bqnW)yY%HT<&dost-8A
zUc8w6_|a>Nefk{gs&h+KJYPgS`T$E6B|VKB>=k@GCbjgH?wD5j;srQEnlE}hRl()>
z-5<v<tWfbZW>5rW(xSx|3Y9?N`IM*EYtjY7sl|6*Y}2w@wD{BA8T?LpHg`l?CVknv
z*ZN#$bTpI2oLF1cZ<c=Me_Ld4bAI`{^7O8!MWKbx%+3aLrR-j+|4U?k9&BTL$(8rt
zk8tU9QD}ZEtQ1(Z__Xk(C2Q&gUOX%G`B7!X1xo1`KMHb`@^VD$3wZ|loqcz&aiZRZ
zz!w>i&@?Yz+duo<E(Y~T6D`kE??fT#qQu2Lj|Y^j@3FT`TC(Nlp|`U)w1d*`ixa(F
z%^!Z*?UMd|?J1|Hkia5kt7k_*QG8Ot<@mw~kRdC622Pd)Wu{*z!G#IGu7KAhp<nO+
z-v9RWlM6U?z0gqb$+LPL>+s@Ji;CuIwS+?jFEmQd6f0YCaa{L0e(@=%=OrsgSVX?q
zVR`M>g*Dmx!}e-^JLNGc=$0$z@m^4zXSnm3+wmW&_`H9z>tajKNweO5jdBL39v638
z{zC~bZbX~RnyjKJ-2y5MI{NN#w7jU$_;zZEs;5{lm#i^Zt%A#O=dIyt+MYq$&@6U_
zMbX@km1FWG6;s}e;7GMvq%4qjsc_ZRZWT?>OY8D)dzkwRnJ-c{mnv~Nem0Xac%ibu
zGj&e~2~OFI6T#)^N12w7ed0m;7X`OWQh|o*6StC{CIbO0zO|=?H9aS73oqsaC%(WJ
zJ9s!Q7M4^hX?g}tNV%g?B4WPiado4BtowBJOOsSg3kw%6-T^8N7d-x?@Z{J^G5twX
zR6PG~R=Co80c>48Gsne?-7b@+upU~NJAb9Pm0C;RYYy3qg@yu)lJ7^EXnA@uKKv%r
zxDgWT7bi-aZ;vhC7*$_($(#4+qCn3eul0zsg6mKOf0E1b!(9#<o=i@l#Ngtd7b4Qq
zc%e{7tk-K&k<=}<;95|Sp6GqS(elEAd7+BtN;|=pI~{#a?zSu~FH3yb7J`!El3$nj
zmfGkt=DYyOureLu_c)%scCUM<iss^dcV)dQZwc_ow)Sx@T+FnVyX6HqImov>ydVfp
zxPr3g<+0yuwsY}YfxK{PC5yujkJV+M0?mBU;&lv(HZF6rZcl%!pY{Lqj@e5mtGwj8
zwNTl7(c(W(R;W65^nF$pXp3%@R`rCG2~Nj9Hweh~Z$0vMyN;}?r=Q?4#%~AjcJw(N
zpK?Kv<Ko8~rKb<`%c^=d{@PRqO4y4QUnu;m@Z^}tr-h4EGBwUdoH{>402;rI2914(
zyMBmg*jg8<c;05`I_B)&3@Ui;bo9+$A6vfCdhfix<jk-}tCA_;=zro?GG)HZdq)Xg
zS!Um@PaWb{dj)v~*UEmlaPj&oQ0N@D;Ba2}c%#@ZXLnDpmjSnmXREe>41A%X@TaB3
zrgZAf3xPpldj362*XV=N=@U1`hwTd=SL;Ykb#(V+a>_FSMaYWMh6&Q`n-=SoOj*Jr
zFzs&0DGiWfP@%0P%kQ93GG$8O{k-Ktj|@TOlKG;=X8&LB`h0JhW{FI;vy0IS4Nd-*
zj~4`Gc|oNX)5E&|r{`%2$~K<`WfxUd)2ZLM-orBlo73?Kbp;VCFR!c`ZVpJgXKi^O
zalKZ^>fTNp#pb?AldPtwO|5*<(Z>c#=#2uh-+wcjwe(Fgvf8rSzPtENN8gJRy-bI`
zzwR$xd|KG+<n>jPewCSD{pG)uL-ryhU^o?AjthcnL8Div%hr88x@<qZ{Jm3i`@OvA
z1W|Lg7Zz8qb;mooYcAYmTXr`lTLqG6OP(An2Gt?yR*VZ%E(CgItus~4d*W6SbAN%d
z)hjLmH>cy#-EOKSQzp&wvc5h`4CLuW%H~XpR&{T!&gY%HzADJ8eHJe$3zU4>s%6Eb
zXtm2mapB@kMO_6?`M?3*(f49Uoj}p!2<i1t?$2-O3yLo*Uh4#HHz=H0ve<R;BpxfR
z+>04&r_YjCjb9BbH2#18{d-11rj=Y{fRL3IXUpeQfn&2<!G-LOPm2_K+WS7{?S8aU
zi&J*$rI^#AOpsQc%W?nfq6$21edX2NZmN<cA%4l3{ae%8AOXw^a$%GSSWm=ecmWEk
z*fxER`}5b+$zAqT-cto|^D@un_}69u+1Pm#RGRxVdFA<9V3opkcBi~KjRBJ`7_JOn
zn=U&a7Mgcz>diA2K0di9(DT#Qtf1pj{@2U?m_XCRV_S~qz0>+$R9p}BH}rHmK4n?d
zBBnn_N?f4%V#m*aPfuS~vT!-hz`c86&iwWD?JAxxET*cx+vV>CF0)0f<~19{9q4`W
zV{Nr$%g0{@lT@1f9yfssPf*}<ajfT-J-#dYLdzWu&leK=Z6^9ygVOdBw-Oeok~!JC
zr+j$?ZnXw%t2cQLDlP?OSzGdRMDuJ^8wF%lIc4*+YhQr;0@CHfsAzSsRJFC>g@&h9
q>D}BVQTDo^H2U_0qkG98?ss<f5<46Y88R?1FnGH9xvX<aXaWF_F*Gg!

diff --git a/frontend/editor/public/og_images/splitPdf.png b/frontend/editor/public/og_images/splitPdf.png
deleted file mode 100644
index a77a065b428f8e7334b41b197c2deeb59a263616..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 46238
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H+b7PZ!6K3dT3r8Pn&K
z%N+Q)cea<x)zc4E8kgu!*v93;%)+9eu%Tkx6}_C=4c`*pI`3?9dl;aSVX=b4>-ILL
z$k};w)pjbChn{~r>34oZ<KBk9cJlYlKmL99n_FDP^H=%J9~IiCceS^3GW>`)Zke>?
z|D8jN7qc)(IC%ygxTZCA`PZuTmpvI86sM@L=Hw<NX`kOeca93f0Rc9jNhQ0Z?w<O*
z>9((f14w>l+-lowlT&f}jEszJ0h5;edXlnR!|${al>7DN%d$Y8oJ1dx*^}yK&aAwb
z!}sei3j>Rcljo#&G5hxH-dI>yHjSa7!CAvIsP1dl9bFa%XARFwcX#d-UwiGt9~(vn
z#`b_oORBH0-+%9p3|~7Z1BXS+Bo))Vdw<fog&72jIaED&+1u~mzIQG|!witt=GNA~
zbLX-!90A!Or>FPt<EK<6hC_S{RZfc4Ree@tWM~VRB(mY^#EI_S-t~K{r!#<T<ht?d
z#f!&JpDzCU7aS5?vvuFp{Fnfdi!d|$mXiAP^g%}^2A+i~N6(0D+w|ti=jULRK?gQ{
z{1`T^w7*Y?A%R2HlkxY*OG}r3t$P2%0&3M(uT*##dQD;~gM}d^h~F%adK<Yo@LLrp
zgF(xrB@I{A)o;5NMooiq*ZTWz?M_PIW;`I^H7V)a=QC$Mrxjm#ug(DCGnJ*6m6azy
z{_{o$YS*7rqR|{+A8wC-{w!`w)HVT-lQlES*T+`x-DxSqCk%1r?()ZNkihP`o&WiB
z_3hgb3uoNjUz%N?t`0G8Gdnl;{`c?H7&=Z0cuo3JQ26nD_<A9RmQ)T^&ut$r-`>v2
zz+}`iNo8$ck4;q6uRYtRgWV;v;p)YU$4{R={{Fr?$X6<@cMqKdg&ruH4{X}FQC(X*
z-mcCE>=dpDGrN1IHobe8$OMXspaXR~DmG3{-TU}43&<l&8rFtt`M>_Uey$%>{+gQF
zwoiNBlnH~A6(~Hnwt|_D!q#7%XDapd`g%@~r#%^?=g-O#Kbje-26hB%PHok$SP|xE
z4p7?FOe;@IpKm_9xz66PqJDF^oS*N~YWe@}dG`-3xj5Bv`;KX;WpAf$JS{dewwjsS
zWhJxJL^WXt$5#PIy8J|rUVUwKVyiOWw|5(uluDCseg4<7`}tW_ML8AAIg@MbKUbbk
zmFJLt$~V7q-se9@PVQc}PF?(*d06PR)MfD=ej*N4idB|XfmNB$zA>;Uwg@<Jl=sTV
z$H(QF&6HqpkeT6o>^8eLpI+>YS6|oP{r~HAhlhUb)*Qj3inYc(5DhQxWvThOh%qU!
z$z7RqYQ9O|Bp;P$^}o+H&$<j#@oky!ygLgnN9u^FSuikkpLA(ATY1nW<Lot$&4SUb
z2bh}#oH!I)UIs7cn$ya_usAM$XNBF;=^0D&`OO0v{W(FB0$I<`X0KYC%EZ91A;ND>
zq~}G|qW<+9%k!r)K2UVzP;3!6^yb0^_UU?t;Y<uW*4*{psml3!^JWPKIZ=?O6wgF%
zc#s$?%gnH&VcoN5CP$wKaUL@HnLhXIdI<&&Cx2ll4#hLv+|_lT)rz$k8iFTEw`T4v
zSt>sFr_8_WmU~SndCvd#jn6mg-KGz{tIdyIxe}LhD9L0Nmp6aw`g`9#uhRYLI+d-t
zkr5n(D?4;*Du0_5voSFIy}iBK?*DQI(;2chtA1Ydouz%^fAF`OZ|4uXiM+D5o;l^^
zi#N06eidIZH@5sPI>k7B!D>tYrRE1#Uzh&(y)*E1+uF`+>-QBsF57(b3<EfrrnCea
zMJ87KSZ!S{!H`gK$1+CMfp^-uc^CiwGTkflUqOd^u5a^8_TS5WkM|j9POe^XX4ml(
z4?b?rI6r|``qr1n`_$6Y$`*c|m2IAPd)-Rg{^eT*TP6uPaVYjoI(_=uy4=by9kn_P
z4X>_h$HX?5)N7jSHTerHtNHakdB4v7$grXx$CozOo!z>6#*{$yHyeF7NpFA0A>87=
zIy>k36VXtE28Agr1e`b~wyyP`XTWgag66DWb6*D;Jl$M>C3~m0V<oGiZF+@X9{be=
zj}>(0+1>2)zZ|=(CUp1uis&_IN2|Urnt$zVlz^Rm&R2hJrQ}JMPOV-Qzb7ZnX2Gdb
zXEdKIv2|eY=Js06_T`57<Y#4NWt_q-yuIbQ*JIY~KE%)zun3e?vX*W#Qd;!(WiT6q
z1lKKvdhx3XZC>9NJTp<QU|(1^B|r9;oYz5qw#2dm1!*(2$t#!q$vAN)b&7MJjD5G$
z$9v7k&nQlrcx}FE;wdNg?&|8V#p3HX#Ko6=uux{<baIlNpR`v&$?D{znapy6prrM%
zY^F}&${TOj-g*6e@`3;lTkif9S7pzh<zYC$f9puGEAKn`@2;=^R`)!RZDDs(i#dDS
zUG{`J$IIJkhYu$htm*7nDE8>(4bNgN{`n;W6<2!yG*5W(?&ZQ<Pp`9Ut;;TosVcMZ
zIBh-}R2s6q&il`;6Fa&NtJ^$slLRL<iKkCRm8Yv~i)Py0i>jZ$hvELE1r4VbIGnS!
z(<;BA8?sV^+xjINH-jBZfh+H&T7$j0YeDY#qG|5krNLCmrg*Z=y{KziJ#SHT>v6w%
zi86eAiA9bY7JbbZnjOHo()!6Jm8nJBw`*NKUmd?7{$xhIm)-HSpOw4M@87pRztqVo
zJX>2>fI*<eG+Ozro3io`R>iZ^F671>cU@rM_~XgV?gyNke=b*eeq?3$t@~v+Y8wO`
zI}||S=I*oAM{Iq_n;^~1*ZQ~bZ&$dme$MS*(p|rq|K52sxAWs?>!laJl$97T#PBpt
zxb!Z{QSR{r!IqNNGx?o`SL&G96U*W>Q!gF&O#VBAS99iXTV0NqC$xLlTYP`N>(^@Y
z`THwUw?$Me`|(uU{9o<Le`(IbOHIKU=+BAd`CGnDf3^6P{kN03e|hguy2zOKbJ<Zg
zmH@F`d6P^TI1cUow`%$Hx^$NJ3TGsZe-(wPwa)+GD6#LDpXtQeizdChSD#`av7%tx
zn;V(szCUhhTx&m=v8Vd|#gmu!r)F?3JM;JAx0%jW78h>4?Ob`se1oy+?B5pYck9;~
zYZrYw&8A~f{7&h+e{|ISDPeNIQ)5kHyNok$J-RFT`v<$CEl=j}SIl`^SFYS^k-%7M
zzo!4XZtj=&PS+Pj?LYFw(*B+Png!eQHmr_$`A_a$>?1e*OXbyn!<2O^zC4-vcKet4
z+1mv`VSB%O?f$#>ysW;>6n+qGa%z9m?O(->qK=Ihjb`rNH}j*TW4f`?m)KYyh6h&^
z&dj!WclIzlC|Q`iYuYBf@|T+mhjW_F*0sw%P8R?6>g%0Z<?ng!pXJ&dD`r%j`Jd_T
z%lmCxw*Dyf(D;6IdAr{BScmO<EbhJT?(=@R|A5=%Y1R);Xg}5duh8S`wLR83*jy%W
zQP8Kq4)V(r$_n(guNv*m-)6caG5b)$e515SGF|?+J^!l69{IWklqx#b?yqRw^Z$l=
z?%${EzorH*;mn)k^zPpKVyA)+Kkvjaf6ta@;5hWKQX_|R``>fg9QHq>uWoWR_wLsG
z>88SQR;>FjJICTjWyRStEyA_yZsy2MREYWU_}032^W^J#pV%p-2uwPAcK!19e{X)o
z2k+ira^SXy@_X6(Q#;;2yL^F<p9@re7<j3@w*Tg7zAxqH-|silS-;NUSfcc`#lGo?
zVX_8y?+GUZ8-bSRN!z2_j5a<v_i$D4MCqMRq$esY`T4$Vvr24rL-b+UTU&Mqt-s#y
zAyD`6?VcyLH@D5#h!D7S|HbB;j!P4^-OHG3k!v{rJG<kHe@+~Vc{L|LEKQ!j&3s?S
z>5{xpE$lmr@9gkqWj$8@UV?$+km9UYUpaHXZ&dtr{4JZ--if?Ux1Md9EnkvVc;M8h
zRaxwg6~E8jU2->SQX1#2bqn3!ypWIdes0q)+;Zndw;+$xy9w&G|KnR*__jUxcUb+-
z^_8pl=ausw)wNai=(oFM-UABu7uTBqxfQ=v=Y2UT$p3fnZPU7%+RB|bQ<4}IIDW3=
z<*F$CD<y4}FJ~+BQDMnx-M7!&gSyHNoO--#GhfpL=kjMwZ>5fJ@A<^<#C|E(Xtmk9
z1#7xG{1!=mKg6PVclYI6*Y55AI(^pE{PNzfTaGcSvcFxoP}(cEz05-&RB<Q0)(=$N
zF7@U3-5*Mc+-^UspUq#Ec8DcK(LvzT#sV*o=cmPcCZq{S^{VauxzVI%aY)mIyxj|r
zZVRv4WyO)M$FaQp{I9uNst@wSnx9&`ur}~EYj=H|{e#>8j8f!4Iey_0w!c#Y?RG9s
zb!43PhkdS9<)^L6?h{%W94%%X4{wvMu9j51si5*EPTnhS@4bY*Zw?+-Hz~ak#<ft8
z$7$EKRyO;B(=9xQHpDCa;Q8Qj`I&XyTHa`3aM`bF_F{cg(#hmI=X~dV2)Vq>C-cHf
zoomI@7##%aK5ged+1c}Z=Y%2wH#ha0xoh*6>u2WdI{w30$g!ezb(kQ_!&xUHZl{)f
z=H1?)CU#3N;P`R{P<V8eT#(=X_4!FPEs-zh4)nadtjR6N!{F$#OndLU`H$*kRODMk
z+x;ze7`FOZ+SUFGn&W6u{*kNusM0)z7;(vVaD3)9|4Zn)>bf{UTIyCv^l2N322fG9
zYv)5T-LlyVZ(hEf`=mnb(2vOd>$>fV-zm-I6Acx}>wUP17g9LCxFA~;Ims)t_A&Q)
znWpN$HEerk8l)d=YA-E4^O=F;(54GF_vWtMa%pbU1P$woIp;O@XcpI>(YL#C^Q!J7
z1)saK+Z9|uwa1?i3-)hHyz`CoJ1dV>B~#>&75nB@@-R47XcbL9nULV;^#7Uf<%@@v
zIGvQtESvp>zu8B77<2lnUG894Tq@fn0BYE+6K(#NF!At7VFP`gH%He-^Dvb2JH;Mh
zduDTMzD?c=jm2jkXJ;0E-10tFswHjn%(jc{{xi-RbJxcR-n@6OQQ--=8WSnGAfNj;
za0Q3K3;s(}R|VSqE1A%$FD)&}@J_mA|NEO~=djo|dGsE?pUqln^7g{VcdErgyuIb&
zYr;S09NO@~mu>MxMGkP3->tqN-!rwo;uA~Hq?25S56_-G>xKeDgMx{4um8W=IuFx`
z^=D5>N<Z1b=J_mS-Q693_vIct|0_ZG(&6@baxEN(H1ze^^O^;mPCUN;;-6#vmao&F
zsvmQ#H;7#N<mYnE#ZNwM+L|3LXYUrp!19oR$JX|HiF$iTv-l(-;}D~&QpM&8k8ges
z-);P@R#fPf0!QWtW@iB<j-TBnEdoxOe7~Ak+TD}?nBJ?CQ~PVmS4M`W4a=XFK7P1L
z@#=$<U$ei}eDj~TSa9a)jDL$$PxsB`n>9g9fkUuGUhFQ1;*nncpOf~!70&u=SotV9
zM0@H~LBZVf^9;|kDRA7DyOXaWe@fIy)iw0A*v0No(|698yYgl;>%*m|!v$M7oc?*~
z%PO`AH2+J8TOj|ht$s_^)K?u*cYhw2Kf}z(;ncnK=dsc(n}2a<Z%_aK*8EG?A(q6%
zn~J+<hL``G_0_2PqJ&ZL%DYo{&HBvY#IkV9T{guQi7)K3UWaWyT(6sv_x;;4oi|yT
ziE_*i0<(DAjz2%oyOQm-(d8|U|GpF@aXTpmPEIXPJ^D}>q<c0fERNe{zSh6${`6$?
zzXefk^6csokDrInop9mqty2sI-xaQum))~1tno07kY4N;T;sQ1HAP_B6#1u;E$m)=
zw_-iz-331JICW*&IsQ1hox^E~GRSKSPAsua{L^4@TB81cuoUm#U1t~yE-U2hEr0**
zVAsMp#mS#u-hbK3!gr|Iy`;?e{hy<!nZx9)%1*sIb?H<xhtoXA8N1BSmpO*q$xCxh
zPZzHZ@N$&Uo%}akUq5@X!Y)Cli}`<#YCo}I|LeHoW7xyx$95iLV^QF4jAm238hdt|
z?w{ZfZh?+B=Sbe+=9Fpq!m{A*p9SlrH*DH)<=?|gk9Tbb*|1~%f;(jgXLU%VxnADe
zK8e@qpOWmvJ^`=X3-T?J`)1fY6cTP~I+vF6V)t%IhD-cTlMfbX6)Ef5?KPd0&Kq}g
z`egHm*}tYt<T^B)*SGBR;ssl}q8}%eckd~DeU81^pyE)@=9@hVHlJ_5FU#KfH<x|8
z+INSU>?{j6yzD3eh0v+OH^O|kW$NSq6zn{A#4!2X^Jh|Ds@NJ*nm2s+jXwIPa?7N8
zfq(NB-F*Gt_qDqL$IFJK4?iNe{S=g(Ym)HvRPXKF>AiDJmhWDEyz1so?$WaAXYc;H
zb2!cVn*aSQXZ+^3ufDdi_s^Ra9(tL%h2v1a(A|!b7Kty{>mPI9;@@?wDe&Kq&f=||
z$;X4lq$ajHG&%m*_0sQM_`xkb^#a#&x_!R>Y7y(t5fJj8mcJpo%75P82iHu@?k<nD
zyPdj!UANqatLyG(ZMkh+a!@T-sH#Fh==0&Q%j~ieM#(RKoa7d4@o-<F3`&+qRo@zO
zf4<*daNYd=mFd%G`>L@uxHNr8e0!58Uvlk3>6WEOkJm-+`#pL8MK41Z#kXEJbtkX<
zT&K0xqUzZl*SG&Bbq0&yj18{-cj*9k>8)FD^DHMBi?`(8nYKeytJ6$+<uV&%j@<l@
z8)YAVyt~HWc7OQmb5#Wb;D~JgSMWx->%iM0%Q`dGVB<ulO#&VY9J<r0a>dH6HRdbq
ziK|#pa?K=fsYKI;?cw&eU()q#e*8YYD`WG~Lpc%qs$R3(e}6q8;5?7hEw$K<ake*Z
zZ%WK=I+?Oaq2$gz4yT7loBNu|l#eX1FU<SvI78*f6V4gG{(isSCnK0H#>Ap1o4+hl
z@D7umW5oQqQ-7xl=n8}i2wl&+^Gq)G@yj)>`?qY_W>|e^*WHxreIkx05)GtYKAZ7A
z{lEX$voqxVzV8U)y~MQJF{1wIGLPl}-O0QLQcALS4P_PC{yNThWNb89J>k}qle|`Q
zTg{YWco?efeyg8Xc$1Z<H`B1y?wmb`zKVL0y7ye|+S@rd0`gnV#GKm9cHQOJrHcW_
zFYD}^VKP0sUtx>)?b&6!Jld9+PyW4r$HAr#M^~qvWKpbNtmwD8%Eu}RR0}-yuDKxJ
zVzN1frG7!euPvGD&N(q`YIgs~c_{q)x~yiV7tMc~KYW?iVLQKg>&uklV{C@$7j9nl
zy{uLjw>9<55z7#TGIo^<B42;4-m`60+`cTolXvX%Po84j-5TH8q8GQ%F7bLC%fo~V
z(IyYNFZ^43GiO>IIQD}4+&diW1>W&X{5&ZfV4WWqoU2>R%V2Ti%j2dEFMnJ#`I-Jj
zaGzsDRLzg)2EP`(UeYc!Gx+7pmrGwZJ=c%3EBoYgbfK_G)Q3+~rTgdGY_Cn4z%SPQ
z)c5!8_Wt=7w=P{DeM^ULKS##D#Yf-8aJhNdb6o88aOYgEe56-jKrH!FOU4;K-r9ih
z<8yc!cJXG*ur54Wq^aBbn`6Gho-&2?1w|aSN0z=aTbC@vZgH>ojP@!Afi4T#j|)J_
z;k<xT)jiXwHVNU0mfT`CyJ}`y@-w`fw?a;5S6z3%<)%OGzv_RmC&s2#l@%;lojqaC
za_f^z_!scrIDFjy;^yhwj1@C)3pjR^OsTVSdddH*S>TwaL8Vj4v({GI{V(U7{?1Tw
z{jTYa4HbFYSk5ch%omxza1v)gbLJ+0Ufa7qRt#3H-j82~=XWhk{5$JQ%&tNc-`VoA
z)18W?H2>%HdY?;RX%cw(!to_XtL-<>==z)g_Vm>{ag?u`vgoZ+%EQyQx8K~rxS*`P
z>c_;e4|i4c6k^}*+#%}|#IS2;`~Qmmm7nXf^4|-T3gk^cX>m2+LCKNkzJME!^#X@X
z<ns;P1@pFR@$lDQy>g_DkzsG{+B*dtAH8Q!uwARmvm;YL?^ovC%g^;C6{jjZSueF~
zjr7F633W$=rgVwqKaI10AH(yj`NB$2jq3Eq?c~$c?CaZXs*W)Hh*&2sH^EEbo`zn^
z0omq)M^{`ef2OiEH(uNAFJNUWt9VK9rNmwH7ygTbmhHFy_Oh6v`JY0`MiW2bqpAya
za%w-dFn$QUlG80x&-+Tr%pj8~D(b$8$vxZRcS%Pd3jaMXp!W9KB$J&RSG+Oc{aNw-
z-FXogfucpy6Z<MI7`o|shiL}y360u6(efLoq7FCLlmHROtwE8Jf)~Gi(UewVn8DMQ
zykAGWnD^3l_xmc$42~ToE>^qZt%{D@nbtP{dvPOOF|VdEz$9<_X@RIorw=J-mAV%j
zOA9eX=zP7U^Da+9@aM_<dMfHsXVTahKrzGivg7iqFaF6-Kh5=Wy}$ANKF9jSM{m~&
z9CBIe)D_5bRZBEA@%iiPIT{Qf{uIT&T$A}|<-togFUMa={-fp~pd_n$ySJb{X5NyJ
zHy=Nq`}FyqfAha4Can+BW-XI~9_v0lDO}JF8;M|UuopYsJnQn+)!`|>PPngPHm(&_
zzqY2PVp-chNi{8orh;}Kx4d=__a%$>ep@`3Me5VMcdsWuejjadYQM~WA7_nP<62ew
zN~U8!e$T&@QDxm`c8i-~^TiuApV^K+>|MlU<*U{3#pz4Y+3k6kyp1O^3A7YhditKY
z{8r%Zi@uj0_kHF#ISQ}7T=ToHcGvrB@+}6(?_alF#BmHXxbVu_`ep$m0|Sd<{lvaQ
z%au#cUW@PQ*IJ!_VZM9rUq=pZ_nlXta7xIFl$a?y-@kg4fq{WTu;q`dIoJHY3-_+Y
zADVyM?mqu7>8I}>Hvdy-dFt30XcS}eDo>4teg65grZ2ww=rAxaGzEMpY4JF2(K@HE
zw#a<nluJw69|ZpRD(+-)Kw{?|-NhVgeX`z>87^W>3=IbyJ4!_2mMH(Vn|@{c*X`HO
zr^o-_=wAmi-Qeb0b^il%A0La=(lFRpeVl=TVMnyUBS-gsANOBukACOXcz*wS?&J59
z{9m*WFR<r$XyEfTaA&Q^!Pv*guR|(D1_lQwP}(s+7Qy>#@!I{5F79|M?DQgKYn`2(
zkZXW(;iAPlETG`{`{``(lEs&I3Eq<Vedfd0lcHG{<XZ%uu~uAr!Z`!dThmE1W@cdc
za1msl6`y-mx{yd$tXAr({_WS^|J`{0l3>*nekYF13oF>&1byaPZFO9}IYQ^mQc!pZ
zyzD6Hd3*bp_t(J8-+i@Wotdxsoj6`9RBc)AH?KkR^73FYqvfEmb}CW6G%;@awtpsC
zsms>$-~AEf(EQJ3|5tX!mXBQh^K2NmE?nrlb!(0X)Ku%D7vU@H`)jM7dzOJ5{4PjS
z&=uNC;$dJAXpz&n^s)KaSJ~e_KZ`HO%l<x+J72(QyW!#M(v~bcb!tN5&oeMEIC9vU
z$-ay?c3gR7&;GZUt<4X7cesD;{=o$f|H7O&7A`q+%ysdH`m@~J)fX=uU|=|KxoLvl
z{~rqsFYLW!xGw)h^{oEw*Y2m+FNpWNKjC|`QzWNii_!$SioQ>uq!bo$1c~j-$w^^g
zXi(T9`cmU)-jlXH>Ax;*^xyw4c|N;pl4^^<E}vchy0|9npEtSBz)MY=hd)0rD~W;O
zL!ivsb)3J_()Qo_t12hZqU7nmWU<r5`Ztre{oC}nmj6%X<L;18{trO?j;e@R^^8?f
zR);ip?#X$3YufStnH`LC=f<X=i#>Bjujl^Em7eEyHP&Y3?CKAk-1qYB)$8#)GheSg
zwyc_8Zu|bX1s`^*P0l=!{`dK<wY$H|nVRo6li=xL-~Rs2Q@iVp{qt;+n;q64)qR|q
z9c?Wv#<Ec0F2`fhu9T@pXSe^qp}zeq`_E;{EdpwqqJMVt-F<N~^2V<(n!=I}>+7d4
zJ1hVFZq2*vdFLXz53MduKbvN}nSICq51f0w`FLjT)KSyy{Wam{g{yasZ>0CmHF>^#
zYIG6*l)ahtuOD0$*N^w_w$F$uVv}x}^l9-Oqj|5+#W)CfnQ~Z8?CbP;`unzBZSAl8
znuU}74!=?AC}|OR_c81fznQ<E`-(6vZDpl<HudL@Fur*6Do$+Q#X{zm^*68GyLXV`
zzQUHmKRUiq>ux4Jlx&$3-`Wx+7BoQ_)C<$RWatPQNcMWa`=jdq|J(e<Wq!B3aN|gv
zHlP1LkF%B2R<BZ*weS8s=4W%8b>fA}>-g`P^9$;3ysGpLtNZxY=5@ckb!D3+i=#!_
zqdA?I#lC0%eOGv?@Xo;|gNi>ozt$AqKfnEU!fNxQd#ckN1e7=?_Q@Npdw)ZnxAOk&
z^2gpA8;;v4UJ`Wjc>cD1R)mN9j=Q&KZ`!bWX=|fk)4Y=3|J7z1?0$5Cv-#qQUoWn{
zE?r(fd-IR*<E{rA6?o$J_C{X3c(e3vTJjRBo4X`Hqp#*1%iHzRYcKr%|K;cDX7>`%
zF#0(ItMXSC9PjVdyZATWn)*-Urb0kEUxZJ4$j<dY-+ocu7T^0@I!T^IkypMvL8m0h
z>ex5g-%Hl+_i1nbry!yutJrdM@!!RJ_x$Q@a`tpb^ywNNq&%Nmv_ETk%De5-JgrOH
zU(|ozIk_$RnDFMKmlQ)1E@WRUfAJvk#JhQNT<Yp<itSc*t<jU?Lta{NtX)56VeqnR
zz7-qabu}y0{9HBDl6mpPBeiEINP1V=x2;-k{^7Bo&gFRNbXLW`f|qw&U2<Fz5b%Td
zenduUlheXL&ENgC&k8}#3$}9Ncp1<ZrPlp#LW~KYhkHj}&&TifOE12#ww4qS*cCA4
zcj)e@@AYryww6m@zjk#0{^e=A&zw1Pr|mTFZk}bSTsK+UZy6XHn`@srIq7gr+OvOe
zPHr!rpSH$F<mBQb&)5BpyKViwZ^_If^X8wk{H^2ph(|ko{p+xps-wQ@Mk?=XRtP7|
zywNeK$mP|ec`vTaov~zlx5`z)$IJda`*34=eC_93)~53og#GvQ(t5pT@q=mB{MRy-
z#b%wU`Sx>qe)yN=68+-4o^5mA|L<A-J!!vHa~}S(mV2(T>)|=|dn;e`>!x!x7F?bt
z8}+%$Ggm_4N&$1v+_)Ok%MAth8xM<amA_LJZ=G+exqi>XtJ&si_gYKeE=rwWqO13G
z*^9^DSIQSn>7O7Xu<rJbt-n{N-iZ;7+ZPk#l%@SgUQnQI`ohKjHH%)o(Ya)2pW*fU
zjC^9|d^KnH$uHjs_MK(g|0Lx_#*2uui>}?TUq|zD=Q8A1U8!5V#s5U?Bgue(+p)3b
zzmrqE+3fF}kGm1H^v>P>5=MhPsqOtT*K3|nkNZ5oefo#KLyO+o%$3`6@%1Bx7{@Cw
z9hLJq_;ycsn0$WbXR+m691msIRxUh#dpT>1dw*?N=V!jg+dPa;5v$iF&bT*w|BHz?
z@*f=2-}h(N;m=2PD_8SL+j^R7s0f(xNG_c%vE2Rkewpk$voAVG#64FtPfHC=ORw(J
zZ|3^k{`gyFpT62-x5+Pa!hHS8yaFy<xOidXpGDo%_~rhve_Uk3FU>8szC?Zj=k7o!
zu}#58C(o_kQN1znVPo8X&mG75HB@}E8soR$y+7|mELUT}t1~|xmi-pe|6+48nZdv~
zuTg$^QLW?4ozsOB?ug!AZ5r{Tg~f^2Zr`-C@q3h<8zwARJ#8yXvP<^kvcmdKMfH0T
z_YG`p1TI-#zU#f@`!{wgfl9H&y!$t2{B*bxc46X{^RLp5Pj6$oWH(zT{@lhb{*zB$
zxR|o)^m*3vMp4Il(?zYqVyadqChlVYTK(PjUW&AGZ0Tj^Cle1Dbedn|kyxTDJ6~Vz
z<D>>@9mb6-<}2Q8ekW$cdDp{l`nvoHd0fYil)Yd5=JtWjzmJ{09XZWOAw)^zX6Iw|
z^Ro;}zdcG_y*G8kqTAUMzq_eQZ`8bZIQGB4&W&9Gl@-q%JnGim&oHqOxTN&y$u~#k
zMXXM(m0O>El9rSB@^Q!B-~57Sj&x1i*KOtUDfiAX@#=kx7k{_8)%sqUV}4Tm<@b9R
zvPic+(hgtG&)Kr%V%Kv|XVEetGnK-UGe;yP=NnbMTa=tyyx3m<?Pkp{>HdGzCNEsP
zk~bqEG47P$IZ$N1dbK*7U;f|n#Kc={Hf=MP*auvGck^C|D4W$jng4H!fB43*I~^%C
zx?sGki}R$xl7Im9`qg{lWwJFTjY1t(l=1z$<#D6mVv@(3-S6uQ`h_H}lyzO6#O5@Y
z_t-V5(iQytEeqC6n|giUeIbE;k+-&Q@^6lBNXlyb&~N{5$K!*2QO5ZXi@v{TY<B<Q
z<{&N~aAhIy?Crb%{yHgJYThSf9_lXt`huthKXc3Vdu5OM9e3;PHCbsCGWSS>!QK}U
z7vKB{nm_$?al`c|dvn|V`GB%i=Y6KkL&nbT&c|nEuZuLV`*XjZQEsKY*^AbOquw$C
zT2<Q$POjSV)w!*oUq$BTE{$7@7x1dK=4EAUn4d1yFu`MD{rgQ*v$rIC`cnCi)#SE7
zT?_l6_IY&^&%f>za$#zoa%rdIMY;8%8Oaq2EE!wZ{CNB7@>^$*b17Mk6F$rp3*dbb
z|KZ?+z^DuVoBNqJ`yBV3^-|xf#5(uQjjIxD9QnJRYcADzZQYu2{C}Xo{EAD(PET*%
zG~H>*{OPlu#tC_^#rwIt3u+d=;*Weg|76OG45QxN8#o+{mae~WamU7QyI%8fU%o!I
z@sF*&m{#yb-fbHG{d3MZD7zoM@8F*Q?60G;ut;a-5}Q<$4V;dl`x~R27cH)DJX3U{
zikH7-`I?oB?Tk4U=9pzSPD|{NvJ|*>jrSVUo<!#4b9yS-_s*)Ro_KTL!)~ou!{x+=
z32Q>OXDiJ!dD891-|}$k$rmTAGrfK<Ia%#keCs)D>%7O_S|I01TFp8ac~NWHGvUN9
zX`75nOn7&Ey>|BUvZb8dxfhffxhCnlCwR0A%s2NedJr62^=oMv)0MW$=nSTV^;$VI
z@)SgxS?B$Edhh+J7~KzlwcEe#%*&r=DNtm1I{V&#$91!pbGA54pO)BtOGv=!WyG@|
zu6*fPjT??<KaFZw?ww%la6Rk9Z>@*Z<Liq5Rx|B)pJ9_cFS=fWjl=W%-tQaJAD?OL
zII=Es`%fLVLmn44F0%a6E_vX<q8gd_V=*`GJh5ecbA8)|iz!Bu=CiamZ*JIo<<(h*
znL5#1-+jBi{rv3d%cK;gBWe?Lne}%*6gL$(?%p!fK&kq|?N2q|x8FImC!=vf)#eHB
z=f5j^*f^owsco%#oRpLD0`s&(U(WCU;q}^?Ik7+>=g17riL*~VP+Y>QYbsuNT5WIJ
z*C)lhED!5`-Eu{$rooT3WtHfkUDu_jMm;F|q3~z+PX`G`bE9V69n-(vyz;_7bAGyx
zv-@OFQaBXI(~@l}X)a}T?S5tYuMHR2rY+PH7P9&B?CHJErR)p$vrLLzA{~}w6s2&4
z<M`TB-XH#{`^_zWrnk6fN#lf&xb4NquD#uOqH)5C#bONwv&wC&zZ`GN3euPG&^TYZ
ziMQtE&Ck=bc*X5`1hR5&ZhO78Jo{;>%4;cyEo+$-?_c?L`gE<neSX2h+23Z0Nt(|B
z<+aPdf9_n{-_+LE*2l|lClS5r$PZmv<`b4L)psV$H2?Wvvc5*@m-PiZcR%rYW%I+c
zjm7Eb++|`MitKAGOP)l`_%1Ihur6xz!Q8hUFSD;Wtms&(Q`z)>Zd0RD^d)!G_g1^J
zYD|in#J;HBv@j9ab<ycnY-(|r*Q!^yH3axHyA<AD2FIP%tP{4KT%UPl*Ip>Rpxpl^
zdh;=XcO}Pv`QHA+d&E>@(dEsi&*t1q$qe1A_VR)Fv(Og-(+|wLWbd)LMEcs#g{|%X
zmNZVN@-XK#PHvpQnleAj_y2eMB%>mQl8-&l{&mI{WV9`;EVB4pKTV=jyoKGV_t@Rv
z>-T*<BHthVKKr^`<Aj6-f^!!pzdoH}RASP*XMsUfi*bobiOiQ5i+^8VXL^R)(k%bB
z=N&ff6At=bi_*2&lsN;=P0+TpjC{>HdBrw^#23$`w|^3F53ax7cz;fu$o{|ItZ%j%
zr4|bR?=YR(;W3%XNlV3Y`Hc1rL2OKl;{QMP-QB{#aLu(tjAQ52uCImu{Bm|u)Ae7K
z^+)VV>g5ykyJFMYQMk|OcG;0B8C8Gh`X@LE-(Zigbt&QfdXQQ9_JqW2=ETadusNp|
zU3jpF>G76p(-$s2nQ|v%k>208JO_-O-A{-8-4VNc@$GGr?^Wd#*uxAT?VYzi{6dj{
zJfGYqOOw)Pf2`$SEnzQ=N!&7Vk?$IdyUrUHRZr1!EOL3AWv!iMUvO4k-FLQock%mx
zHHG?>3v~*vYa5C_<UZxy(8MsK%1MR2<)4DO{ubkH$8As5KVm;znqjJ-vUO5-L&2Sy
zM#=wHzYlplZRO%q*L%e{OtaW{E=g6HT}nSR`~R!g`SE&s7Z<u)mpq-ebIpsgE%mGS
z%%2mk>90CvxwEso&xLh6^cB3cUO(DYubDE}Ak{2CdU6bxE64nImyD|vc-C*a(itb{
z7T?yVHu>ZQL!qg2%jJA#IOH#lKi1pUcj!>Eb(zGEpY5}ba&riGr@yOZ=i6P)FK2aX
z$?LEEU%BTV&x}+Qp0cCw+x`C^luyntT&~KY_J+mldhQLW8&m!GRHJ@A2-cs&DbS=8
z_r0>SoQY*$ToCuM6G~e}8w`A|bFJ~(svV_p#k%}(L&rV-{w>ufTO*?SP2Sy<-!6FP
z>Ej&+=dbSbu4kBa_215<eVQD*PQ1$fA@uR^j*v^z?`oRtt0!nht`Uje71}qGza`W0
zc->CRV<9k~gg#Gku6>yLBICu3u#zW2y{|4k-5hb|gMNX7;3}an-k}jG(|&!Ql<F0u
zopPS-s7h;MU811p&zWME6Xz`d<KQsMpwx`<*pr5U<_V9J<$iBfc=dh5nNBf|&Lep@
z_RKvxlexufcPm45)$Jb_)<w$S;heCZ^UAVIQ(t*ATc6&2b92V=b#7`ajYBs7cDUHr
zbmYp5MgyVH)O3HdAW+Hb)7BTbLQh}a=98q=wmu%&`=?GxUElh8`tR@3jBI^drMFGc
zUsdGzedE4;i54AKFCEL@_m|JygEeJ|y7l)3@4QV!-5q~4b$k&?c=I=HsdPZlt7S@o
zNj40g-)5g=T*wyMefYRfTg6|E6MOcQMG15Kw0IIKq`Ep=qV0aaSh|!z)!t|AJo4)m
zHs7-soj1Sso9hFy*6AlZd$R=#Z~v9$Xwfoz(VrIo{?ANBvkIk4zaRTQnXYw0=k7lT
z_BG8e&AEacg8L^W9x^a0@ma_t>#H_-VX|{#oky2(o=Hg$3-^AjiVGYDc`J@|FOUxu
zKU7lDm~i#P=Ms;W1Z6uz<LA1|sst`i49<IaW_MDxxNhvxX{OocA0zHRI#vHqQN|?w
zpwT)1&R8oui>-aTzso&PZkDX6*`?NUKf5`4r}4Jxdy7O%1X~gk-+ZvylXmx6<Y%$Z
z#~a==36%(o{tomxA@4U!e$|hF<o^c`pAKL9R3p9l(*J+`dv|}xRk40xaj*Wl5zn`h
zl_FDbYp7d@O>qp!JCb<%<hspMQf4}BntNyJ?c}tyw3xKHlUny!757x0ta`S0<9_?v
z(nXJV-<{k4rt<w^`)K3l0;Tt-n+2?dN>o;b?<n+tk<E3;;suB7Zk_C9iyyyuy`KA+
zM0SF}JI*~b3Rbeoa#{&F9$%?(;ePc6L94Qx-|Vfd{omZzmq=dIr=TNoto^HY?(Fwk
z1qvl9FFaUe!=LPmp4O@T!ow?~;?o1igA&Q5><erDa&Ea<I^_i)$j(KJGD~7hE~dY}
zV)TMTwz~Ge{olXK`Q*iV43{yqoV>6xCEDvun>44n(8US4rCYbuY&##iNUh{Z?}d%#
z9P9L_-m@)qGB|eQlVirLNvdy;ElNDI;(!FmZWrZw!rTE`YhQ54E=-P>xE5hi{b`9u
zNspn!3?^Caz!`QM7brWrE8P;@vGMgK4s)mDDq8Cz3O|4N@MdLjli{(D=7OIkGUtCf
z=>7d5<mkR=;~af`s~0PBFKpaV^i<ZmY|hNNqCJLc{7$vEM74HQHh~OV<Rx;-n%62z
zu0$qc>#AdiHgA|<sK$I~QRX$R7Z=0Mhdz>N>T8kitnyVp7TSEIyYIrrFK6@bS(}xW
z<@xDY9g|R)vVKB}wCG(M#~l+FC|`^^{U$H-=Z1A{99EBxExdM(U2E#+=jS+&Nv!7P
z5MKJ&%GKOo0OZpx7dIwz=~=$$kp8;-@vr=PX)&W?LCg<7y^PqRqY6`VwfKo3C?v#Q
z?)d3$U-jgD{e1iSID=y|m;_FRo@1ZTwm^BQzx$%Q3)TItUvS87_CEe_+cx#}d&}zT
z;xa6bNhsV|{^%K}(hH9Z6V*O7D*b!t##*xE;<s;7+^u=ZJ&cEB8=GdUcN8c;beq+8
zNbYdJa_bi-BrUma6~0`0{$9=IgdRqxTB)xxF^(4|E>PB7nJ{bBQ#RR!i<`<~E1#bJ
zeotE>xgnt4%)%^6p{Z|4OJB&QvvQdhf+bTlqjhS&HnOuM^9ZcUy|BrEL9j$cwPcCl
z^>vK_`|`3ZtelS5+W&nS?Qf$9G9vM+#*>HhIIMzxl`MI?Pka5rwx!B>Eq#XE_v?OT
z9+Y5i@tPG>_?bn}(Y>iJd7*m#o@2|DOIrH2?mzV;zi#vYo9V2{JOaz^%nLYpR@kLQ
zn$vvRVh2Vh(=z3fCp~lY4zKw4?|XZErK`a)hQzGg@3E}>TU}UWIjz>6`1;b%@dbyh
z=!K2eX%8=6j~53eG^fLQ?7c#c?n<U5GFyE9_AYPfW09@S`8}(zFFAjYqEu!N;~~b&
zF<X*$@me-a=vbh<a^YjP+rNa21WS(e?(O@${@l6A?0g)@B0e_+>`Sthdhm=>si|+t
ziQZ`2<=dC0UaaCUH#3+0UHku*)59wZotq5VI3_Phc0GDl*u`bX#Ip9d^@)3?_wX!K
zF3Cx=`o?~ccj=|w$NRaDMYK6)L<TKAee~m;re?R!js?oTPnsi|H#xe$;E?4`j7Wa?
z=H%oi!)qH9db}t1?RM@@_f=}@n^JdGqo;Rz#126#GYwhxur)hUD<s5>*f?H0AJ3gP
zYqokv#{y+h-Qvm{&3zXHt@zf&R6aj9H$4p;rg0v#W80rQDJiLzESZ!X&+%k|a><e2
z=GEcXBPz^<by9c)_@b^&H(8*OH%~z+=&9SSH&(xtCy2{_EmvOq|C#xFS!ru?b9IU2
zU(Er_ro6N`?6}y)MeBvf?b_|<4fd_Lw-gi$c^SF2E23=c-_1GkOM<yY^YX?uOf4=h
zEVAF9{kc(B<mi5fLss?HkGJ`UosKa)ymV_icf~6urKY}@=Ax{hUV$Bb%KXz|dAo1l
z_n!x;S?IHy>HREG%bDxeC4<aayuse^_d~ZA9J21WZ_V5FEy~bdUn05TgZHghyC*43
z@toHOQpK*T9e4{Il-sv$2O0Bl`qqmZlaDTyEm2WA)GHlp&AQFe{oILzz1I4BzwC_8
z6YMc;Rfx%soPT@4t7|v295`e<I~F`%@qCFJs7PG+_?`B;il6tYS(ANKIaIyo_g&TS
zk*~Ngv7@7mHEw@m%_=*uNqsfZQ@_PjK3)ACR21K8GN`rkd)oZvW}9?pM~2e#;~Z1C
ztRA_&h&X<%{@dp5^D3MSj+w9|{wld6{41VGJ?PWXRWDbBMRXo2x^u<JaqY<;+n?^x
zD)$fyJhs|pq0RpVpgiKa;ltbI^MrZ~mnwwZKle+<#Ow6)_^-CVbrbaGoM2Dp{yE9_
ziTJ-2J&z`ItjL(P@umo?>_TOID=D|1=KF8{f3vyC@Y)synXi|a6_e)tJ5V?IXMz#e
zG1a%~7c1;E+#i-KlVj=ZXv^`oWGV#Nws)E3=XQIUx}T{BC9<6a)XF}ye5-!Hc>jW!
z&GCN%?^WE3&r0^rH<~{)f3lEZZkcRl8#u&+6CO^y9w*$haaVJ}+|=4tTdhh>TXsAA
zzS?!@lT*<*?*;yw4Y<Di-!h>iWA^*3r{*s>WGgRjJiqP#y^Dokdd*#gl6eHYmNfK<
zzMQR|p;ni;{*&VWq~9+i-dyq$c~P@ROYq{o3)&KHGHNY-I|7xhzFD8!Z*A@W?!JDI
zd~!noqpZ5v?n<WLzQ^K!%bZV`9B3fidgsi-bQhDU{7JlCQ;lR7g8asM{HK5V^Oeo)
zu3gDI0$K|mzq^qA>3z+)BkzBQiq^iHe#pJ`^29##VgW&4_l0|y7cLeu7rGy&%XV;U
z>!Fv2+mC)aE}^jH?a|=phu`kI?qcrj^6>b&AKW5)-Y?f+jpv!RKw0o&)M>35&mKv(
zIavvnwDd9WyyNTayjk6^W63cIg`Qxi<AT>SUu4TQeScRr|IG5!_C6f4ogRyN*D13)
z{VV`EvD0+IdHoF^u4qoYA;H|j^<u}pZBj3f?mt!i=XBEr1I0X*MS=N06<R>~Tr2bL
zs?hDdJqMhQJ^4O$Qf~bXE8W?hM*PiPcXro@Ts_%xVPZ!a+dP|x3l`fsy5EV2+WTwW
zT<i1a&T$=^A;a-B*x`6l+C&4{r>6of7+I$m9Xr!w_W$PsWx?L3%@VOQd&EIuCKI)J
z**j1np|#*~#JThLnyW?p9v(<FJ?W}^>%zp2Q-J{{z9+e&*klWpOYYpbRdxTzkDWU$
z1N#lxI7BZLhR-k*2-ADh5OC?aapDUP7v^a?919np%WLV|^78imI!KXmA*F}W>F2gz
zd1-yUkrQY4ymD}yb?tBqi)^RYHeFrYyDvFp7b^4CKey%&U;X*{c~BwhVDTo6xg|7C
zd`-M*IJ1H5p<b86^Cqi6LXhj$t!v+Y*#BeXmORbF(Vi3izx_dx$RZ0rncO`KlrNgy
z4^6OnaiY8LB)jbPt=sKu-)>E+i!-?PL_wzOXy_$t)p!M$<~e%K7ba%-zc@Z6>kPQO
zysf{lqOld^P%o`nL5xl&CuW0OsP@T`N2RH6$Hs{-cRcUXp11$0*g*+}Dc+2--(OW-
z$YAAFyD6fe^1@@)>^`Rx?6M1!CtoOh9~!>5>V9pLp~H;2rAKcGR#@G$KCfwXvOSu^
ze9|X2U7dF6g~@HvY~1nH4;T+hC|p^!cHZiT$x2dBG9;B=+~CPA$(g_=yD)k4#lla|
z?dyM^RA)_Y2$*cPvoDXoK3GudN%Ufu3mY}1zQ(*@m9<n}ZaMqc&-35y|87a(5zxxt
zyI7n<JHueDnnm`M1<EV)(iu1wF8;M(@g|?mpKjlmt9WO5P(mRj+I6{qms(MP?%uQp
zM!}MhTM_5lJy~RD-|1yNz3W+jz0IdrtD80+V}4k5ds>c1=C7KdkbjT**)t!lewf00
zM!RT_+YJN3yd_5Ly~hMgTKZg%|8#dh4z8R{)j6(SD)e7*+Hvt5)y*pMaX;oS;o<09
zu=o|5&*x%op@+wwEq?s}=5FryYTLH<Kdui<o}A*>y?eJ@d3kyH5~kcj>!k~)alLyt
z#ksJ2_4kk!;_rgxZe(9GnW8xJq+d~eb?yB*6P78izgumeExobet-t-%sneK*Bp4DS
zUhX*X^oZ$~iSc3g=SknMs=ci)e<}IjiigW)Tv+ZkPsWX-v9EKRh1i0P4##ismmG0B
zzF&qfDX}(E(xQ=3pl#)s6FVxEgkN#r_?x=LdjG#gTYg-a`{`5PHnU&**WOwkzP<iq
z<O}(EowqpznPgL^zuM5wacIU8WhPn2<C$HXKK9#7X=ycdWymosynC-!kjZHm+bV^7
zpKp9xtHXY|xj#<aE4b<F_Pl$$?cZ(Ne*f)@2hXGJYWx=%daYmX&e7QSIi_#_<3~(s
z2PzEx+*z!Ww!SjiUY(tkRGgdJQ^m-vAaZh9vfS$PQ<|dnUxlWe-CroU+A;q8@+`eM
z`;R|<7u)sk=EYlH{oDEFG-T}C?n^FZ?^SAXIIfx}{#k#?12-0{V<xic6*hBq)~seW
zFi4Vb+4RCgF8Oq;CFk*zE4V&(o_qDg{cXS1{}oyj*$x?7Mt;}ySp4|j;e+R+-<!Po
z`}H~dn%;BGZh}q)kBinP$<!@ScKUz5#K+6y#>{EgV&eJJ5?pvWCcpi5eA<zd%aYsN
z`8amkT-|%;^((tzjT@mcJDu5|^2+O^XiU;`{^vFOUhV5f25YM$Jc`W|ruWY~_o?+q
z?$ditodQg<#Ua}Z&o%aOJgm67WS;GJ{g@lK?(pO!9O2-wd|49nrp%Kik+1o}5~iRD
zwXXd;o!Qq_e_gtF|DTeio0GI>n_pUWdiL*cF}L@<y|ioVaWUN&HV2B&cpP*++3i|=
zG<?3b`~T@j*iRa;9u-j(+_-q{*O<om7lu1FrO2Cf2{4JIA35qPEV)4H4u_S}1;d@;
z>;HC(Z9U4vZOGvCvSiMB3)Lor)2lZ;)$t5HQoL*P!$YT(ZcVx#6MXsFl_Q^XlD2H$
zav?c6_36i>+}!FtQ|&@49?f5B#oMJAcmMb4{w2o)_N6QfH{uX<>Nsa6EM+410%S|!
zw+2RbW1}DThY}MQS`;rDUey$Cv0I<CmF>EX_0wbP=6*M6Hn~xmq<;P4!PSOG8RwOs
z^7{Vw8~6V_3ttV6T@Sy8OKEGr*lo!AGtlPY`<oGgfhL(TD>hG*I|+*afL*5#9^h8G
zAeiT}Ao<k-NB5#)>sz-E^7Awp{0MsUt)@~T=A6QoHO`m+=LuXlD=8@{``*a#({=7v
z7Vh&;pRau(>OX(N&ndTmWL*__JlXZ-HOGzN1`ob3+4%l@{FxuGRhk79Tg0@^3G8LJ
zYU<-C@sYNf5pm+bCLc4i0?)FTtGcfj1a?1T`}y(3pPhRqG^E|W(YQ-nrXp#>Yd+h$
zsHz<n<pux!glGM--F@HI<G1wJ_)Vw3D6FkDb#C5K=~TzDFja24=Co#MM|T$UbJDiI
zA_4^?Iv54mCi@F<{H<BkV>)%oa<&Ke@A4@+zkTp^W|ZM2?JwtNb&LNw%syFHa^|(C
z-QPdBxm)SF9nfFEw)*_sv(jb}43oMq%~lt1(m1_(hKK0|!4j8@e>XO!o8>(C|E5K;
zn4x70-{#qql-Hyd<;{EGy+UWE+?`(+e<#gcaUmgn*2SRk=<26Mcek#NDlfdX^3ZGR
zZNJ-jw}mwC(VF@svi4h#g|QpY+O(GzbMD@+S7y-c0$bH_O>@RMgA0P`PZYKk+_BgY
z@Q;CmSABjTx2mkkEb;dnIl{MwueY1=z1kw8Jh!*E<Ti`1TwdLC-=w&E6Bx7S&E55P
zbH9I@PIhg@)s-`xL@t-K2T$5^Ym3INUrnYfiWhwQegDQ@?IY_K-ruD0`x$48fY+9z
zzS|oj7AU{yxUeaGp5^{r>69kHp9)j_k5{gfU{uWirtLS&bB)kC;c5=)yt}{3!-^jM
zxVTR)D?C`#SHipc^NZXl&rk9%y$)<WZ-4mK7LN_9=g;)HEn6xrTiWgVl6UnoKcnkQ
zBkvuUeE27aqR6@+*)pbuAD1a!_~_XrebN5BZF%MYx*sgclN>eX_idib=UL5RyG&n9
z^-ZXZwU&VDvpcWW#Yg`>wE32KaEqalifxxT|JgZeX-`-<tfQj+b<c13lGhXc`&-w3
zzw#X`Dkhp_+j-fpyWr2}#IZ17*7G8%>k2PAdixeAbFJ%nK7W7J3xO$3i~?+4ug(fD
z^WS>0^z9lA!|lgzvtHl(WzV<VT{qhInD?tm9Gz!dmC}Fp{tid`O&M1;bUoi%X`k?y
zXxS4nW&h5X@d`QrSD)t>apKS|Gv?6cFJX~&bf5C|R`&Kj`Swr)hC>WbJ*+ZJE?=qU
zsO7xJt<8OOmj6TTUG+`s{JZ~`&NF`U(`sJS6|UUl)93%Ju(}v>a9#aZ)qDF+eBfSj
zu<iEtOxM+}GG`zEkM-axapBPYu9f&q{tky#(qiR^h^kjtY<YMZ0-~3NpL1MnH@W3-
zkd}n;rj?t5EV`Eec#%}KXo2I2k9sb*3~z*ls)iifV>5a3RO1Exky?-WPs(0d|LBLI
z;pCg8%!*g<-P!VfdpwJRum3gODGQXHI!=e(eYi~a1&38rpN5{^_q*lZ=jSv=uaRPS
zsI%KPL384*AWw7ul*+R#4^N$Z+{(=Q#4k0iqqpgp`PbO{JDsb&6>X=<Sw&dnO^Gyk
zeDlQPZt<-B2K;aLihqf}zCC~O_vr9#Ap(bbITUv_dGOtKaK9k9I&|XMun#BIL#OLI
z>rdlpxKQ!wrN;YbojIX~A8P`4IW%qKezi{K&ZmFYitk=Oe!2U<UR=!gN5#t;CfwZl
z?Pz-G@na>iI$oEXOLSH(HIGYK*%h<4v5#Y+$Zp?h$3f<oxYXayX`Npa<U4&@;t6Sn
zg*8^^rj}gDSog|Iu%*N;<MmuNGtuT%D|c1>)z)WQxMQvSKJ_if<V%;YDLKvl{?q-`
zQzsWaRdxRo{ybZ*GHTL4>qq9%)6c)2lx=W9P;tt;k~1CM)j0-=FFK5i9Nb^edRDOJ
z*RR*JUSD7OfRP!LeQxquDx5LqY+1AB(GkgAnR`zKtB3o^h_i5n`_6Ot{?Cx(=jAAA
zsj~X-r7sk|Y>Z9!N&fWGbj41s#an({=!*OJ=ybG5zPzi@%MO942SzMT=d7#_^>PIF
zEqGkAy!fxb{nhDHJ)g6%IcO->f4Oht*uI`az-V38x%r>@<z-q{7O{O%WqfsRs^Za~
zLVFfAOfdCuTe>)}B>iN^LH$ej_x*b+-eRw-8^3D0z>AIxLEE)i{x$Y3P=3K-6?OQ~
zr=k^X$}9p_GIvF0DooirJ!fa7xqr_8Kf<~kl_xVU{xI}sa|%rqxRlEOCy*&q_2o*P
zT?)aXbx(w|kMJZO@aD)AUd*uM>d(-bTuuebPIjR)6E}Cx$SMLA&7fFMud<o_@7L-^
zzYWI^aLBf>P4YkfbY8~3N~h2jrsr+%evJ{c$~^W%b8(Ve-s9-?mzO!-?bKH-zU1_O
zmHVZ%*Lkuc&N;PvHfF2GPCeLgrG2(~z?qAJ3uCUH6)_QdA#n~I^FCjywyUd|UB6~G
zlg)s^>DHv>+0z=ITq^9mExOm-f5Y6cFMccbS2}M$_xXvv_vYW<pM973zvA%8POBvs
zEhbrY-xv5|e&@%r)k&(W`kEf`NYA?Z<mjSA=0r0-DOOp*NwJFxS(-pa%5G`L<1V3Z
zQxa=yKiC~$;OJF5-y2x_xn+a!*|jg<@vpI}&H8FQ`KRr%L{Iiz9a9(aI4x4E_bZtF
ztH$NNoo(K`+sbwU>`sN#czhKv{XQHic5bTUrk5QTa@y}|ymfF_=>)~dj7yuJuiIkM
z4XVpdEl=KcIdZ}SQP;a?g=0?M`Qm=|jijOCdY!wUAAi5q+wtc{Q1tGvi@(n-dsN($
zJt6-n$ClWDj15!e@?~$l_x{k8FEp=aQ#yy>i;fF6M=dX>anIq)DOen0b*OiN@*RuS
zkOqvYd2|B@PeXu~?91GrALXts_~^8JalGm0J5$cS-+MM(Fsnc3=le^Ct)K4RIA_&|
zEAp~V!PQT@^5pvGn_myP9I0O-%90;hqr`jZ?<e1>Qy+DADu!+UbaGKi^xhv+4b&uC
zI7(bHHr_t^%~<G##@*fp%1pB9-{0xZZk1qI$oh1pW21qI)w9`M^1D)+!h4N2{@`-#
zdN*G~!nW!D;^c*X<>A|NF8T8ZNu7wjxnbV*KB*Z+Ps~3Y&lBr*k}v)HU?c127jtc#
zC7wO0Vo=;6m|Ee)uuuiu*kF;p%+9BC?!<%Bs|^j37+WG&&3-EO%*Z;tSL;?&Ft2z1
zY4-PB+)pi;6wkkZ`{!5pntQe-+%B$_&g`-G_pO~BI`@yINtRyRgQttxu9v<0{WV=}
z>9^!k?`Z8l*{d&2<~)74AdtmMX=Uo_yv5))$OXZ?o(<3V<YFexzI|{qyM#m_@1c5|
zE)juy`zw`R#O(T!G4tCrv1<$R>>qAj8{N@*v$pz^burtw#iom9->>|9V-f2Sn>uyX
z8_T30E#G4B^}zi7+4-v~LcTmSG1S=C%s2B-Qg!j=w(D_bCQmzNs|$3wS}FaX+$2x}
zs)|H1b!3cMB7P+NV_;VBDYbCfym<N1JWGW$k0hOpPxXAi^!Qc!vXHrUx?(k5TNfuS
zTL0)sq0{53z0&J)??=TIwXBy}qImDH@`qwxegEIn%F~@f7ydkKdfqQ{<?6?hP9MAf
z96hq;@yS$g6$^t&dGj1NN?bI{riF^MUtP68`3{Gbo{aUkBd4Y&D6%zw=$x&)`)8Lo
z7sqB_M#b+R7Qa|>;aC^fT}8b!PIvc;B)v!zIa+*o&b)WLsqNjF<w^(jA7uI09kow7
zv9`84Q)<FJ{kp)64WEvDoWodqWcJc2s?}`*iWdaWmRcnpt_BxZO?}<RdaXAnHkV~F
zGAo!&s<B#TDI4T4<F@7AWi#>)-MwFX_{n2w*)6B-B2&KvN1gHPXW9IYb;acc5pPc}
zTFmM2N&Rk|M1l9hil;XY{XF~sue#5P&8@k;y|3eIJr}X<^pP>?nvi3@s8vrr)_;Ar
z8k6ipw+n_@FLzWNYVi|GVrWrRY3!@pSE;n;>D~C}nY%b^Ki<ogulGnl`QhWdGaJ^e
zyFAHX!k_13G-K_G+W#}>ym|A_<f8j&m#_Oo)$aUz>CU@7|MMM%<gF^UQ|nc%mwvt^
z*dp*kV|{9#xblUHiT>^v1WQ<C1CJG-pL>6wtOFCrVg<IuJ}t(UDLWOO)O?@2GwW5#
zz7D4~f~iM4E1f1*@JoLB(sic!^1o-U%ahFX7jPc+{~7hODNy-FOHa_mACFg^6xQyO
zfBb#=^eG>@4^0sA)evvtP`q&Qd1%jP{*oR&^QJxyoijBLTUWF5HFz>4iahzO)yjD<
zZ_}%1oSRKg{1ghQyYu-nzp41S?WU%8tMBaCng6~|-~M_0@}qO6s{3(h*qv(W@hMb3
zdTe`KIwRM!mk}QBv*+pSEZ~p%f6Duj!W?yeP(LH7tIu-PaWD2$<)9iz>4M?!uh;Ws
z?fG;VTLkYK@i!ZMNs%>K<zJw^+W)+7{{G5^D>l6O@bK5`>oW^VtXXaKe}DgQ^y=y^
z;q(h1m+Xqym$82qvv2;rlhuN~bL?(KL<Y{W2=@8Q`p0gKZ`C=MEk+FjiXyTlIvyX?
zZod7b$zheWRqF+ZdDQtsLGy|ZbR-Havy=(R64~ZaX!!il^r;F@Saz{oy0-VnpJV3n
z@!v0TZ)vz}pOjIy|K1xDzt<*JPLuBZ|Gj=KFYg}liEo!1FZ}kYs%{B4fA_KexBq^B
zn9QNcZSJq2Vtv8z>O&6u=ML_ijeP~mFETd&ykEWk%^Ar9n#UY7_FU=6oOk-92Y2z#
zRqB^l+ibg#>LF#~=U&(PU1?qI$DOM#FPErh>{q-xbAsF5ui3Zlf4l7a+vBQcZnaqY
z{YIr0fjbuGRUIULL+fn6?YFz_{%(17N%aG#LXU#grT9Pv=9bEjJWiL5PB_*1mGYaJ
zC7x^8H{E>A^?7!`Ry<w&NFeamRuApK(r#Df%|2`kH#)d$J8|fS&G9soo-Q#HY;MPz
z#Kf;xS38I}NNAR*%x;x$`T70))QJ~_=lMI!MjNc(x-V`+fJJ~!nQdm<Ii1v|PsvM~
z0#2qM_0+uAEZ`(5=h|?gqVuBs3l8(9z6FnYmKUEjzkelWH=7q@%cqw!*6vcxQGOzM
zh{MnN==R6m=d;$wh)r%}H1)`M!rT7n!=<K+%BAXOU84R~JexV^fm=(!G;<DtCQwjH
zaHl^}ICzNH{(nq-7+U~ii_z&P&2ES1^}iH-xH7LU$fD}W+S=;f_dFa;Lql`_e@V7l
z-S%!*Mt<J1@E^RsQ>X6U_xINI$16Kb6@B@<kI22~5cqVwy5}_?xa_=O80KBFv!j*w
z>C=lmN(~oY)`U#tKa`p`T|^*l<JLu8t;>z3Wo{Swl=HClP?IR9*8cXqoeNHDy(n!w
zw%PJ#r8C>7b{8p*;tJ`7dmP+b0=n+%$+r}MQhC<{w@TG&o9KVPRxez{w4=*XK+2zs
zBlV8W!PL#07M*Rew)?;3*O^Saswvky<UHrP+CMd)bM~y*Z=R#m4qZBYR9n68a;@KY
zU4HMItDZ<YL0X^}a$DLq-E?rjVEBw#*711C`f~T6pyJ%zDU}=wKIK-tVvQwpUQa3h
z?829?+%vDnzw*b)ld0Y(s*~Po<m%t~axDAHuTvkBv)9Kw{OSDGMd`lB#;1GBzo_xp
z8t2b*SfK1A6t!T-jp{aL*<^cAhqR$jbJeYrhjv*xXtOy=%q%(6KfUm?OG#6~*DEKN
zSU1{!i~D<a_R^#6v$C@yI{z#(Q2f1N<*r`^m(H-ui@xt|*&JHSp!lL=!kcMTQv}|y
zTOBI`m*D5#-7NO6s^XR}m;cSIFvaV5Oz5$*!hx(#^RAtKHMQXP1ID*93bO-j_<!uW
zk$a=;`MIlSXMbY*Dy}wV&MFoQ2D2W;9fAve)=$dWF3p|CBKy#d^I-3#mosjyzTW8C
z9W{G)qh7-WC#$rRJ1U#HtOVrd&OUcQxYPcX=?UjOj>e%k3VwgP_Wl0Vx-~~WIqzuQ
z#L(Es(HhhD%8btmT=qI1{~v9&?CU#Uog8LvMyKvm6G}g~Nck$nd_T1Lt*-8`*Dt@`
zyS#s0?YZX{KG^^F^}MvsW$ILW76DNE&}o?n(;o--?k4H~$M4ndFs*#oFK_=pP_=T>
z^1|%)#iuXs{eExv*E8>8zbEc)Xft5i;eNN;zu@$SFcw#VsW0D`zdru{?wl{2Y&9n)
ztJfCq)z{-wYutQmPu2bJ&)fPg7<%5FQTO|;^`}oyWHsd*E}Tn~j?0_(VqyHc-1l2<
z=xELVdbZ`$(fM-1U$^et|F0lW!=$ETvv;d2lhgC2z6%pG+-@<bYrJ4GcXEH>apB^o
zGuH3#1czL?dzJMt!@}Iu;?FK`uE;jO`g|>apU|_F=ch^KtXv!U`{D27;(8Zey*}6?
zH9`IQ+UO4#nECWX#b)s}3z$2(FXHi!%CBSt%@U}jJxS@4S{k9zto5TnuI1IUHfb~C
z&f-_kIJeq7?b>?qQ{nd$DS?f1mVQj(&bXL+`07#-+t~r4KhI8^HS6nSyTYtrD`ezL
z4PJCecNXofWl=17vOxKv+ccTt_q*RaxU%Y$uyZV3vUIVsx&IWFKkIh%?5lby#A|a}
zxv4Ze%-yc;^Yr=UF*$p`P2uAfc6$&o-)7A()%`EF33kS->r8N5{6uCNht;K+`8-mp
z;57;I&3&7X^;&N!S-I!olfz3DO6K(`=FRK4xb6MEy;<Ae<(*bEEaFT&`u8zwOH_&X
z{Q6}tPY5QaoOkECI{%dYm6i9m25;+E`{uFmumWgSSu;Z_IB)0D<&PAE!SkF8AHV4o
zPFz^+_`*h(dq?G=tjdCq!TqbbpX&DWo#G36YP&NpPS{W0I)pj7Pe1B{VtJ?A-N29P
z!l%-%bbnnQzW1wJldp!k|Ab)B3WKA|{3o8Dwm_L36v{1qKl|<LO1@^buyIu1jsN(J
z^YR3x|EW)29z3+LIXir<$cD^wC)4*ffBC*PTKBJ7JAY{O{=d7vUdflL3l!P1XOG<{
zw=R|q8&n=_n8jh`<UUJl&Sp(efPm(MS^e!IH>Yy@F}Li^n0Ec}S>aiUn~rS%`T2jw
z+DJdKw|h!F%_^hh{#?Ev^Xty#=X_zY^-J@#g;y#0+_-u#ZgW!Q#ka~r$%iIf)^2H$
zE>vE+eCf@1ws%hCg}&&JUYPvhr26Y^xz5=Q2J1H2X7b&&dFXBMEoD;rm8^MEFM{m;
z-Meri@z?Cs@AqndzKQhRvBLVr({9<x^{;N`{Q9lB_`S`}ytQTvt9C8r{5sKz^&Gdl
zzh3pf$h{>u`xQ#6E@(Kqzwo$u?;n$5NegIJEa+ml{=9qp<u@}Pk{0Lt5%l$0r$!hn
zJNvZ#Uk<&Kyu5n4Ztk7^{<$x6tn2sf{N-}@Rp`{p;_yAcHdUSZ=*pd{8X$PKNOpbQ
zalYO&(pn)mcGj2W=?J^&x~`hPI)C$p{q?Kv**IR9$nY@d@a6ka&3zXp-d%M;Q0!WG
zn3B1}jbK&3h7Bqko83~CGm`uN_dE$oc7DAw*ei8fPVoJylk2$UD-Hh5W;T@y-~0L5
zQseZN>93Yn%`jQK-q0p2FwP=pLt5gi#t93Q9go}0-+o^blDS?~oYsAKJ>I_fgF+p1
z%eAGi&I(HfX5Xt1Kid#EtvhDo<S%Y#Bg{{@pUl1fW#z|ggHtUJcOPG|^u!D0*09NG
zU*0dSdwbO1?pplx>&#9~eHSji<nnbsJ9T3Ym!o^y69@Mf8QJ!{5(fYOem@@?zSzP+
zB6i>Xg|pSq)Y+R$$XI3E=D)vksU@#&<lN1BQty50f3o?<+QjqoCS5G=F#f$Kw=~{w
z+PttV%aRaLO}DL!L)YfI^%`u|zNzceBE4{N@YFbI6RG+Of>utT6%M(HiNU_S)0kW8
zO|C!p-RQV@k>k<jbA#2Q^^TlmZQzR4`Z;|X-<A2PEH6HZ&)=SUwCHjDzpM8y3FSJi
zR&EUnzx{O8pFQzxce8eL9)8fWK-u!`F-hh}+vQ7+^nN=6PHXkwDyG%^diisgl?yw^
z`f1rqq&QN`pT7Ej@8WM`)1Os8I+7NK&7325$27OAcXveio<B*KCn|s1y;5nf)ay^b
zF5li3cE|qSrIv;X8b0fmCcE8YxER%RxEJDli<_@w|J_U%Pce>_w`W**JbCVFhZ#=`
zpJ^SM@bdNYt&Th2KXi(nJ5OAyv}pbA&5OT&zkfa~)b!2W#cF5gSeFE>J><&I)O+DU
zzO?xZ@$FB|r~KBv;u5^oL!z{J@2RF$b7hUbrG4F<pB=r7funPQa>*G}8?$acP`I7Q
z3w>qF9W5<&AvWG&#>0;h)AC|JUAibJA@cS4w2O<MrfyO<es!s%uY2vQqyxI~wF~ol
z^>@F|+u3PnQgh-K|9$(76@gcR7H+$lFMaK{^-b6P=ccXSC$b}IeooJU#B%rciqN&8
zQU3C*EiM->wx0be9n8+t5t<YODs%E$`Ysf%%3Sy7+3fD#UWxN^0#VbCl<1fRKY7L(
zSrh&9ShnDTt_um-uiNT<Hr+X_x%TISz0-C@<vRV1DQ)=Rk=a>S8+}QC>ywr0=ic0t
z-P)G9voiF)N8sj~$RG1|e|c??I)%e(*Y*XP3U5G*+CVerWu|9MuKUirbL~>ommIc*
zyk9p<%kG@CE+p*a8$FAZgtx1v{`$nW_wDArODj(r`$q;}Ffm!}b-X7i{CxIo*Sd`#
zF1EkfD-`hm&LeBLYkzhvYCrvYF`vn*{%NyjrRv)(k3YWjyMWL`H!Y*u%WOOyXXNCa
z+?zn9#<#668xMqv#qDVLK8I-`bIF;{m9mxjQ_^qoA9C%tRVusGx$Ii)uZ_1>tbEnz
z|H{90O7HLQFU2pe-=O|@|E8l?+=O4ruS%&%IJZW6R)BugDNm2Bk3|H89No*sKlqAs
zeKWgrV}8kz-Xo6gFD!~*T<A4U-?n|5T3lqq1xBlL-z<}xo9ZT9{U*Qv`sNgt@J+{q
zWJP*jvn<FwaqnXHa{tqIzJHZoMOBvaFMP0e{<{nD-%q-~J$v?3aj312{MFafUQKgS
zy<s=QfQ4hSveJtg?>xK38!rf&tC@ic_vBv}7Dg8rS>3+1AwH`qV0w1NY4%@hi_f1G
zeq>_G@a+8dGpn=Zj>H!3>xkmCG28FNuq^z^EI#?TA2$w1&D%CRK(#uoK6<~O$qKvg
z2AR)(y|~!crs{8hvweQVnYCX|3JR8-`BwGDT>(_~Ufj1pInPJlPDX5*1&8roxsCBQ
zH$9F|So{3rlj6hs_SVPUoV@$@BgTbwJyQ0<mL(xCRJYsR;C4E_xTo6K_)Ema2(>HE
zIj=6tkgto$Y}kInQ&6yEPBI6_WGhH6aCCn$qxAV)>(8IAY;l$O!Omf9J8y+iOmwC~
z+}E2P$CECfTR69<;lrPgkE<5-)Vw);?#*Gl^Pf1sue8=O;ke3OwsmXn|Cj8)9VL=~
zz4+yCpO>8_B%Jj-a-P<jGqaB~Iw^f;ll}ZBZo7p5D9?db?0s7iSl!*V>+9@X2Z?%5
zzvD`m)kC~fR2kzN@82%o8>JYsoqOB%EiYP4CG}SM-TdlXn7&%;sm^?{v{1)=yO;yc
zOk)rRRaB*!b?424G?u+Pdul>`vy6gDQSy$BA8suOESf025VS^4rsRyIvD?OgdkdJH
zqKoGB9X!$;@a)u&z1vhu=KOzfMEh?2oPELZ<#Bs%Jg=Rnetq4=cR~Vky4>P-&76K4
zGlt%=|Mz1N>nr!{DOtQ(YfecXiu>!ebdRU+td12=ZY>DBY7!1w4+M&!!gD(cr;3Vh
z+aMrd<$v5}zoLhC0qe5F#hl*nByJWyY!dKWziQ>>hF3ff^|$}3+Wl%p+T>UNH?_tc
z7uW09RjI`2-J0cFbUHjfCNF17y?a;drp}OmcTMGPtY2q1<$n9$MJ`V+rD+Kq6EA7$
z+aYMB7JZ@cT?=RXbiJwD?>Af!jl5jA?O`cPi{osE6^WYZ9Ln$c@7N~KVp?dU_HQ~D
z->y)-Zt?Py$2*U93q5c+{c>@)T>Y0XeQzgfw`85lc)jxewEcga^5ZwR{9NQICYV}f
z`!Nd~Q!}PGy1$U9`EoINbvUz=`1IGMY%Q&2%^$8D<CSW;KK-lM8GRWmkG~UjgpU0T
z`mElUzi!>N<AO^UKTVys;mrHzDf?I7TDxjl|El2DxzqJmXA4~o3);!HI9zl_+`THb
zXqPG3H~5@hoam8x!67T#A!&I~ecp<jdn5&RZ8cJNh!FX3llzc!tK;4_H3ggK%7lZ>
z!t0w19`yfTI&J@tJ$Bs{wWl(wf4_Sf{Pp#hwX;nYuBy3X`zm2!%#wp&n^y`7p8Z-W
z%dQA2WCg8miI(Wpd^&k+ZS;R3g)^TjN@l)WZ}Q+k%*-Ihg|)fA-rTS9U)m6GR`#yt
z&*c{397n5HEq)lZH$J3(<EO9TqT;SSf9HJt7TE3Fw(R2Ur;f^JqR&6+?%?{<R-m2Q
z)b}Q=6%-}Y_WXGCvi5h7d`saoE~~Z}yNr;a?#9^M>0iVAXYRig6u#O-qMx&w+4t+t
zKl^rHEszRa`ftrXW$j)jr{hMve<L4#Q4rj@cf!mX@B$=rC-+UAtzX&s7@Rb3zLfYP
zy>6cN;+Z8yXR~G=({xU~B5uU*X0LXwxV5`TAW&vSyyLq$8|ql6ix^!@nB?ZNl<|Mh
zmMvGl$bnL(pq0~cM&?uZDi;5H;OH>pP05_+pQr8qDY4M*?)Gnozu%s9?xppeuiMU_
zsw{Ro-0t$p|7-ePS<dM$a*kKTFRz|{)&5YaX6g5&n`RFM1(z;gdRD^VL0h5|sQgnd
zDaj1JbV+RA|9?A$)fo~$T`HXBZ0_IkmO1f?(0sSKW{GdtYm3=`>-fra>%u|pxGG0m
zhq9TcguhPx^3}TR#Nn8z8~>OWU6|PMM(4J$IEQNZWkK^tZZAAGY*@LBO+YQ#Qm&uZ
zqoC^giY@;x_dgX_ux!D<MQc~SOmN&M#lKi@+JvY3KHLb*zE}M`V8w=|%iR1mdaJH=
zO^?6wpd@nH^?!wqAd~a9otL)%wm`Wg<)on1Be!t#tFL2?GB5qS73DCaWUA$o)=3TL
z?<KdiHZ%V&F8;D3u+}(H<=Z(~yDJ;Y{Xcg;mR-B{*Zz>d9)DfFE>!DVRsAY<)j^?)
z2}SI(of_xws|!2=t(%N2QZe6La5Q~>?27f}h8&ys#)XE3<gq1ozAVn0c;T7l9M#2n
z>!bI2_5J63`^4F;-;Fb%KHffPci_T}Nr!4bZCb<o$W7_h@}^}EO@4w`C0-D;vbtb$
zI6x;SH>1Fi<MBz|5}gvhmZQt&zRuq?E8HSwfl*?3^=?(B*7~Az7lL{g9dzxtedEU~
zwUqHXXaRa)=gZ(`H|64v;tL>8zj)zrp>S8`x_{qpclY*cayxCmu<<~?#kX~L-%W0*
zlF4{_$8wWqh^7A$_0{!(b|UPro*sF3&ad_4r|S1*&wT>(CAgg2mBK~kUd-3z>rs9&
zV-k2(;=;!~mt*WJi=vB-6?&|9-?g~D&~b54=7H<-<vUhitNRdld7^TaUysuKXY;*k
z1-I7SxOZvO<LC0RRj(5kW=>gX{leqPA)~!=sfQxYUU=yCqC@)TS}xh(TfN5Ye0xqE
znkMG(f<gA_GfsBynQrwn0{TSWo&E8CX&YPZ#XbKfd_Aykn^|e~!duF_%#9Z({n<M)
z+CO$m&jiI69#4*?NycrA{{wNOa*0o<)iQqBU6!_c_ihyxP}?GNSVKO=>gPMl2a{hK
z{XKGsmER}8+($-FD@0uM+WR|&+derIf9))8=Ua7mA$!{MydTGxwD#L*Ouv45>sLK1
z!-y2A)C>VDp`AM`?W7$zKx^|_`c^)1J0)Y5Q=ONW9xbil6SLHBzi!xZk0beiQ=EP}
z<t>_TpEze%?}i`S9!@jPyb~1Y^+r(jj)%w>X|u`a8O_1Xq>KL+BtQG`u&Xt;Gf`1N
zr%TG@)w^uYwW%7P(-!U1)a2Ur=t9E2m%Ovwv~mShUwDWZ)$&c`2i2w>(hC=JpOQ7r
z3Xh8mudWtqG&ugccXQ5n6?1=!xWfIj0*d(mf6-qfu;R$PNqj0VJVK-jWH}as`lX;$
zcHmI$(W7@`WA&I9cE6aRZ|=Y2eoLNyhSnTu#mnI`AEwUOS8!nZr{7MTRzgdw7qRsU
z<!u4=Z_8FY9gj>trXhC9m+>9bLhct9*Qd)UT-kngc0KFwl~exqENWP9@__$;s5k?s
zmC)0Qy)QE}1J7>hf~IcsbJFJPHZ5|Bcp)aRtD$dmPYUD0B_&fPdDpvM_hVSaY1PA~
zddFkQ?8m|a$D|=Oo|F5F8Rm(H9;TkYV*0q@f|=Dc)<2$UPW1tPzjo?Ie%Ibt_G<kX
zxBn}J1WT6G?7zs)?&J<`+JG7x|Csr29B^{bn5y=4R_MmeC$l|mKY#wU>%Qr~*6Q>2
zN=<ztCbhL@a*(>>k=qN2sz;rVSBEnnnys7iYtpycc~0S%Zk$hF|F?s~D(Itcvw+p6
zXi=+2Zb>IMzF4{Z)wUc@7LMY*_oSyiKGbxQ%W0*_1Af(%8$CDt|E^h-ecR4^=4Ve9
z*_Hn{x2A)8J57BT0ylnm^6l-p=71t`+0TF4wC~N=T+aG7De=gz`8WL6{yu20<YgnP
zd0DwY$%jKWm&4r2{e?u`$D@~jf4Am$D!&+*H?P3^;cFuku8_jp{-V3G?3Gu(ad+7<
zF|FFxY!(-IdF%y2D=zNyAz`~jTKFym+Fo3mzu^#L{7KVino44;l*ImerQFru`MyFy
zsj2UC%{P82RcJ*#bK+vV@I4>h4li_m$Gniaq~ygjPSARCRyBnqklxxWeJj7u6=Jm?
z9D_?u74|r)E?b|p;Qpo}kgC67C;A*0v&e$-a-s6w39Zkwvl$c5I58cv*mSWMw2<7J
zxl_W#3mgzHJdAmgZ!YmXTUuJn{!r&|$GO*6pYGb3An%aDF5B6`VU=c(Az~#|;xk2>
z)9T!ppJ8?XDqqhuHfuB}d$%Zg-g$wwsunLiTw0`ydGs}uUYu||?!qR!@UhSS_>CWu
zl9Q7hUNBjmGu+cRf!|6<@M6sTiSIrhnHjr9;e`jt`r}_565ejVA7@p4jZxs%Be&|8
z5${-@EKn8{eEPeWr(gZto2AMR-9SAU^JV-pI}%S#*)~n=x#J5R*~5Mxc&vm30~fv&
zesfbgPvyl4aAEUUKly^f(L>+3#pkdu3>G~dBk8q9y0c@2#e?^oe}T5ryy%e5oK>63
zE4@t>R2qF<&v9r%=Q|;PcO|7sj*I81blzRX0vU|DsqFUV#M!qw+1+dpa}ICF3G)&u
z$!MLhKv^(w+V$5PzJrGF?r_L@s_V#D25sE1datb+NAhzwE34AaEROC<iz3~OnkGO@
zW0%c5w<2)&=g+OJW(@{2Us@cWZl&F_rRI-qw0%|mY4-PeyOLA><i*&OU1>9qvo%P*
zHShiY*oxmDTJ{R6D9uuDcH@MkCqvEI<>zhL#dSP1IAj+tew{aO!Ov#qSD!akzrXe8
zo;CY2-<31t3-j*Z>-#@@=IyBH-Jd41ubppwBE}%+LfiGYd-gw<3okv|YhAu&?%&68
z=e(EK$D6&I2eyT4);^#9<<E^cz&7o;cu|Hek?BQ*lt<qG3ksjl-@o(cU3BcL1FNsP
zpWe7QdtRl{wbg6upB{}6F4Z@m6Z!W_GUx5JUM?a=yn*v|Qw7*%Ijx-B&Dl9*S6iH9
z>z%abUvB09xw8L%{oYi4JjyQN?&tGc=B?RWa(C(F<>vc8r@aZ6Tm3-%bjxkKzZw4?
zL<<*RnAou*B#h%RsC;b#we6UkZfmDpSW(=$Z`wW6sI@=d&i@o#TKVJ6yt{9o&u&S-
z`}VE${feufI<?jMvRBz8bnZImEnZ&#Ih5Z%<gLiwOLudB-dXiUlG~jp)y*$SY0;(z
z{nNMYUmfnfFcG{iy{xgIFVV%+dMnp2#)Y8c2(x_8PfCC5>w8<hHtFY@R^_%iQCp3!
zIo-e5w5L@$dDpsSi{5yJPk$=B`t+ghJo$4KS6f_NEIoOgKnW2vBrRzv)$;MVnUz)T
zXBJ&a>s5)r&AjKu?krmRX}__~d4W}Y=jYxn{kiF>u>aaWr7vxhlm5DF<yjGT>r>})
z^EJ^nueM2_+q_Zxj)zMz&-%}cKm&20VY3@wWn1zVF8=k>iLYqYtAfn(^yN!0WNDoe
z@85U#Q)KnN-@6v?y!k1zcX!#pUl)!<*!#))_OKrM%)a`{N7vWBtG@S7f4J0)O}10x
zzIt&gs1^YYnEh2K(U(0fY4R$AeVPB;9R&x2GQQ3>)0<zg{^{mzH9z8_lNUeTd`0uf
zSAARg*T>gZf3z&MGQ8$6OEvkOz`vE(!(UG>?G`r;4K0h^rE+e|_xlzlDvK6mrc~NY
zOBDhQbvwHASuq_ta$zHjfYq(O`oD|c-m&yvxbmdoYPo8QYYPHPix<=_+1Ik6?lBvy
z<?4@1swTghdu_ScQ_)wiu0%+^{(4wzZ(WA}g^3+qzVko4PdlaZf&-kq94d@O4KuD>
zG~4&DYv~1+ir4XViq{qdnub3+GwrPVv$HpU-rRrnZu6^4KP&3)T-xn!E^k|OH0%0`
zf6Ko9diZ|%HM`$a*8ab@P+73q?QgBXg1IFscQ|A@&7IsGB2Fv_bPvvM&^_LFRL11j
zcmMoPU!SIRCm&?mdgQx(b#U@${cHN0pEj4j{rlbT!bFYZ*{gpQC`0_Z>1uEN>}-jN
zXFZQ{F)S=TDR-_dH(Hl>*_mZ+O~>jZ|9txRJ*V#d+vZ5g>iz%2{Fq-&G!XZn`>Wpk
z`$B`2YBz8Eem}QB`C`stZ65DK;JTVccH!gu&wkbXpPU%+Jk9)^_p{mR5++vr4^>@w
zp%5Hvw&Ua3>sskP!Tpxo^Yh)kyX&S!6~+Ag!2IhVSNn4FHTyjUR=s}H-`@1?pS1c5
z50mrL_kg-L6G26jr-MYj-qK{P=770tf)_*?lq5V!t<t*ABXxI==CuVEbLZEkeC1($
zc=5#Ny6$%pk+E|7BzeoWZe1z6{CC|yLEoFwB`RFMdP79O<0BInC@YkR${t>6lo6sk
zYi;d2P1EhczPD^<*}ty{To`2=EUV8K+V1^IOxGsthj-|&GjAu`d2VuCT;Fe*v1OIf
zwFMWqp0{1w))d9xuyXzVKkuS{P2_gx3H`tBaRkerBGZTWA3Cc~*Ij$c=l-{o?fdOY
z>`jzjc>E1H@g=o-@5EHsR-uKU4JJ<(F)U=x+tS>3beZ-2Ha?@PX(vkcZFavu{{E`$
zyR+^5?q|=0Z0J<#k2zSrbaU|8$im|bF7Dd(b^RWR<O?rqec8W7>%WNI^~L`AU$&XI
z)oRzYcYL!6cbge07Sbu?;J)ZmL&FAsa8vni&4q~^0&1eN-FG+-nflwt#fs&vUAwWx
z_xz{8@a@`as%IBmY)|5ovdy>62q`-}FY0IZn)>6%>rRHhUi#}`*V*fycP=h8tJg|D
zwkyR+HY29wcfp-W8#v5^`Vx=yJG|(SUZ`B6@`8io?egRcx#5EU>c5>ktlL#x{rKnn
zycYQ-v(tJz)n*-;c5n8}z1d0LIWO;WX`FR)7pQ(8%i^lDVq<pFp}(~s?pT)_Z8q-d
zFxb8C_a6Uuzvk|;(J8mDzV}&9ZAmiY-Z{&5lq%cpG%~-|TqG}cK{S6))TQ0l+JQz+
zD~sFMdh29MCduyq_viY}&7A$&F#!k9?zqK~uh@93aQ-^!kC_6l!uG)>&(|_d;+w2e
zGNmq4T|vZ(OSZMo$=x%nUSZCqrQMoaPZm@~b+0yX+4$>E_~$3d4}=x2G?^^(u75M*
zPqww0-lX?V%NJE|VYY3YqSv2)e_Q3F3h!1<@fv9nlU?O`j}`=Ose964??1<*;>yL+
zY;CqL#X5`UF^BK{?|0#RZ?)dr%ic3CCQfSUyYxhlt>xo%DUj{QLo!RIEHPt9+%ajc
z^zyQoOvWzZ>Wh-EPH4PlaeZ1lcjLF|)8o>9FADw7@%hNMs&5X-pX2LUW5vqun!M}2
z*5r14yJE%^&yUY%&0=bDE04agBL11eSF;E!jp`>JU!9v-`DN8SUugJxcdH6Oe7kV5
z%2q~>$>OrSMT=GkUzoT-xSegWINL+R`j2nF>(0Jy;8^!@vwyCHan{T3^Tq!k?ya}6
zVfA6NZ~5{pa1%GTl<b!SOWAtoS-)ZFRTG$L<!EST^CHS*au&PCq?W#*ZLGb^_O<jm
zxfd?J5GW*YOhWdvapRVVQ+JKNpZ1rN`Z8Hjbn~)M?e9;{E&0mluDZ7=<oUM$Uzi`x
z?3t_J-^%zprFUMoRm`Q;(K`f7J{tQs)mNvTebO@L+SPgCme1RGc75_Qf79)>{M@y<
z!RqICKW%H7&TM*K&Zc0c<KhrL=4Q9^b2l%zsPJ*ok3bchve)JJ4OTYQPI8!}QnE+S
z_GV*2Sk?6T|Gw(0sD&(Ed?E0~3O9F8hZ~tMPCVg!p?ywk|N8egnc1B(3gR!;WF^V9
zwcL5rX=!u%-Mie$T4jF!boXrS7p!rtxgN1~!H(l|tDm1OJk=n0X4Tnm_6stjo80bm
z^GMx|50sNInPpo0Z>>4&UWYmB9L=u(y2;8VHT98B;p08G^Wr{#Z2wxE{y9F{GwW&k
zGRNkNswE;;UDDu$=y2oTixU|SW-u!%&U6doobdAd{p+=Md%nE8SDbeyM}NE4<+ql(
zPH{??+9rNKlh3h+mrXw?B<9zn;)~60b0^)M^V(QXJ>$xH-FSa4r<=~+V%ixYlOC=4
zRQ-OV$m+IDlR7S#exD|Nn*EFRyQ{kMd?aL9LAEXgg@gtt$NG*<moGnynf~tjn;RLY
z&Eq3oPxl*I*ZqF#^&vfA`rY~J{!!bO|M#2Ilz2g;B4*YM8{xV`w<nux8)TH+lj$&g
z82H*w{^RkFj}JO7{{D;KFtC(|N9yjzSjWYaMA9Gf-3Sl5^2zM}2D=yDdVd62Tm(yM
z5)!YTwB7o=U-oJK_4m=+^X8c}K6tc)@nQaTH&&a4$?aafeNOHR7fZ>qwgj)2QkXOC
z8tb3#b$!p>&ICF#9B!XiwqM3lPdz)^c~$+lmNkA1>&?`&-!7NeuP>GO{8vKk{S>k0
zyo#&V`8)TnS$0;Kx!H|hKRW8(dj8)(j=COha+Bxfld665aKnO&?d==-RXjIdUG_2l
zQLshz3jyBq791Tj7G=-cmaeoor~T>r{Y6R7`JUIF70-HeX0q|`@1MW*N4uT7qIbP1
zrEtoQz!w@Npu&W;MR4ky7Z#?vx>o;6xvbvl>w9-Zq->mU;?g^Zh&!95H)^kSJ8BXZ
zy3MD$oNv#+|3C823ir>ux83}S#)64?$6h!tPI<_}-pj|!Emiw;>4pV?cCu_X*ZBU=
zs8#Xon!QFY;?izwVJ}9fGaN1{JMZuLW4mRJ7RLplspdU$k)|aH7iG6AT?^m$b(drE
z8l$33I^k-aswGpRLtkj*O^FV5nDOUM#0<%~udNtmv(ulcxQMUHdhOm{lCVbh=mHL#
zIf{yg?$_2VyO3^OJwrgKIi$I(WrBot1z*gcJC_?B7xVt^u;JyBvfZYslJTYZ8|S5m
zqNkgSQdf9>;=FY8vQlM);=x1D?s`wUlKAdI*Y96e^O&+N?Lxz!|Iszl|8?@#U3T&7
z2__1kx@ybL&p7sLW3RN=`&TnX3@t4^`CCA-3<*R5HG8XPsSy(m`es!-v;Cao_;ii%
z?lLFMw{a>eWvV9*XYxNg)ZXx7U1o3--;vdx(*5cGPfc5JF}AbW&0i+|>%ZNc>kqZN
zuAZw_W00e)l2LN~%SxXI99Cl5I%jA0oJu&u#_Qo1uJYN&B5cx<vMEd5Zf*%Z{o|<1
zf%_AtZNJyb{k&gp<>~WlrHn3oOMJ#_T+x?*Kke_~o?{=|Ln7M~oijVv9*N&6IZa!c
z6I67&gL00;jmj4%R94(zdbnryy6FEu3+fM^{i)7qQ2qSeO@mjTkNVrj*_J45)0h{+
zx1;<W?@XDvYs<ywuhYA_Vb`z2--W6zX3y5$)OtQwu|4=B_aWU^MKv*>-^5?}Tjo{f
zSaD3E$I@KoTmUb()Y?@#Z!a5b#EHhgn7`alt*-GPzm%F~*rX-jM4x?5o^AF??DmhR
zH+GuG*C!q4^A8c_ZJf&grCdJg;*qb#Y1Mv5_gv1kuSwtcaq9a$FPHF&f8W7;J;Nrx
z&N1!Q`TxJdMgFRA%3cL0<5d>}9d4Al@=Nv3U&VG$-sI&$&A3>L>SNoSVp28*7g%53
zF+ag}*PB^kI_(lakInrzbJ6YmndP6qmPO5(;Fxz+^}M~Xh)I><+r1`p)Hz?-Y%24e
z@L1&d^#1})Zk4@^j*E+b8chG-)N^M+%M6Q*lE1sUe!u75<s77;u}+QcP=Z>DMyuU!
z@1WbK8bW?f+iP^@(!4(o9hQ5RKALWQ`JYJ6&n%^nerue|)8gA1{tKE!+1#&L_(%5h
z9A1tkyMD-@|9Nk(gx61f#zQ`OM{^He>5}+YQ`h?amd?V(ko0B6CCl0}eZ3C1RPV;V
z{M%x3ABCP4KD?sY=Jsa2MzY+3$L_v83m6?2+x#d9v){ep>LlfPK2_C1_m9mqPW}6<
z;u}A=RP4Srd+y)mT)#=jB4f($_FqkT>tCF^{o+i|zss9#{mo5cF1fgSPP$g}#qRzR
zi=F!-9Hdu^J+Lf)@BEgpzaf<AV^h_(JQ?d-GVBUVKVLg+!C+owHjC%4xN2utr)ka0
z$6L6p%?r}%4_^|W-+$XbvuJwuZHHP=2D!5eRH<IcyQ85nC(UuO;k9k=_aBv(<TI%A
z&-A#OU4HG$&)9sPT``{h*38XrvuD5lRMe~Dyye~IhX<Db&(KcOt9n()zp$0HH}CeY
zgb&S*t@{=PTrO_sZ|;70*;H@p3dcJyWM@0MztrksDDCd7-?3(Hpvex=88R9Fk8IeR
zdB~zXisx>FTkY1(MSrfku719oKl1lU_nNIN?{zERy<8Bj6w<bGm5Y2hzwDMbPsLwq
zZwm?PFv-h5^D>jI#c&cN^vyvnkn29olMhXe^0BZszUH$d;Q_<GRP)oRDGi=JJ>TM2
z@0s{WpycSTracQ5Tx`3P)M5CiEqu>Msrh@Gmfc=o@mKWxKks?9S{4~w6f<_Yd0%+(
z%-8Xysr0cP9`~)e_I2m;>T>uPk4}BRM-)`I1$imS>-qkf6Y}-@^yzYIB0E-3mfBaJ
z?lj{~Y;gF5c*6&A(d+m8-`6%N>GLjq>2FP&?Kh;$F$$ck&+P6$G~1zj!CIZ#mzBrP
zZsw45tLK#7FL79L$F;(R$6uw-o_kL<j|EcdgX_@8rXpu$T9XsA79>0FX}mCj^ZfFw
zD-X>yu#z!4xB5ljI!=9e{`0K~{OL#ces8(28~nI=*Y6j8Pns9>R~&9~3$On$Fa5uU
z<KhtY6DmCE8)PTf``*!gxtrZd|C{L9^-@+ERu4F3mx^e754F27KR?CeeMy*@?av!0
z@9w^vFVI!pJ+JQ2-E-_pk61T!&7Z%IPdE0E+N@u5P718PSADx-LRk9$zd8SZy8k|X
z*!ou3DtRfNbcOB*8ArsAvK+cK^X9Xt{@eUDVQx`(cKE%}D1kJMG$aMw!agldj&oa+
zDKJsWt48C?Bkk{7WjQJXPI*^YO1$Z3;D6pZ*E(CS+Tu@M=TgpHpKda<b2xr|bN;xm
z-CI`KL+Se#B&kV$adceFzDjIIvzxG=@0Nw)E|Ccnk4|Iz5oo+5%u~(x?;NL9V&3h0
z9o+i<AJFi!Dw(3PZ&sntj2i8dwEuP0=7ujBLk{olG^l^{XUV(mc}LWF{yyIM_Q1w-
zm1VxOPbs<X(fV_5-|7ph6(9W_7xzwbx7pZr|5xDrpWmOK7o5EyfZ0RZ_u%X)NB4ey
z{_DH?sx6D^<E6bbl)R6vnB<;YCU#$SqlEm^bd}WB0C3sIC9BG~aB+yk@klWfsp`O4
zw~dX}mt-33X}mB$;8sA;lmq`IrA)XqE-6XW%|9JiW!K@PKgaIu6|Vn^0g(Y0UhMl>
z>|J$d;s>YK&dqKgm%IKsc*xIZ{_-~gMdAGO;(3Lvye`a|Ju4@HS+3<%U9HBv+rK-m
zB&qM}{N5pYHS<hy-z|eO5mWPRc~ak7H)m)rC~f`u?t}lO7_;90O=XU+Ia^e&*V-N0
zIBDLh+lQ5&f4{Hp+wjaR{>O=c^bAE~^$3*!kw2fqMCyNXPDyn*ckpQU4{L@>E5D+=
zGb@b3v{W*_+{&*1_#*y)(UdC|>LnuJ%s8oG!{nWYN><NyxC<Vu@Yp+<X;<ncmS@Z7
zuUc<k|K!B~2JOP@@sG|qM?Z9yNW0RqS?`SKw1R054!W9di}v7Fdd|P8Cy4)x{HDrB
zJGd7*F7DjBa-rkmu#-9QXZP83N-wqeBk}xx)#Z<Cqbq0U{CuXJKC$cmQLdkkX$Osu
z^KV~%_MP&*%g_GJUA6x4+ikDzZoj*H(bVmQj;hf=*C(H|*|6c(zdZ&Yo}HL=HSF)_
z|C$lzk1qfBoAW+PuJPC@uK#zN>W|GynfB?9ru3(`lS2Qjh%5SR;j~lcpmENjrhnIW
z7Qb8e=<w-j>*OsDS=!V&E{<(Du#F=L)J$vb%PJAETGqwVGPkoY(lbc0q>X)6>!c+C
z9Uc6kH5VS<{%gCrXol9sh`@8|o9}PW+ZZCj9mg-l^zrz|`;uAnH8Q^N{pOf4LBBG<
ziD%czO?I~DO-xuqIbL&r7G|5XE{{{nR!YPq$~Gn8P`2T<o&^^d#7Jg`z0u*6y*r6P
zv}fW1Z+9_<@;~3W7d?8ue`a%ccE#)mKTE_qA3fn`%9pwI|JA3@cYa^D`PXq#{91s&
zYu-Iw^Qbx=;r}_U`86;2zbx~dYjN;~LsMcwlD@I}H~W0fe>r)1X<D{6FY9&x2tH8Z
z5!w<X8GNX6c?<t$PHCpx-Ysf+)lXG#DMWVeTvoP|g#*^zC|s<fkW*hW=iX7RmXq2K
zKB#>!j>`Bj{gC(9R@QG%s}4<))$`pmi__m@D#H?<M^;jA#q2*X*?)24mh$ph-<^Ec
zO1t&*c%5Ci*Ff=B<Mgm&U%F2%JUV%n<kVG~|AMOKX9Q`zuNJpfX>I9Ssq6jhh(YH5
z6=qiJYmfe(TjSSo`K)*J{@=&aYz$r;wLjfxZWqn3v!=+}Sa&6BzpAscO{Y#Tx0YUC
z)%x%AvyMuyzZGu4_w3=HC#y9W`VE3U^iQ)FJIt!_sPI9w;+)(6*7ByR#x%Wb`mlVt
z@r3ff8+~W**gH44F8bduZ4vvMQ%X*GZRbj~QOScuzLWbxWd{peUEP?=L4IbHN~*4+
zhAQ!Gi;_Oh-Tt%x&{U}>4@+d?OL%ww{xWU9Q4fDQXXb{V`}wY3in}Y+f30G}{!+1z
zAFhjCtN9T(p?8|1*n|0%Udh@E7he#J*pxW?%9>kGw+1|o{``?$VD8m-XH5F+i*ITl
z&SAgz<Jv0r4L|$u+GN^9Zw%XY`;W$>jUBVE?6*&K=zh_{U>mJ1|04gQ(YZ6_amvAu
zBN>fyRTIB-TkjE3*J2E0nO4Pic{T@c-p-A(x92VhoIF)K*unB;=3LJPP~+f2AgHgj
zlGh=_OEpjDgiq>(jHr!wCY<@NP`+@D|9Tg>bLD>>7uVf5ywTHJQN}}Y(N)c#U&O4A
zh4**uzAGkVvg_;Y^&0kUUqih<K6hKFY?j}1=Z}%_nxdcS+PjyVCnx7@VdjteS9gDt
zWE|6(GT-@GzjY+OFw~X=h^78qut_f3yQ=)ZyM#}%u|vjGx9ws3KC5lilR1>R*Z9Tz
zJyX3mXFk4h@!X@vS6ZJZ>Pb}W-``#Ivitl*_U7g*kw*$0Dh*ydZ~i+qJn=J6@TOIB
zW(#VAhh~oUf_!#`O~I$G<jMd3;28o2!K@p_l-~<4+cUvV-bBaFX8)D_%P+6*_^9(l
zP1?&l$KP(rC8H|=F)o2k{cFvZIeC?ph?viMJt=MHgxVFQkE>a_%=~9P*j_d3L$Ore
z#~YTVMs<PF>db7@E!@0*Ki{*?JZN%$Ufwo0$Nq-Z_I=w`zFgve!zXq0mFFgnsrAu?
z{qi=O_c#7kbUv@P%;Lk^3B3PH#C|d-{hpt9<G2Wy%vzJLYk&T5UbD)=W@T1Yo7;ij
zJG#?CCMD-QT@~bbig_V;xW|2GXlozSp&yGE`_A(SHC(UHaW&&-a{CL%#WJF@+;^j|
z^Zr-avmpHQ3+EYkwAjB0FJG!+#U;D)?#*xmMvWWC4bICw`*!5gOV$n33>Ut?#aEzw
z|5?i&xwfD(>xj)4=3i<0K8ZzqTb_jRsmK`XKgrxv8K3`A=F*)pWqszKqyBB48#)(A
zeYd)-*;Ml&gztL)uRHJVWNtPweigd<{<^*2!skztcncc50d;JI1k_}$o~Z~5%zA3H
z$)jY$wS6rg+_YA{6|>E_(zEP&zued6`TrAZ-H$NOdT#8oE!3-yQ<k|n)xb7NUH80g
z^vULh^W04Nqt$8~ZaC&nJ6wP8z4!N-GuNg!-<o+%fYp)F^41?A)?U4&*YDQ6Jg3BH
zaED>LWBH={OR6$%Ug|D(eEzfXf|XEV<FD?SJ-SaPESA0|e|yVBDNR?8ecu=My!@%?
z5xm=>;o_7eP{j?c%M8?BNc=x3?7IEFlk(Z6a!2n}+I?XC`ZbaNwn<*j1B-)ujyNv1
zxp8DdhTY~iBgO2qDd%(kT+&nYoZH{Gw6-efaZ_tX^6o|AT02*>H_IgK)Q$H)^ylQM
zN6+Uy^L5PQ+84n7;mqw!VUdQ7OZ9EvhcHR9__toT=OwUs^Zu!Kb6OI1%#b=iZ$aAG
z$^AR8=NdHgwkM=5u+9+KzhWxm-wgND^0Oc8a*^#^f3x<}rHGI5-2X&AwPsgEO@Hx2
z9optv;pV<@al?nM48J|iZa)h=3%E<%`+Iq3DkRwMsW|cdZ`jk%x2@+s=azdRU*f9t
zxVg!VUpLl?b7HMVRYXWz{Vm1$d6K;uwaw@DdImjT^mtMFyd|Df@B7#7T`$A?Xxf&G
zmFE^`eqE)iZ<n4q=X9K`+3#Qfi_4a^rTt!0^*{D}<utzPgEJ-=8kiL}zS}2kU4G;5
z_EQoneNn&Po!Wl?LynU7v3on`+~1qwxOl_-`M(?js^fnj-yQt%c6iVh^?b3wrMZU{
zHLdsBHp1Fct$mlCG9`vZMNL??d>z+gS(8&gjM6I}tlYJ0^46_K)*1Y0ytikod_9Mr
zUQGpuEB_@&bAO5B&n><G@ho!Wmd#zWYRQL;=lyafS%)9ZEmA$P{ncCZ?X~~k{`+LK
zYpRr2mqCY7!)$4>lOBbSk99Hr?WxQv-n3qT*GT%W&*M5h$E~^V?^w=O>w7F)xNhak
z8_#@?)LDrIxc5#K)e#cz(!E@7=9F=RYmeajllI~~br+Ou%hS(un6HttEsE`7*uBj6
zV_wyU{d=eHR5d^PRy&JR%63=Y+WH0eZ~5DAbJi(ZR;zmUl*en9SHj@5_sDJGVi8FW
zVeO+kHY$8`TwJrw`^6a*_D6pvD!0{NOt#kyJ22tg$;Irww>JDZ`d>!O->>#hqvIrr
z0;l_HT6ep!?Af{fPJyRGMwrix3Ew+5N8H(bd*36a>faN#yj&xGxAOKu)$Yh8ho*hV
zS$(hm`J)X#n0I*oOpn}eXSRTKdgki#Lo@9BvJcx>POu1wK7Qk5xmCozm+w=x1sCv5
zJFsre1JUQw^86b`zVFzab;5yXolX9CJ_k*EKL=P_e}$X-N?(T=e_qU(E%^QXCik%Q
zpB(1eW*%l1mvr6p;q*l9j=4G?AFB5S+l$1O%uxAt;aa`joR4fgOZVKla5uhwSw>ma
z{e3OW;m^wVZmfE7;H$Fx6>+f#JKS#9{}Wuia^aLnTjv(pDU(0TMgG0`d!Fyrex9W~
zFA@VS)@EMyI?eQT{#h%|o2RbZrfJN*{#EVW@qKJbB`n$x7p=>9%;nj5>)U1iB}d=<
zcq^VTRr9BbSkRU|H~K72-mHIWoqsWONAjojUmUDdkMk)yXkLXRJ#dVG%Gl&T>i!qp
zudsdlyxXmC&ZXchub%$camMBMg3k{H-)_hV@LZHW^@nfW#~*X|oC#hl{ZVtOVMAAf
zO8tM`8=gX!_Sg2G6+Z52xF+vkmXh`4-%JOqZuCrDd%r$A-@z#?XXA?BZ!NY*E-^MZ
z@%UDa;qA<)xAV{KRGch2XX$f3d9&wc?Z0QMl%JmwXIap&*=f~eb=j__g;%9tKR;);
zH(!6ELE(%uioQF)-Ma6S<OC{jLFJeg7l$>g?B-<tmMwCBe{Yhn`4#ga;eSWCifYre
zqb<*GTIa8Oda9&HCG-3lnbke9&-Cwo3U9l4LFE5+C2RHnr*?^c^vF$gIMfz6KbmF5
z(;Zu+SkH)5d|PtV{9(@2RDIk0+yhHCSZKIDJlC*xNw~RvhT-ygGUCQ%R^4|veX0eO
z%Y*K(uFEjk+Zyu!6&Lr4d(0D-T-@Q`R9WgDr^mSPh-09l%I9Ozub#}GYdh0<*0gJ^
zB0YK_r-Rxaka60#J$)bN+Z;R|tS+LqDErE%<R3h>tM<(kkUA$|`_|YdV~U%a)kGJ~
z>3W<drxbWPjifHRf6m)=E_ku_`|9g^X0QJ)ANu*m;n!{TdtP+9TiPV;R#5jZnCC9P
zNaq?;h48VR*TeVx>$)gaTT*7c?2&bT@`CxTM<TNFChVBwTWMMTBH++$l`GeqW=-4w
zZBucltG`{E=ziVFY7JB7O?rIqXYtJ=yun&qL@&2(Tzr=M)L~7ASv$9|#^j&*GGU&n
zz_CcD<7>W{F)X|Q8O{X_$uk}L7ILR?0{^M!v-ox=>K_q*^@YnRujYVi!<IGv=TDft
zVCmg=IqO1(w2J2zCNp#M$FVA#E=8)WyH<DKW}@qfA6h9FB{sczckj%F#oGNgDpm>Q
zem{HL9P$(L|L+qs@j7`iQfJrWu-8u?@8`_lv2?|aJA0n4?p#~f?v$slubU`a_i(ZE
zOs*H{fyKQ>{LM!ap8IAkV|eZ1QxSV(hnf28BYkgKTneLh2}GyK+5K(V89Ld|>G+&4
zCL7iot3vyCpcYia1_R@FJ|5RE&*HxyZU1R=Y_Pid6fx%NiUS+Ae`HCPPW))Ietz(d
zzsKKy>`zqL%;h<I>yw+y7qRzx1%*ido@;SVUr5g@U65bB<HVy?<@dSfZ+y98PrUpk
zqo0qM54G^0z4tQYxUTPY;RctZ`Sq?ddoP!Wc~_So&pc_k+P>m^*qs%TmJ8(b^)^qM
z_KizhC@5`9k^E<;z0tW(9vt0$s3%w3Z{mbciwzaak4n#(&ivr!i6hKcL-+id@V;}+
zItka!$vTC}am$$(?f}o$KvEmip+6Puy}Rs1jAq}{><<ul;H=2%z~;97?-N-G6D`l~
z`IVCbx&9~#K6>;_Df-TjqZ0g+Vs##s9u4U{UGhAC|BmOypf0qc&!5|-rCnG5hVA=#
zYtr-iH-FtVFEi7*Jm;po$*Jj5*ZMNzxBg)dXx|%Po1$=k`2~NEd(U3({i<Wt&%N9~
zTEusPMqrebfvf$z>TPB>o^ZCi#zy`5B5cC)Oa0V`MMBCSMW<cZ_&9Weq&T=W+u8@J
zBT9V3s&>81Vm=fTF1;|taq$&7=4QA0AM0{Cv^+zZ-`f`!9{9y4epj*Ld{&ZzWa^g1
z+1Cx^n>?bqrBsuy{0g7@_a|@4hTXk+%m3zI-my_nUbFp9=8lSz!&M)2951|Bd||HY
z**z|XHY+rz$6R0z<$j^UV*2x+>Yt?(UuAyvY}>P2J-WccCUUlI^V%<8CK*0%Kbfk(
z{{&xw^4^XGMjuXw+vjv`Zs~igdd_U8w@)W%FbF(-5WChv!cnuW@83ybA?Gd4O>W=M
z&Ogom&TLNbB(L|c3ST^O`1Ut-=`~)D&Yoi-3TOLMs?(lI*uDMnRNX(7KhR)F?s?{}
zKC>RV%!3|0;TuE`+jC1D-I=BRW4>-?8++)-X49)79MLt`o!M_LUEKXZGG<Mgmcr!O
z`5Kx`nj4o~6Mt6hblc^C&jxM<Q`M53(94tLIlyCXi!TK3devZX^n#&!?EEWxlm0{n
zT+p!f`w_BuzSks~2aTH)mQE{K^!E0e%Tw8$mj8VJ-u~Z$ckV8yy3FHLnU7h{$qDjL
z<-b^%KDYgu-Peu_Qr#026OPH6WW@!f?^2L7IBvEked)q2Dv!K5_${8!7P%#^D|Afm
z>t=4<y=~SHm;OBd$otW;HCyy1?=G2H^LDGCiW<CQo&1R@(d4K~M#!O<=Ua?F-khr<
z{ij;{e%0NT`CF`*9VY#F^x(lFsffO7j_fNolz;M0bzICAXrb~^aq^NwR;n(~KTJ3^
z@9B<)I2|KngNrV|trKm2|2rgWlJ$dqidF9p7sE*3{x;|OIhxmepT!B>I6e7A=mp+n
zw@d4H6rNde)Zg~rs_P*_RzfCR0&XHckU`3;;OgZVKgVQw+4S^f=l8yopH*Diy+i8P
ztf;xE`YXSf|GzfdAkOH)k$xWwo3+mU@5S%TT=Z{2pj+y#N3Xu$D-(0ps@_)d?SZ41
z<i&YABBq<4?pg4kLrPaa`QwL8OY=%hHrUiZ;W+SeozJIT4hJXiF5g^wve<vK5~u9?
zmb6p}fo-m!;cHOYnm6T^FvsT0m+zkP5_O$z!^pBNP&50(<Ru*YrA<!U^eH=(`B(V1
zqkez><Yfo{v-I}KJe;>SomqlIq!i?aZ*y7Cw(Go`Yi|B<jgzzy<2lRjYkeNU@{fN%
za4?U)bv0Ma#<#QOj=`(DVJ||KoQb&i{+;$0<*6-wKiOKsBS7UL$PFb^7BMH5EakI$
zmbyijBY1|iYG=^xPuJt_ndWi@99iStl{U@r^#sMk*LoLc$<-fmPo4R-l{IIn@dbI4
zS8~b+kJx{5`aAiTlUDVdJsTIzId{0&*Z1@8doS#{RvWh$DEzISSLQNHG}Hadj%dl4
z!cE(*HD$eF^ttx*xsYL%tFgW6!sJBn3mMa&OaPCIg9cm;TT>k>T&MnW&?uQQDU!#E
zee#+M&mFG6le~O)qSL=l!D(E@|84~4%%3OR)EB+~@2s`Qx95Il?`_K3mUNg+^1}fo
zVKt$9x4+G={}TRfhw$u&e%y=F>nAzA^w?sR@~G@c`5xyFZ`&$Gv+Zj5+1E^(yrl2R
zG0kb(lm7@=amhkD+6@Mg7Yoy>N)m*vyiV#$uW)!TZ)*GDjLqa{Z=W<)PBQRWy>nvE
zC8o^PVNNkN>1GQ5mptaXQ*>_Ihlh$j8aoTV_1M1^-WT=tU9`-n=O-smTbCKWT+BVS
z-)dp+Jo7|t)}K47oP>(Cs_(3_&-n75TYSdj=Q2Bf{Vm@ie~nXW>8=-c{F?e~T`K!-
zc*&@6$}U&e6*#q4t3<@=)LJc0j$jtq;#+(zPVSmNU5b`{J&`N*omIA~VOrwVorl|b
zxy#Sb2)ngfI>NQ{yd_tIiQ1B*=iWYFQgD0$tJ)9M87}rO7>{i#=1@t~3!eRuZ>nSG
zyM;9^tx*>={<i%4EKvAl{hNoWtQ`L>%6it>{}L*!eq_D1MMBQ~`ufj5oO1s#uV3_M
z-aS5v<BpT2%$;Yp)O&h?s^M2oXsD?u^w?Xa9cSif?F-6$|4wAziiM&4k`+(aIn}*c
zxy$zK*|Wd9o;|*_B(hJ$x1qP`;kz|r{TZL{*ULw4zLo!A$%ZuNZ+AW`f(Gopl0%o)
zpOD*;p*i=po%B3~jFKDNdApe3&bcWh*I4$SS4#Fhr_|H1m&r$7R^?oFE8DOqph~dU
zOjT3U<Z^?-E?Bo6l+OjW?S7Wh#b!NUT2(8-&GdC!z0Ai6mD}$e@UiEae9<{cb4p-n
zwqb{vNkH^!sXq&TYnVxXbu66MI5~zReEISq_I;a}`X}-}*0E~-S1@N&>Gdlo-z^BV
z=6vy5CyZbAi9c^@0c)$*ypTKBzpr5JeRi&7ThNQeDlc@Bic^;)-n^@O)!x%f?`dj`
zkpLHBPBE)q;fPu0seM|Z1(gmOoU#WMPi4DbU&mN+t47Ex(Lrj$=C8Z+g}(i>6ab})
z?`P+GFXW%C`nS~m+PcIHITq26P62aDFJCl#adXSB=I<PxiNc}Q_77xZw_lt5xas{A
z(K}22EeKp@`au6HOK;HG%^U&8Q?m+}{h93gYMOwi{&B9h8R0j*-hMpsD)i6fH<I7^
zTW$);Fce2wFH%um`N{b5dXcZ4;58Va7Dg7cfLnMO*Gr>jH`Rs8oYRi1X3$kx5Yv}>
zrK7vT{~zb`fUip5i%xz%zaxF6@P?nqKi<E2mgCfqv&ZZwd=gq}%{O~#>Gwpjug))5
z+HMUy__<#!M?*JJSm%|Tc7Oh4J_qjEh1oB;&u`kSo-yTmhU4M~bE=<Dns@g==IPFj
z><f0k{hj~zX$aqr>-IboR!HmdI^A}t)T~^ZF>_^R=3H;^T;PSkI~w33EUPH_-P5gt
zUQWkfwX;QM-&yxE__ocrxgSI~8Cr7gNslf5_M`T6T9IR}c~|?Ih?}`5H~Ta8E)eOS
zw!CQ7zIoP}U!zvvua>@(^nYsp-go+?lTI8`JI4R3ae_sFnd91Zf8THIlHbgA*ZQ%`
zQo)ZQv9hyIY$#kc{YF4`@utWW;iZ20b!WWKumAgH@zeD@t9N{tOTRd0b)8{olZ(uW
zX^fpsT$(FQb$@0CfY#Z7)&uqSF&#>AJAQhejUuNkXF%cu#v0ant}_1}OuExG4(+ey
zU(q>JfTz?zfn_p}^~}fa_ZPJHb-XKCGvi^?f;H=QB!2NYujc3NbjJ0->Tk@7;fcbP
zOU_wTEa-a>usZab=#z`@-5<-_v(K5MQg2lG=+MgGoYvU6ey%mE9%$<Y{N~&eIV0-r
z6N4okPF`85OP8B4f@UKj6@r6AeaV@fS&ackUONvhI+kj&<;BV4EBfc&*~^{(q;szI
zwi?rkogdanzX?oHo+kWSbEDpCx0+Y>{9<0S-?$%JHvihUb92vLOP0RYo}LqB)AQ45
z<&U50SE8?J9CiEOSmI%1Fk$UgXZBr-GZwgut(C~|*O}J#ZGW+Ed$iZY{C&^f@Z4z&
z|F6^~|7@poyTPfbxxrppni(Zo)Acw(Z3=ifsPM+1WKQwa#t9)czjam1?_JANJ<hO!
zr6plcv9GVsB!+}@ayAcEGG2T7RA}X+b1{hpOs}s<|4mO`z%={CLGKFPG_ws;6M0Nb
zwuzbCy4vI>Egte~yOF4XwwkCt_s^1UiSx$2zxD6k+dXfOWX|daz1c6+m)M-B;Jp3B
z*CE%Qsl8FM{ym$wr&rKfBLzsm4^-BGXVl-WyU8Wxn<;w#V(G`p{kamBi_EIsE`Lf5
z5Psp*xK36-(DcK<TG!7W|5SXA{+#1}jOVG{tF)9Y0y{ljvmf8M=o7gh^4)_)QprwD
zR(EIWnf;%ev|#Oy;|3;E#5Q++5RLx0)3#c&KX6vJkO|kPxi@xBo+AEVp`tmcK40#r
zZCvZodp{Cq6o@bX?mubC3#}6w%mT1FZAajX8|xe_KCfaw#KhXWY>xPrXA>7z7j1fZ
zaPzJ?{~d2U`xBj)v0htG{#%pkR))rNk1jo*zc9Wp%$zH`B{%HL?%OwAUiL)IS6{qz
zPrUr;sR#eRG%wzik-2Ewqv>C-<VyWdT|HUi#&b|@_Re9#%5-6EP%-^b|J23BC$1b6
z&EF#xr!ZATa~GGfwFtP$Y6@O)m{sD#({gd@<gQcV0?X!@^+`V6Am3XVa`;5j&3})-
zM`*v?)Lk*@l3ck(i{!rauMgOFvRuFQ@pJ#XO^T+@Vvbvvp0|B_ul^qIOzry>SB+e?
z-|syx*1hZAj{RGXXk09=>z3I1vyoGMgY%4($!>G9{qJyZb*a;l+hTlM>&GjeDbrO}
zGOPLfybk$*7`eJ&XeF>r$NU)=$7C1R?e{`Hf0z)OzxUjmmZ$prPuQ>g^fUA9s$w=X
z>-yhIuU@_-`9kZ+hn;VC=YN|%RjB#o9`>rY+k9pP)cL;;J0Eaw`E=7~rc*>LyH$BY
z<F`&a`q|f)^S1==hYH=#d1tm9m9_ut@U~A!Oj~`|)<;(p)A_fASey6!Ia6<T$m8ad
zGgJ7lKT4msg<*#7eV<SK3*x^VS!`l!#r$#o78TD^Uax%?34=q>$=$Q#Mwx<-WXYVR
z3ob_7vU`4a0^`56|8su4dl_sPF)ugA<XNGSuH<2d%Xg=BK0Z}d{#|BY!3ziJiQ%&+
zi?*_L=k2aMzec8i?G!$T4?Ul^S8e~CziXYI{q<vPMYqpcb<b(BX6O6s9vN8p`}_SM
z=`Er%%f-*lQ#>;{kawToiD=#PlUFIXMSNejiv4$Stl7oK?r$efEzp%Hc;DE1mB$#g
zAaCx!z=%mp-l#A-fhrWx0EwqVN06|r<<B{1w)j1hKN<ca`qLL-lV_D2y)SE?L<IG1
zPOSR2z?r|KL_WGQ{{FJ5+B(xVU-b@7%hAwFN>AXq{A`*2u>h@@FE<X~Ij~IsxSpw5
zwy%lmzuJE_-K<;c<I^X;kecx6&&9<ItNsfV*+pBirHhM|?mZcHf@7=Z=WP3b2lm^)
zT<p?t>vinsf4g<d>pp*t@b6`-3^3g~Kc&dGWQq!F?<1+w>{Tkzp#x7n#>7nvliU60
zO-R@<%e{Tw?=Q+abHB1y?q25C*m~;StB0NMwnUs3w%)eB;;-ndgm(`Dq8P*Xd@H)#
z^^{L|+Sgal-UQs*JljxiZt2>4Jh3$i(g$Zp@1Mt#w3E?vSJ?jFV$5tiA8it!Uo3XL
z=7XH_Eykmw>v=xQAIeUzpOn9$|JJEP?QFpeJVm<>^-dAUl~5=@-BZEd>HqH5&Tosq
zpRKwTIZN3yX!expi4GF6kW&1GMu`t6Cr5H?Uu$^XrxusV_m&kVXRcP(x}1G3CogZ|
ztXol4|L6SG{&g=ka85w{1xv&3YiYjQjZMO)Sidf~+ZSKAY0;wnoEJJSemH65)cf?o
z8MFOXKJ%t!?5aDmeBOdUG0Ccj_9=JO<t0yBs_<NnTE`O>Au*|J-&Xnh6WklC7G$0@
z_BVQTh%Lln_5=faMz2{pUSekpJtr+`I`btnGxOl5hl{{{kC4Tn)krtqIcSJ#g+Du$
zeemyhMteRcqk9h=t}?aVy8862)#m*Nr=1KotTS#{qkm?*>#Q$M=X^LXPS}+7fMNNj
z_Sc`zPgaj)xq9mTJ73nK(?>p5KR=gPz~pLnDtpRfnQ4#N*33OW_gT`~TES4;7mTkt
zTkg+sefPYi*0$Ta{_o9tkF$&UH+K4YJokHH&%*ToZFRx<63ePz3={X>STg-WV9*7P
zE9F0hplebWF1})>pc16o6(r5^d8)RsquBIIX_jVwmyB$eALZLs?w81|{_n53{~X_z
znxIF?vUj*FKhNU7zu5nL0?+TI>KRjvX31~tm{a)c*8<<Rpc}ttwzV~Lujbc{D_O8=
z(hSK<*16jYZe}=gOQkmL*&K1{t(lcvq{>c{g{)WJ@usf~Ubn^J;;}BHS4%_w>luAE
z$yw2MWYUg6FVEDa&Bd}>phg9_67rhP)1uLO(eV9z2Mx*j5mS3^OuF?((#L(rnc^ms
zo|neb>SY1{MbFDyUTW%Q=MTED`DkeV{=|odB`;d%%-kHgT~Wck@uINFDdziXhyT9f
z<~Hm9&9sB*-kiz?Kh5<EGwhC9bzEug+u>>6Co8L&VWPjC)pUE_#>=xJmQ-=xn)+?W
z<@zamt&&1)uX?OnTqg7~%fa3A)Vm4=6UaJ2P_e)Cg~N<ncPzA(V-@E=d!@3CrF^M%
zL2H8lf}@ugwkv*iD7`vwrlsKd_ZthN<d(T#GxWHa^D(&p_Nhne^2Vp1ZhOC<*HYKy
zD1$?p_0DSXNYit3qc3PUvnt<{JFNI1ZWaS)#!ZVV6^Wd+RT44cJTI<SU3l?B|73ro
zR&M(86P?aeU1y6vT%UU>JhMV4cIyib&n=sdi-W5qP!I|USb61^Tv1QZnS0!94ST)D
zvYolTH)Q|X`5V_KZ8#z-`B$i~ce2;q`qfWY8XUW;6tt!wed+$%&(GV!pJ!a!JbQ_v
zflY?VqBRcet7b};KAsV{c9vQA{?GRpT%10yTx{mz6Kgsq?=F`X_@%GNDXXe!Zkt;r
z<yEBy>h}h|(Ad68MZqVjWKQu__Fknu-9MyX#%<;hKEC~=2#Z&Gp3<UqU$6iCe1>z2
z!<3GqoH?aCjcsS2`u(M8)|%btXP$2VFD#zHy?9-`c$}h&LEBxuIaaO~%dao|_5FUX
z-ocBzGb)W45`WB_7UpGmA-UkGx~F3(i$?2$#VSwJmpLP?y*~bAT7$v77b{K*bIgAd
zpMJin@@lg@5C5dZAB<)mtJ_5HRtZ~b?64~Lox7*t#exZ+XZK!idw;XbIPc)A2@f>3
z+Ldd|26L^=$*_=0yS|4bSwwN}8{awep9Po-=TsO@Se)@W*<sOUzbm{S=gIg@yilj`
zP;1}gur&23^Mo%G8z!lgOyM%t?`4AxYrW7Y$*EVE!qU?5M`HHu<7d7v2y+g(x&QsX
z%3??NZ%h1M^d)T6tZ{7GaUw6#{Fl(jS$dVfIJNRq_8M$xTp}s;Aw!u(|89H0ug#mH
zEhbIm$f{i8eby+8@9Oh;e1$7!%}H~WnCcR+OKE1Q;{}bUUe=1fJ*)54edhXiL)G(+
zMywf1zs*|U*|O#B+1IWv{FB1wlokB8NN&f8_Y;nM+41gj|BPi0_jvxNtYhBuglEcj
zrdt=cW<S`)yV!2~g!3B~T%2FGLD@EOUc-xZn)`q9M}EEbTI{H#T=A_fH8Xv6jvSIY
zxbW50MaShWL$@C<_Ld0ver|5A>3MA}Pa!L>NLgoSPv?b3$&_0REqy`Kvc;3t!`u3H
zh_2ti>2LdciJR_Mo<Cgb{Y~`j;mk<elm}1G_0=!<|32F6wgSuc^OF@noiniYnYtk|
zIki>Ss7C+S&%0)RuNseU&sF`NdV70(@C2T$&zlzn&X$rF={xl|V&Np~FIFMpI^{B}
z9xgfMQ8j1j?0qu3D-T&5vUhY@9qKjdLf|Wgvp(--wjf$gBC;I8^Q9*zY5ZxMIDc+#
z&Y$u{?ne{_9!~RH{qNw+cPFOp-OL@S(tKsFv8VBqtpO3;awb`3e%elXzmj~W{N<Ed
zI#FLGLuAsCdzq$g+Wfy{S1tekwp2{jQ^<;o1F}rX>(Ma}A%U`8EG>O&Owucu+a9*4
z<fcBJG4ZwC&y3&w_k))m4)?sOw}*pG|KY18cl(mfdt?Hy?XC{EpmEiH&BAk!rma^q
zvS!TINZnG#A$3>m<guUo7hH5T6*GBdernzSnjbq4x9j(9ws%nK`>)D;((Sa_8@qXv
zR2D9tGCk38@gz`%1ztD9+A_DjZ}VeYi+KvZ$+LIuiCnj64r^2p@9yNYzu#ANby;|K
zdfc@98UD{xX2tF;Hzu9Dd50&cDoxR$N7r$2`uQEaD^}mHXP>YBd$)3QN0i~`=cml$
zy8k(yIVO2G`xQ&?JnNDZVPZTx#QR^olf1klqG*23qf*wZ(kJ&H{BzQ?LN3~Kl1hor
z8IRLm-Ai6hx)7Kb3Tjuq&``+PJ;^L%%0Zr<IEK28{LVTNGjC&`Yc^I>q;AO{uU~#T
z?{@k9E6-9U&PYn(VBE#usHmGUMLlo6y3H{qR?qZ_Jps{6-s}C+-I+7zx02kZ)JGQF
zQcLrGUf)^FclnmeuUl(g9xX57{dn_O{3Ml5>Gb$BQ#-*^Uf^11)y0i}8w0dXc+4-q
z``^UePwQpfZpVwDc7)^eK$p93-rN6Qa&(>R?y_CX#*QwluP~-9n7eu3i%$3d!X{Q_
zTQ+-a{qW>ntWJ`DY5&XQ7?y5@$S>kaj*F)SWU*ZdJ36Plok7=Y$}6RbOS0`M`uUt^
z|5o>$^d$HbYj4?}7VvZecpPAln!c^A$IkGXpLjWxS3KS+SZ3sR+cvo>g;{0YIrE$v
zo4IwT+xI@W>9uY7RZh$0n|D0;_gg1J#DCdl4`w;$r?w~cW`syepLld|R_ivQz?6!A
zm5*G!1wTzq6f92dkXV{pcyhBp<FPd!lT?<<Sv^})Zo>td8p{Ijcz7CSs?f7;iraA;
z=0n=cPWwzbsFPKEsdw?8%i?c3)6<y$mi}u92#%aTk5|<-$97}#?%S6<k7#rs>D{&d
z-~0s^d!_HBuQ)r;@euF!E87+X?pd(*eg1lnNh+FGFBXO!XNFG2f#-8`*$;_4J+^b=
z%XN=07T*4Te^&Y=hd?!fTSshs7W#ZU{Ml2o_ti}Mpr=R9$vSfCCCH_3nAl)pIrr<`
z%gb)qbk?)<`pt5<pfO!d^jM_Ijmfu^(<8n;D&8jKYT9q-lA!5sIr)XE=cFUOJ0<5n
zkP@}xl6@K`YUSm0Jo}T8k;B%Cms#wGj%dBUxpt|~^GXwQ=}8|C9PpIU&_8JE^g-><
zoE)o7S*c0>FQeDb&Ym*yi(s?c%J(~^1^usGEBbM<G@CJG!Nd!*m_w(AsNIxOv6%c&
zIJNw1z`Jf`&q*zPtdgFdC9nqUQWgQX@KuW+zd7@RNm1)v)#Xp(^H-lge{>gT^T+sC
z72<yL+b(nT8|vIKDJ!{n_PTYuLHLE3xjY5m>je^nT6_B<ejVEUpF_&FOvfPO%jNz%
z=?hMM&%fWS=V<0RNyYP`skQM`?H1TT{8BD~WmZ;VQUYq7TJPS)es%bNYG3)(vfaHm
zL_a4wwVCqs7k+ExFKpSg@6Xcb{|kS7{eQgPvdi~5pIpqJAIkqDw=cNZ#&+%FVl@t_
zzc1O(msE7M_liDc&tCQVQ?cZ<6KkBbCcpYSS;cdg%Gr}5r$J32P@?hD_~$U=(w&Hm
zokk~DPAlX)d)DCgv%=)Lu09LR!VCQUwx$1HG<)6Vlfvy{`bF!*1x<EU3cucJyv(|L
z>fc`myPJ+Ob8F=;tv&u1<fEG}Uq;HsCMr!j0$wb(Bk)CqZ=G9Pd}Zg<UoRpioN?%w
z{pHU@WrOHi$9bDQtnbe}_E#r~_wLWr{tgS)p5Je{*-n3Z>fb9TP2cbT+@E$-u3Rp1
z^DN(lg==s8I~`Xs%_upt-+G<Po>eNIlT3t};G-T>j<ie^mE~Bh?RwF0X5)kv{@D++
zHD<ln(c7_JKUg(FB~K*##mZYzPA=ci&Mi**y=}jKjDls`^MAo>>wcfreY`*B)0M~1
zbX>nZIpz66!*kM+C!H&PT-SS{0S_a#7TE=Ro;V)gdD63a%GYlx=M5B8w2npUzp7Hc
zTdN}%w=3o3<o>yLwqEY6`}z9M&)8t~-~Oim+j{!;*DqYG;u%!OcHr7c(AYkxMd9fn
zvF?id@f%EvbHe^6{O6s||Ge_#+wCIv%Qo-kxe;J;-k|@>#Z7T{@331Hv!1Tnwq||B
z)1_Yz+ed!<)Gb<Db@cgFPFYpYNnAz;H!PV5tq{DJ4qb6MZs9*~g{0Msn&8Xx)%^?#
znr622Oi6J1yOH;GBqQrg`-@wOjxKVS|0LsjLF3}$H_rBnb58o+(eRv<CX}{ZJs@n7
z_Z^Kq5vx@f1BC?CgsqNMeqwp7`r=pf-&y~Eoi_f}&oDz*_}ET$fnCjRl5zKI9x}~s
zEOavhdytO>)a&yE7sJaYv9uUE9&b9c!@V=;qq2U9zu&cW_v>!jyz8F2o-bJ>@r0rX
z+j&!2HmRGI&(^4xOi}T4TzpejY2ji}Jqyn1als5sJ5|(r{y*WAmKBWUez&*1Bd}q@
z6-mdaITr&bsc4!nZf*#GL=Y&i%5yB%K6<h6-d9alX_nqw3w|E<7USOgNC)J$N?Gm}
z&|EJlq)MjT;%m|D>09Y8Xv)v4HX-dF@Bj1n<~}exC&MUlb*0mW*;XI+-+ZQ)G3QBM
z<EFEA!C$t-O#0FAUf}P6RY{DiqWNT1_ui4_xET22MDGiZ7XBB<er`-S(D+@*+)K(^
z?&^h!(mMn1NbqpT&+99G$fDWUH|g2wg%|q`6|J~rFAB;w8Z`DP3wU{!O!-nR&M$j0
z@I^=8ve4NL0r5=+>Ae9??w<9of;SpK+w7FB7ClaU^V?fKbBT$7my`R;m9|V5CrV!w
zl-(&P%dF6|ompU->f@8zozhF6|I6pKXzv3#Nh7akt8B~f1<9wP!-TB7k~8_u@?6|Y
zp13VcX5x5%t5-9gLv`U|ll{sZ7X=~Kb1Lj%wo?1s6(D5gmHqZ##u3mY50~skLxw{^
zi{5tj1z(Dl^n9W5_hxB*OR`hR6Soo<_mUcYfp?vK!SBz`nygZCC0M4#v&03o`|4xj
zor)Qc&fFH2o$R3Dd1uA*e{WwoyO+4Q=RI-DWlP)>yYr&3v8v~b6&qvXYeDYq=zFo^
zt->8)Sy?GxFCnX}Rqu~jf*kDPZkQ<2!kKqw+2f!+9L1Ab`gWOKT&QeSq-@2-ar)j1
zi|ci=ySzguwe&f3^t}L?;@~hNu3CU?^`s?fc_kTN&d)#E0<z#l?;Vbo@FkB!ykeSP
zXn4N3vEg}<V*H*Ot3}FIT(YH0g&bFGEnEKZ(yzXSi&YjrK3yiTNZEXmvelx+_m~dt
zoZ?~4`p~uc<AuOU7dHAn7IlPJ*3oy1?@+~M=B+%nCmMb4cJxhZ>HEC9VFEOEL|Gr&
z-Q96znnF)|-=rhG*Oy9xZ0nL1W;#^8_;Ji6(~PLlOL@-6_y4L{0`k-13xXW)SAJ7i
zquN^bLc_D_-R}Ln@*&QjA!Nn$kng3%^csOhi&frkp3cqDyinO{QF7Fajy{JUI~W(b
z9^a#qsUv<d))W*mF7A0Q#}5ac>Yx4nZd4_|tnj2IncN(Zbko{*ohi{qLBz@{X!W!z
z)^ml*5NAm@6!@3KaLs<2axrkyEo)v-LOt61LV_)^Zad?lc{_rf+&!yat=BdL#iNMT
zqGV=)XY4KfQdV9?8DCcZR#9^S#c+ws@ox%iOhYt(FM0gv!U`QLHPy^L4F(ccknpq%
z;8ft*5^c5aiE_yqk4qtXTXx5R;td?2?OU(C-^y~US=xVUdP<b3qGxgL5<5sz%L`#>
zX)N<RzV+LbNs}%FetO=yeBXc1d^S0d+ZQQYWeIb9_jXtC@qD47$#AIRjs&ml#fj3a
zEiZMqySgi!@qD52a%cZ60a;-ukRur%`n@>8IZ4`5(=++yyx;$JGJd{bXbQ4PMBtvO
zETe<d@hMAQ+AHuta#Kg&3yzkzFJGJ&o|JiY%95RVY>76I)LHW6*x{Ae)<=J>T&|ed
z3(7mE*Eb1(Lhj;3X;Jov-@Y*&n#Jto`9dSMyAqTRK}nQ>Lz=ZE-)oYq`^%;LGbc!2
z-01n@L@(2!H+dp0e7#;y?oUmoMT^LSeYUuvz&+1~m#^2$Xzi*w%dFWKW`;uCX~!Vj
z7$9V&wR~rZey#k=pX<OGtR%#WqcpqSO_fu2>lJQ}$46gkfRwwq=h@83{<~%JzRN%7
zIcRiBUlioHcoCGomCd#I4!wQL-@;j*s=_H-Dz%Q)36g?Ju9OM9o8D)sFh%9^DyhvI
zkN3XF0H+|1oq`;yoU+BUyvnT?L2MNfcsI4rS>4mgUBSh@#ANL%g*hxOD^(i;Cbjgv
zo$YP@?Js}T&es>f<<?ZrLy12!{~r{!nwNbp*<;cZw{xs@A1??(L+vpr)c;yOoT}{U
zbX*r?9Jt_G+Gubsw%OobX7MByP`Lw2PK%{2U###|a5;WCph+a>wVS7qmETf%@1Kj*
z<~#<MPa*<s&c_#4{|DvU!gb;T$DG|uM69-zFK!T!_5XV6m9x8N5VOFd#gks1=zXD~
zP~&4YukGL6()PYdOaA}q-B5E^f=9L$T&~<;XtA2cvTfmFm6z5EJ;!@NaR~~I{qH^`
z&hD7P?36b}<>=dXu-cBk7dseRKAvmN>e_T6aFWUNeKUVSyzaX?OPd1}^nsHaAgM%9
zR({1>1()L@f}FCdnJaHQoalYA;`z5iWh*8{^E4SLQ7f-YLAzX5finBz3x*N`YV0jl
z9#&qLqIU0`^50xj$UN=BMCqfw2OA8w{$^UZBXE*klYsy<vn@)N7I<a$&qlFi$`T7E
zP)RQ+d-39ytR;tE8?YoD>Ytm<$I;q1X^Y8Id8;T;q(5;h`NMIj;6;R^>kAFd*B3Ib
z<Ulf~({YD<Mn$W6T8$jCs*H-DlCenHYS~myr;-+~g^QO=x#kOsDM+o5!|#;mvrAjK
zaPg9@FQq_L-cCW;i-p!8pR1Nk33`8u1(Ir9+)H>GK2-eiJiOt49$$-)m6yYf<Djy2
zhcL*7S8o;m{Qmgkaom0`+4mnVtZ3;If|tsV6z<$xcW1_@Z&O?PE=5T<f<yD}iHB~v
zOo>*YjA8EeI$&CqeyS%wC|%VSxwtF19RGYleNUL`!o?xGmtM;)1eN^jecTxni`GAU
zC)G0PLSR(8ou6aLm9?N`9_a8xq2$kmqKptBE3d85*?%*=cV7scEcBwIZ&$9sqQ~vY
z=cE>@EL?moN=c39STDE+zgT!a&*snLia%xcM<&H>2G@OS6+nftd&!rRfsO*loR7~D
zpQo~Lan^m73P{ktSh2lXKz8!GQyxNATJkMF^IY5)Ca(i$P;fSbc<myn(XjrB>7hB!
zizl`8MP-XZ<CrONPj<tGXEyUxIAud$e~(fI<!xEvN5?W8W<<%fFbjAInWue?6*vZ~
zwCBt4|F@Cbuf?UVy0=ut^F_p=4~W=kDyVkQ@N_!flJ)=f8E5xyP<p=8(YK$)sl-NJ
zR%)tB?XBJ>a9Epi%Fb>UkUj5wX<?wJkkzuHK55_8i<GUj?)Sb_cyjFe>ZX86|E}JX
zeZFO_E~Cu3b@PON%PgN=cc||z%dcNoQtuY+T(x6iqv8xd-uYjI|8HpgtT|8e<s!EF
zKdXB;gC>AMfwRMg<Ko4qoSs2p_8cXjE!1jkWn261bo9OW!O^mdt!1rvr;6tCwDR`{
zJj7pUl$e0Dbo9;MdF{AwdThgF9jU1*so%K-z@;20wAvgb_+{TSJ9!4(%6a(B_lC1O
zs1SeRcGR(=R{m~p?dwl1Dx9DOQSl?U5|`sC0*f98fDO6wXT`}LP^JF&Ne8H*(JscJ
z>dE={`@j6(MV0UpP|bYqS3QN2N~cLvLWK<yElNbJp6wKrWo^k``uN4C7M0AopezEZ
zB=5*%*JfPX8o&CUNOh`;r{>#5Esxzm1@#u?cIo--iF<zDKe_1Q92L*A->TLwgtkQH
zu_qdoywR09>p5u(FSL-(1I3I;b?T)_D&20aeKWyo1r|MCcuRZoRF##Y;7UZ<Dy?aP
z^m3*aPtQrS+Fn45T0suumljuFxlWp*l6if5?vmN+ozfR4O7mJRdi-ol!^#VS9G@qv
zDD<>|8<ZV=FDm#BRUGGD8GljJ$rF?jK}HuTTe&$(aLBe_d)hfg#q;)ROGpu@Q4+(}
z^1@=5&BQ4xnjS`ZpcQx*Kkjwt=v#bRIMZ{|tQ|Wp1cG8R<3eGjK+)rnZgEeqNlX4k
z3cPXy6|Eh8`x#qayl_?WJjL|z!nX5QxMhW%j+eIdz1ShaadBh5uGCbOr40queFq{S
zvHs#j@9f*_c1NtWw|=>_E$QM470spB8w5a&<cor`qO6H)*bNswPIOh6qQa;MN(_sX
z&9%4=IlQnC>vmK1wB*g5ywVO@1hP1l%xMgmG$mv{hZ86_E|z0DRAQypd;ydcgK9I|
zgXT?RFax)AnHV3kFL}K2+P%dtlcogTf5*4fCYPhF&*^x}g}}yZtWG81<iLNZ;6(>G
z;db=R-o37RUvw+GEXWH_Lzom|mW1vW1T|JJ28K5n$SL`4eS7+w_}2fGcg|k&oK(X4
z7F2Zv))ifuq~LP=rx3^CwTF5qsX&s_!pD^k9eu~69({|R);CFIImcs$-w!}ePWF1i
z(ek3=&90{pL6w<9Z6v7l1-0~d)Cm+NbNvL>OH<Nxo~HYBK;ze8hQskh*FW4_=E+)4
zTJn~e_3^^Rj-bX;p3CvG*Vpa7GB?iu_(qe}4zgBW;OH+>wmRkC_g$f<t*>#}t)d0%
zLsd1GuH460@!~~xC@6H2Wm*<q_!z-`cj01{r6n3~cb*l3lr$m&bxv0EcAd(3p`ocg
zUHw?lHF0oaTHNsA@P&`IV!fvpELLGuG?xNJ$Q3Jx6TQwi1I4Vof|xi?=V_&ifD|uU
z++Z-Vj~&#EJ+&f#d$8um83K?{oc+J_Ze{*u5v#tfib|3tQ>L&V0u{Avpn9OOVE_MA
z|EV2)2h%{=WzwWsUe&GN;TeK?Ve%Sb0WMipRnvW};C@3#AJd`oHLvYBW#7llo8ai~
z=_%_q`IJqGi+eMuY;@@8`~8<e+R5EhQufx}`A5N>mM3nE4}X6>zU$&s&ZSSXLp^JE
z&(8Y0JgB7)5-`VE1QtE!0M&MqUsJ8G|4O=iA5^=8Tj6>8-hS`rI?*M~Trwx?^-=wW
zi>CzKl-r%R&Qu7JXswDKTXH;J_}F-ELx9l>4OP?YvxLlxl&#j~Ul5cnW#v#__;{`B
zVj(LpPv50;vwgWip1wE{R6p)7o14D<Np`5_Qs=X5pe$hZD@s(hQ9w3!-h>N*k(RDI
zirB#c?&4k&W6!a(a7}Ocr}zF&?kn|o?+k;vP$2En#YKUhY_e0gWo)_TeYStn`cPP*
z@&EVVTAv*zvi%MkoU&6{4*fLZczo6gT*$^$27>CoitVu<L#DR$d1bD9%EbsRm>(~H
z%_YF*e0=v_*Ts`~thAPI+;Tk1*clSQY#<lvN`dvPxd}=2CE&W;`DUg5zkezV7xSfV
zFA^vM1)uq%$G;pq`t<xgCOICT(#Fs31gjKYGb@^(bI|a7G2_b0Yn%K0VWF9~Z@=`G
z3m;Q1u2A_IWx6tX?ec8vx>?Zl@KLViV4Sym$)4A%md{XGnCum-8^~CfWVHyIFYeU*
z|MWCdP-anbL+jmuZRfA=cb=qDGRI4}{I2>^aGA{|d)`q(|AAY{pKE)04pr1zcusOW
zUg!v_l0bpa+H$?MFZr%+2B`H|(i1<=V;Q*BUj%CXS)JP&>s1Brau#abwx3lDDlS3E
z(R>@1`MgOE;NIr;t#&0KzkqVYvIYU!_q!%JS(HpsnY-(qS<u?~(?Dso?8yRUtADJ?
YYdk-l?63A`U|?YIboFyt=akR{05b(QumAu6

diff --git a/frontend/editor/public/og_images/view-pdf.png b/frontend/editor/public/og_images/view-pdf.png
deleted file mode 100644
index bef62ad513901a1d8b1377786226f424fe14e008..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 52283
zcmeAS@N?(olHy`uVBq!ia0y~yVA;UHz*NS;#K6FCK<N!P1H&06PZ!6K3dT3r8Po5S
z%QSr4JKO8Ys_BP4nLMKvaz#7XI5->}5(=Y}#J9;@lUrkZO4Nj_UBS^wK}jR`Hdl)8
zuF^?Qy6(9C)t`PRpIt(t;pX?xANO=V-~B%S&X4p-DpQMgx~;roW$F1po1sB*ipt;D
zV)N#yF(^C`@S3z`#`*PAPrpqwW@KP&516#%=);G-UQciTtYl(h;#sKT>D}s7&%HTJ
zn~|Z-AYsyyqK!Ku*QUKKV`AV*JfPzFbmGLfQE!b-3o#^cFspe+$w|M?PrNS1)S%ci
zQ|0CKk00k&?Y;eSNdv<HkX1#$zukNF>g&}|E)E8e*;99y=O)H5NH}>;lJoc5muFIS
z{ko<CgF(wA72BQl|L^{)T7TV}krCwNmA^hD)^i8@FeGrOdRAGPZr#6iY7!HJvxeuT
z%`aaz-@Pj$3^r%p`7?h$KJ(?`23c@YtgiCE9V0_qz$B3kt&NT1n>W|j{+Yo5(#Cb;
z(1Qo3ckaC0+{^;f8FWK8M@~)+>`<mKDXA(``~P2GXh1X<b4xG1^z&mO6UbD}grza-
z_P4IRd>NwgK;53w?6om@^XIBUbZ?t+K0ie3{<-tQVAnE6Yl-}dp0PEG6Xdfc4Sz#)
z^1@a}?w$*AM?_^x%I>h;XEs4io96ERJNm}fR<K^f-<35r%j4dcSwS_g_3?SLc3oV2
zEYz;BoyEsN!97Lg=-cZjPhRhB(`5mB@7Ck$@AuZO|6aA1g@HxJ$#c>?n~DT(Mum3*
zUX#AuzH;T?wJ;`zB))|zp8oQ-RyXeYGB})3oTBpb=9e$;tE)K~l8ivHFn{LH&u?$D
zfI@J|hUgzp54W>`(}9XE56_+%b8YY4_h%3&;869v1PRT}{_}-Ep*iVLUgGB$8jKDH
z6sM?oE?u}V{PX8{`+7f!;vmiG*;BmMPM*vHPID@M3qGgSbKg!+=VV|4xhU$)^XsRc
zcBdIb^>-gWEIrlhT9zsUhegXImCTg^8(JBT$U1pW3egiYUw!q>BPFQH(~B41-g+x_
z8cbzn&YJzLvC$l0zj<m43tNA!+J4#dKz-2iyLNwO@BLhmrS<yv5BpDFbbYEAQ!nUV
zOD)@I?sol{nB?_)2_YPF8C{p0WC@sHC9-jmuxnvyEPLgfj^@4Afeus5412$Ce{%D8
znkR?2M_$q7_vLo}H&5?uoxGvguK1ko{%-N8tZb>`O?u1JiW%;9<hh$KjsC9Oah+R{
zfq{Xc%zx&kkkC{kso#PuAA4r>v{|>W;$Qp2?(lp2>VKchw>xZK7rS%HlM5*(Uz9t_
zA$l$?^Zm@C>mu+Z@$bt;FDHAPv}swCuV%l-{&K%UoPG<)*b_XQnb$JTq!rsYDa<*Z
zV-n}%tH%D>;Z?cIES|PHmXB46EDQ_`4%g1il*v|XQed0AF70MgkbZxw9KUs-;yxv?
zAp!bPS8iRn(67M3ZaCXNFT(rM(}!~+gzx2>eOK=2=K#C^lasT2+`c>g3LV<Tu6z4S
zy2VYNKK-WL;m-+?o~~1Q<;IQoO$r>B)?Q8PvU}bwkj7>I`qI94-?u6VIDy<M($>0n
zM=5u*AWLDMpL^cZV^237soV0b_|0|8&B~X!ckSK$**Plh;HeL5UvEEp)ja0Wuc?8}
z8<#vP`0;D5{rcN+AyJF3zplJo2r(_{$E$O)Jstu_G%xP0-~at{eQ`o_rQ_o*+w%is
z9ltGq^Y_ht=cyW3N=rZPx@})ldY<pEWx=PIw!cS1{dR6z_K#`iJ%x35Gyc7nUi?hg
zdeYkW`^vI=PNqC^zwgMw$iToLpeit>rG5XtYVpTHERxCZ<W@dCz^47|{L9MU)AEkT
zacDa~4^I5Gu<lmXAC2|9_dZBiy0u@>G5FcVIS+5F_nBOG##FNClh>NtG5afzZ}UCO
zx@RpfI4UY!rvyaoEKI)r__)Meg%c}+x7YQq&Ykd0KlPOB2EjvL{Qp<hd|eei^{IPZ
zjNubg^L39)x38Y`?UvTfv$xB43LZ)>{kkoe%X{_DTeG3zaO2;X%>O5v6+B*^$&X#$
z^m6{+)t+Z_xK4R-ytF<1nR8=Gb6@L*oU#t#`^$FMJe^flfAidrEvB<Wz3Xq8<a_>j
zwBf7$+Rh&DlWSJ3t^VnC`k7Tqq~%Xl9uxK#3knNe-zv!ePWp9d-MYNImJK_f&dZ(c
z-5dT}5S%Cu1cxLQ`ntFr-<&S7QbCz(5nsrz6KtDRo7%sozYu%V8er>pZ^qW?Aq5eN
zXSlf}e!tH%kvhG)kM(@4r`3}V&Cebp@9k?I{m5D}@mjj?+>d*kkJZ-hYCU}|V*7fV
zlBT|5<rb09q+O-W9WO+Txomzd69849hD?r|BDT0|-CI6EwbP~M`k}>ISJ~H!Jr-?A
z6_|CTxRqCK#uwM$&A&@(zd2PHRJ_`H=<k!poR$f4)jj)n#I3(CAn2}lWK!p4@hdWx
zPaQs-kiN;SxODmU>C03-P0NqGTc+t{b!e%;tTWGUCC@s0TiD!9Ekxe(rLgrW2T;0b
z(6HZcvCtq?=hPI>t6q@{_wP}<uwTufA#uIWBi_xeLY$e2;%^fg6;2csw(?%8GpLn)
zTT=MV$z%B)Eqzta6wQ_+67?Uil$cgar!3>@pKo<K=HNjkA2*Jj{mF_hH6CCqA{HvR
zD&13_`b1;NZ)TCFkEbrF={p(fvG@7)>8D>$nzZY7X2_{n0T!o-{mPe83@%KK<Wjsk
z?LyAoBOVIoPCvf<JiTD$=bNh)4sV(1ZGFFf!*3?V76B&?1_p*5yi*+}Xo$U?){*&2
z-(ORoFCfG)xL*08L&KrdRcd|<E#^+U_Pvp<U>$Fh1Bd6^b>iYi;c3b(TUyVoKgs!|
zPKG-%E|E3!(u)O~>dM0IJ(Kxhs<=dTeaOB?fAV{MujlQp_<1YEY;(v*?eP46WjkMn
z6>G0FZ4qE#V32sa$$!?b(-S;(PTS2~xqoA@-M#zT*1GrZ&);&Pbm|&G7N;Hlnw4cg
z%XcYME1sEe@XsrcuT%cJlf=G*eWrr97X`hutypvY^~r*5$KP$btyYsf<*8Ct^TT_8
zk1s#>XVzN1c^f~t-!A8S`P3mhX_D~__8U_t9+yea`179kb^96pRWer|y!q*U#{c%M
z`=M84;`eIKGCMlcF8k)ZH-F!>PKayUviJ9b*xXmrdc0W<=aYY4yuFR@S8PUf$m{49
zogW_^JWWgQ21M_?^v~8u-*Bn;%gp>cc?;S4=i6<sUGhI}KR921V4v~pwzBBuP3LRs
zD_>fqni_w7&a{e|c@Zm9{@XK04jd@Hd2`phJPU><i*OF^<-S$lUns`*?iC2y$vw+Y
z<#lnl0NeS<#BASSr+x1)znozvZ~tolT=BHqIu-A@yqV9=jCVKL`lGZ!qxj>^g{yO<
zFX-v_J^!^x_>!*ljU}mKJW-##ew~WrcpSVb=XStV-uB5Wmekl^C=^O#|GjCFZt(t_
zw;oKB^>m(Vlz5A2lK*Y5zbv{(zUqPsq=uFIT_#@G^k(w1e_c!>Q&lqOOjZ!8Dz{f>
zWsTL)xL|zPj-^qculI1`>6tIf!<>Gcw9g9H+Z!6_cIvs9qRGs&W$_9<UN;VJDOB()
zS$8s}s9T`!|Knrt=G~L8>rCk@&}?Z5`(0M{;(TAd@7KmI$GaY??`7v3y}W%iWXs`p
zaN_6?;?Oy5_uWHvXV-t--)q$5KQo;0sC}sHG0&iJ%LN8qmt$fa4}boU`0Sx2cE>iT
z+Nwx<aZR3})2jb@;oh6Bu+KC*v&eV1ZmHGW=#~%N`C?1oon8F@v7X|Vxi2<bH+vn*
zvAt-Od(G(EUKWslADp$`mvTDu=JK<B`f_e!!Ig*DZ<uCYdip5o@bUf)Oe{_oK}LV<
z7QWm!@!q?$bJL7$zjG=27T>(eAGOtDMQUj7TxP{R#oyyj$(cHCWy!sLLA&gWa(2et
z=MgOvG;1HaDW-^3Uiw@wDq|JW%-%oG=z3<(uEg!UCw2F#daSp*#O%z$$Z%k_<HG$P
zdwzdpzP04ab-S&1gO{0vhR*D9+rh}Bn9^x=;s4j(*Nb=D-F>|Oj$X@_ol9f?dU%HO
zXH_~CpKBB_x;STV#_eMt^%lQry}-C-`k7s8H!cYkyr>!Sc%HQ4lG^fH)>gW~^^!YX
z%Wg-6XWK;7oye2EweZTe40cd(|6pJCZ<4FiYp41%efocvR?N9%Zhv;m%HV~q94!-g
zRgIf=$L(EGT&dNv<#=c8-w45dQ}vxZcHa$1zO8E;tJ_jMy(Rd4<o6|adDAj>2QK41
z+kML{;@jtEj{SdAKPZ7~g?XaCR;$#0a?@h|Tl=&590%vlx-S}A1R4eSj&^Q+*tXBk
zYT|w;kBz%)H45LlZ7$v1-ajwss$;ZA%N>oDEo-?&>k?)aYPKY<R=y$f;Y5hI<-Y6F
zWKV+Yx<8s<j=%Zw$oPoCRP~yvXC#ehnM!Rgotw(iC{XvQzkB7$zh~~V&Tlm^vO2mh
zyVkh6())F-S$M%>fw<H)SD9N1oKyDX8sGZamgykMoh!XU=&~ZH`D3&Bg1qt9=a*Hw
zU9K1_RDa94<ix?uq^Pp#NFBeQaXsH2@k6ha)n(tza9S-he{aRpnNB+jZc1&w`Nq;|
zho%vu(~DdN1_rLbjU}sl-5RY-wrpL<c&p*ZCV^-E66<sK`S$L0<EXCwz07)Dt3m2L
z{n?Ao&)e^^+S%5Nqx^{BEjGm#0V@^;28T5P6O;s_-~V8`oP5%*H76jw>5r<noT-_U
zoPfN@p;H%r*2=!Ua%pzUgrLe7EVF|ujK%&%gp{pVz5BRxi$QWcw1`jm;Z#30`Nmt}
zH{azqePY@2p)gojgz2NKqK)j%vn#G!zmD5g{ywT-_M?E}k|WF0HWxab-rX89`9g-t
zu2>Gww+bzwa4yi*_`>cb8#a%jH8D{?|Ngfse+Pw@Ssl85djg+dRzG`nYEJHi6&l*J
zzs~h;y^vxQX!vWv%FmHm5Bsx~tgY=GIA(&Y%7UmD{mcG&gji^NVbAcssv$O?Z_9^J
z?{4vGCMLx{weRK9@3zJ{rmSx|^7WC^s<Iaq-!4U-zjmi6|7@D5w>l5^{blA73N0cW
z3(c7s7&N}HKWaT3K93=g$<ec7$F{AaL53j$91Bk-RQ$T#DtI$tvXyy#l7cM*yVHp$
zzs_3M?>IZ9^01ZS-Wm?YFQtk-pFS5K@MB<L&}q9k&8gnx>-5zhjyTmTges-|%xuzF
zxS{Crv2E)93&fh695}x2-TU2ixm!xJc<`jns!Y4Ar#qc^^0WJT^``IjqB5@>I97gO
zZkfQOn8JNUkb&Vx#0&nE6H6BVShKM8?fH3*1_B%lRrluRNB3RnJHh6kdvC+{&Gnbp
z-c@Sx*^+;2+wpfr4_dA;IB_V-$W<saFj(&s`B=8ye?eH^vQI1lokvXt1!d3AcQzJ~
z7eCb3&Od9l+oo2Z%FMT?mY!LASEI$JEcFSmYRmNXG0g%_9FYfuOIa8gM1C>1GIG@%
zcJK94vRoBZy0?<~rbA62$Jw;EXQkhSPS_E)WB-fUCrjM(S~e{Cv?2Cv_MW1<yJp@?
z;F!1jP@cE%UsevqmI?RYlyERGEVv-QAW1Iy&$$MPl~cBC*u9qbRO636fmvUEsf(ZM
zKfxwlY;?8JYuDW6oQkTJy4Ukgzfx8QB|d%jR~!t}YA;=hZ}WL{y7ga!*MpYz!X3dH
zuO>~Zx^;W+J#7Jwh3i(ozIResdDFo*i_m2+ig$@mcZ!HB?O7@yr(>V8T~)SSV3UZ`
zq%1S1A4kmvoK`3^95~GNm(ij4(79i;8ZDN7Dv6TfoxV3zOMoNs_ut>;e4+g%+%v!U
z|MxV16v4qSd-cZEJ>1jR@nlv0_>s9=S39fEnIn=b@z_46+iZcH^*^&pOG__1+Hods
zarj{W=g*o>rVnlmHg&J`165KYU+_1WtUR*wzJtK~_wT1hbvSUGeD|t6FMWNJxp%j=
z_?g7KBO3)SNjH>zZQhd?aC#Eg?{07ZjB}10kz5b|J<__(Cav^njsB&o|AP6g6Kn(A
zS12>oXn$dM*d{YoJ;o_0;la)~IkEoz;yYNF6ir@zU9P-6=&`Z2Qsk`%SO5NO4c@;j
z_>OAJ_F2(yU%3~$>Rvu}@QqmE=WlltTMaT^)l5FgqG<E`_4~5iouB`*FY`Tk&`TZ^
zKvx7A^0@zo_Ez3hXZY#0^Yy+h3YCXixLH}N=JxGZYINZEeXle`Kh8z>CilblFEf8n
z3Ceo!rnrQ)%Q5)b%~$RzC8ril%iezMhS_Y3T1Wr<^`)CXi%Y-#b!IPnzhX<s>-%}n
zTk>yIzIFS2`1tu%S+8HPI&nN)(O~W*%gFUNvaF`@H{<mH8^4#Y-Wz+&vzWN$!U1Pp
z7loGm==WkZqAq7|a3}sfcY<fX|B8*(trIrYTov2B?E9CW-phQwUo+2ox;gjT>18h*
z!*>_%KDzGw1-98Ho-ZCdc|^)=o5yFRP;stHQ}Mnt$HKk<cLtl)7vvdC&YwBEpa0;y
zlapt!TIJ)W952GuC}5XmF<n<QKzf@~L||FX*HyOj|1?KcH3?i=GbPq|=FS((yIv)y
zpN|ic*O+fsyz;IYuecuny@2J5FTb0jY*_C3<J#Plw-*IvY?_#J%DnYLnYjFIBf0zM
zxHsFzEw^M>Y_W2ZZOj+@^?6F_e1;<&t#kfzHf&iLT)Ci?qvb+QUeI%+-OZZ>4@s-C
zYd<@i1hV(r*OzJS|IT!<SBK?ynaw=AO+036-SG|2>ttnK&35v*yd>Lfb=#|Hy4I6=
z+>|*NCVy`eDB_PRX)$N=<NjOu?20^t=A7_(43hV2%m2Oz%vhMt=HzjD_R27p%MHB(
zW>24r)ku2q+IVqjUeCXm7#Ev-a?ktl?OV%l?7j8YdhNE?-ij?gU)Y%6%6z{2XMe=~
zIY%FE>DRugV7fuO#Wy^^a)rPumL^A+YGqLRbXaK5a4GfON*hKaXQx@FQpUb63LV{>
zzi+PJEOIDs?Y5e8JXYu8IP{mP8Ebpb<+lBHqrUu8?}MG%5w{++ov4VCdbMNLQSr;-
zMsF2c$}WFgH`#2G;tJ!L^+$PCTlC|zE0tT`bh6oPjuL&<0V;CCk9>BjX9zeeWd6^w
zaZTjr1+5*cCySf(^$P6USLZAH!k_&n_rsZQ1*`4Tb1t8J;?GlZYW@AIcb%`Q)x~YE
zJ+y^2MWKvaB|!A+vg|d>R>keTw(Pk~#Fm=33vM1--{d@f?X5Xms^wb>Rs@Li?&3Im
zf0mEhJ#NJ-g0DDApO|WVVL!lFA2P4N{*`NYl(f_X-Hz@<KEEsl4qX#IZqz#eq98c^
zJb7+l^}_1KQkUo7ob&VLL&f(Lygc<WIDIw${3Vx~!q?ra`Shjrt#orvlG*J0rTgl?
zJh9A;{<UrG;Wr<YI==bNzPn4rhj|~D;vTTA);B(~HW-D>`yc@tJTWs%deC8EJ4;tu
zhI8S~8cXB3mWSLp*30YYaB?nF)^pulD*XSqT%n0{WJDCNVvE%ySNDFl)_)8iSYOm$
z&tObB(|jU+)02-=wI%G7{Lbv1T<Yw3eSK%4d-z|E|LuDP%$}t@Wo6xQi>>qbtl+o{
zKRJ94$XOQ7y0>@BT29Z)ZQ#OU;{OE~<o`1&IJTS;mUB;xxX~Sb?q&_YqusX>{!pEH
zD|HVBap*5mN%LlrxskB!L2zw8f4`OF!q6Qd^XmR?v(UOWe_E)6bzj=5?nT0vR{ANw
zoUhBd@@9!xi@+<6(l5F@V!n9>*H?P!{7zwI*sYSpG2?jF!`0U11{Yk8&1;LedP8;X
zkJ~SM9Cpq6%(?N;tHhSFcZu=$lAkS_Z)I&?u|?n*2Mdo@Un9up4NmoUm>ib*aDDys
z<nCIpLx<zHZ%f+I*`r!3`_`wB<9xfCV)gCYd%kXN5YYRZd3m$=`WGViI25Zx^qB8)
zl(KwLpQa+V)cfdfkxNV>zlyaOR!m)C^YEn$XX{jH^KG_uHm?ryHr>&%JRz>QCo=5O
zRC&ghf?H>n{&byMwRhgF>V5$y*|~gI1Yb$m2E5SsRXX=8`R4LB3S578N-(ULqt?^y
z9(Cj2mzOV&nR5i~H@@^aH$Zq}>+-wZTej}c&f8i3?a$Iz%IdoB1(v-D6b{+BamyzT
z(VstleDoJ>5imL+y|Az1qM@IL$JCC?ONF*FowmEn%rLc)u|QXDp-^|Wl9JUtTj`fS
z*c^MR{(ii=+U6$P%a1P<KYA+0X|#ZH?Ujj<-)5Qxyy%}+J1yb3ct2x<#6pHeN3C^j
zRt42w$TG}xc8l`g>pA!I8{Wr`HQ;7(+T@ecR+5bZPO=O8BG!7@_lk3sce*m4wqxh|
z+uQ!TQjbBU+ciMPZqXzU5ANOf_Q_s!V0Vm*$y_tT{B&{7hNORQru%B_?{wf;*!RKh
zo{+Z4vJThk)Jrj~Ul>GxaerBVjAM2<!vr<gr<`)a+S9MAs+Mlw{#}{l_l&drug_mu
z8$VfDc-Lv>;wOtHOJB3IiuUJ!967hyfg_ofNr}xtc46PQJN;=wD^65Ti<!25%JiP#
zutbBi^$aH_F8;*wzB5?MfBDj{wGxq;`YeW$Jh!6FJ^AvdiCxYL;#(kn@$HuF`4`vP
zZVeaUSQy|jL3oqOG3iEgC)t;YLM}?HBIat!M||sCY0t1{dd*T9r>C+<e*c~<_G;HI
zgL%#ZERvfAHnD@s2f6D$f0v$C*~#4c&)_S2gMXkA-&FNIUGQ#u&np2IM+-rxZ=l$_
zlbrub|K<7A`Sl{dq?fxav}dT9v+6*D2BVqOSF=e?O?o0CFG{U?-h#9UIIURR&Q$6n
zz?pedee+{)*3c>rsrHBO6&M%_ofLUaX?udJO$J>T0hWgm91HvIFqba*7<1~tmHT$B
zIr~#@s&oC_$jmUI>y&WZ*>#?i^~A-c?drblN|bI=;Aj!hxB9ij>JqaG-<uzkRHr}F
zPIYDM@)G&Q%+S-wGn3`oldo^)87*D8>QstJ(w24wjzj8-Emnu5AFtv1d+|#A&5AeQ
zUZyZGWVQ0_d!oF=cQzZy6@@A-CO^_RuL$0IVUjbgHtlpOtHzh(q6`gA^&#^<=o&dW
zt&_LSGMnjUpX4OK0!dTJja6!%Dz|h6(@!kPIx2tKPW!{D`Lh`q0u}~ZOyZwpTAa4o
zE!k|g;Xh{qmcq5*WcZOexL(qzvnt_cy5_QfHk=F$x-R{0PdVdN!5uIjMnM+GIm#^`
z+*T;xoxbefC6z}qJA2A%G?zKm&-nGZf`Oq^DP-P<%qt5QuI1%bmNrr3XaXhA8_Ml%
z0rh&nr-&`OAfM03@Mc<vqN_sv$w}_Ly%Ky%988K|To?2mo@B7$jq%^}PW4;f2=A_C
zV%XD`vs1+C2!n3TohvPlicJavP7ij!^4Om?DPoS=)C(Ld55(6MB)obbkibx#Rl&-@
z@Z@jl;y?zj!-wL`%#$-Z6gtjxD(3z()G55jdc`nt!HMc+KC8k`@v&%}V(;1`|ENof
zpMinlMeB17`~8j%T^tz?S5KQ($Koi!u~0X_-L6VG_=&B%-)TG1X{qzuE1Y^yGcYuq
za;P_Q_~sy6+pf{LK*c8J_ARSj3q_k0PHf!u>%hrk-4*;(es>5s$=W)|x+<LpkFN!v
z;{UhvF*o}&w$dlc3=I*D4SN}#WNUlj{TqWVU!Rnemd>}W*HmAxQW)+R73Nszn(O_V
zdCIJkIs5ElFJFz`b|)`$@Ba^;&wumtoiml{Z9ezw{ny*y-`QWwy8r5Hm09`z;_q_B
z>zL*2YwfOxzKHWNp0=gD#EHXFz^Ov{x=NSJN}<AKcQ(D5Jo6WGfcrKEhM*%#-{RQw
zzohEs)PLg<dzg9grCr*pZnfIoGbGE5&qNEwEw@ZJn)zm4hfT$oDOD#K4;F_XTbeRS
z{?@$PcQ0FCi4<P0|0DD5x2EQ)@2&1z@A$nbboR=R8&sC0@t3xKT9xc$JT2o~T#LY`
zP!7ojeJ7JX%I~f{l{!r}K4Yoy6~0#-3=+!KOOw7GVk`ZU3LdXMvRhpLfsov!b?@d)
zeHblk?eL>*?%cV2YP%I$4jZP%MWr>K%t_O1;fZH$pCmSEf-{F=OTh8KNh)G*CwgsS
zE347m^yb^krquZi_c$0%gr2yOEpbI~h03JGTA|lxn;UR#S2wacTD8Ofb4&N(Yx+_9
zzIEq|MatXPy;}45wF8H`PqabqH6w1H_mR%03)_VbEztb@VvXm0-EFTEUT;5I`)5VF
zfD=bM<Et448{SOr+Vfue#>b^Rr|m3RUU4ui`1(ybRA+^9$3!nr?%lU<JrI4zwfE(>
z|9(cLbzdJ&u4+E`X|dg0zv5@tSx?s`_AnLdv^;!W9`*l)bNKhK(Yg~?g=8n!eEhUE
zR&kE(u2V%5e*M4M9p2uTC8ighyf$&myDJ+7?p1%7agS*$ckL8sTl>mq3yy8^n7Z?s
z`R3`j<9dI#-QaJT(A96PaL?00_AxuSyVtkZss0Z0f<A_ZO&?EX*xPdlGQ6@7dL+`d
zYsr#%-^y;Vem|+bCZX-tOH1}QT+W_H6MyBKRbMhV8*wbftp0(Q!Hc*rEqrlpZ(hDt
zEi76jU=*mj%s98pD_e$p;n!)#TTWfM#i?%^SE|smJ}!Iir9igki96Fi%n@A^?|e0o
zy)W;mQEl!V)s`=U!RvQLbGRxA?cXSz&*~x6c}XSd^rrJp%P!1UXI#+7zz{WMp%BNS
z_U4IhD;_I6=q>bm`f`g&Y`C~e@97I|i_Qe>_PcD*rTwRDXJ&B9q3H+zM=M%te@Pee
zJ}w=2>2=4KxI3HXn_r%@<f%^7lBl4{i1eq)xo_W>9eKCS;aXPp#2-_1PWyXqU(-MN
znxXn7u~{W9znAH%SvJQVTP*F%7kTO9JN@%+)+;ZGE;}3JWv{yIe3aPiIUnoa%xx_e
z$rL`efB*AGCwK1N{ad!KZ};&6UZFPy<>k*c?kqIhF@N{(zmpzTS7fJe;z=~$JfZHj
zW#Y2?S63$0-M;Iee0rvf!kw+p8<MQVzVR}*MCCPYyx9KsGA~E}T#MLS<u?|ezxw%+
zX5~}X{Cm5MKkBW?4qy9wN#t#%eIk4R)}<~!|4A&1rR8?nyWETWX6T3aPWQbn7Icg2
zzdLiw!_*fq#NV$dPh(4+e^~3ZU9oz^&E+RATuj+j)snpV!1^?!5|a|0eJ__?O-*fU
z-MX#8{BBmc)+_O%=@o1uSIWY_+y0ZfI_aSK_wMkp>zd!cX!|no=)d_g^Rv~xAB*|^
z9e=2~XY+;?)pI=gZ@us>6j-P5>&pT`bJq5|-V07XKa{$9GHXjgUy@zM&99ppKD^m^
zKCduNv0%2E14lNmp8WFb&+@BOzDw`;*sZ@m??c_~S9?N_`_5acuc0C^t$&`#cU7<T
z*Yc%STg<xWAQ5+6#XK$L%b7D@Wa8bPJ?}gI_H$NQjp585Y2RgbkuyCV9i82sk58JN
z7iFJyMgB>5(4L&N5qmH0ZB%>f#vOUWQ#9W!@8!FrZmrT)e<zmo$_Hx92x*A#w~e3w
zC03}h;N7984$FRv$Zy$oBALO!{SKSG+^Mgusn6nq8a@QPS&_8i11D!o)SlW_-T1wV
zz6}$WtUk1=*>Ka=!redWPAaP3iwLu`vk@?|ynNSt+4qm)QWGl065rWJO#J5%5q@Ff
zrt|kg`}ChyPEDO}u@4jjCA|w5pER*Bm$vcFmNbtGeGyUhdTm?l%D6A@ZNFD7&Fv|<
z?yMi^&UIMj-i`DN9=Vx6>Y};yJ$D=w66k&=8D#q+Z{eg1XP=m4Uh6ChHc%`35pn+C
z(>uH0-`P8Vg9_6^F2|LAbL^@w_U!BqUw`{e>%p#fYh2@`=jJ?FR>AB4cYef%(uJQt
zoNAo#D`Nk}j0%MmmnTQxDyzG2w|ITldiISyPQtS6*2TxmJ<^g~Pv3E!yXc2m-sASQ
zyI#IAUT^mBJIAHvHy-jx7`3G=4ybwj?5$$s1f!^rHmNHP`CV!g>GPYpQ(>*Q+xpy+
zH<6|<&TIc(<Ma2X?EaG}FEUm!OHG_VxunIo#H8d+>G!*{kN5w-yul!qTkf#WrTHsX
ze$SKM#l<Wef3E(U<sY?m%!-fHBwxtIo^1({xTLXy{e6&;Lf_U9o|!rdS1j1;^Htus
z%XzANyZhaKN4h6Zmi5_8Q#L1Csh+hGzAO0oTNbQ2<n@bhEgy%q_}BM0*Wb~1Fx=_z
z<G6gi&Br9?qdL($@7Y#AdLsE(=|DTb#;YrRcYoil{ClNum$bUy?A4psn`W@hX=glC
zEx)@!@=ErlDE6yutJn<{d~~g*g<0;K@-(Gb{sC|0`q?Y(Cxf!oqx?pZhcg#0UYI<;
z`rS>l+F$qU8RfQ3+CQVU;i$KafL8UkqO;3({J8jdIlE9_PVAJoftT8*Ic+yFxp3ZC
z)WKufiT&kwkLhyFu&tkI-;gMMsQ-h*k4v}ZKh@b@Z1PB&5N2hrd25sNO0zb0r-rb^
z+}+>y-LY)B;-e<c;dx)PA<v=yz=pudA_fIFZXD3MoVi)-*KDD?p3>}mp)HJu+UHez
ztDgGht9a|H{jZnIp(Va6RE#(Kmt9+MXHH_}&SZ%%<;jeF`XzrAU;j0p$s_B#EYn<!
z!DHDKQ!6R+Z+qX{9X@o$H+4bX`To{bAu2Z?U3<Aw&G^EJz@O$9E?OIvJUPPRn-t}#
zFUc$8bRqiy$I*ZnFZd7WxQDKP*!W?RZRwZvYYZIEb)yy<@B}KeAKKUKuE~&p<G`HF
z+$XKxg-xE6@-2VKyfDTGB@zltw64yb)uGP&b<suUM31GGR-e4IPTNU-nin4Wt<rhl
z^B<E~Vt2pDFp{*I<<rxZ`ol${)J)RqT1c~8ZOQjNm2It>QD;0Fno>>+&bXv_^ttR3
ziw|qn*8aI<!B};8k1kK+gMKgRWl|hR6B_yNZSgJNx|(%g-PH^GuJ8Fgm03|f&2#=j
z`xB*~jT!}B1W9aLag|YVN?&SU{FMSVagOLRjX;KZdX0w}Vpl7^U)~a5_w(%6_nd!Z
z6Tda3=KW8UP*`&3`_1e3dX3qYgm<Ujez%&NW3l`3ORKKPr!gpV6&2RZEK0sQ;d{!%
z`3o1HOu3V>%J|jHnT&5#!{_>jt(97Gu-|@P{mo4xUpa0bdc~YAS#i>Le@26aostZv
z@+$Vdy6?BYcx3j>mAmE3?ADsUKHItZTlNTP<=B3_A|S=NSJU`e{lBB(UHrT)2R%1%
z20wGj(`s&?z_dzQ@6k5jD(2TKpO<8}t)88^Qlh3okG18M=$~Ds%ja<wsMk#R=Nqrk
zGeO$2Nq0y1w@Awu{;BiBb)4NNgR<<QK%SP>rjq7TR?}>ME=f#$B{prLp711_FMX%?
z3VZVh)pM%s_Ap<2<X}dlfU?YXZT*9<=UbMaoVvSbQx;Fllux@R8-IJ(@5<MbA}h*p
z=;e;rHy597%L|&+7^ii<bQ5pQtD~o{Yqjy)^9W?Uy;;7(`TM?4R+CD36{4;;PKeK9
zf0Dv~@~q_4_fu+@xgG0O1LZUm6Z75Q0xw*+cwyt8qvFZg*Ch5YO=7eZ|Em(d<}=^E
zAJ5peB>!s1ywx+ETqW~I#hGd0AHT`mEfboP{N`GUKYHrU)-rqBn*w+1q+e2|0$RzE
zIVTst_dDq@QTOR$E4}pa@>-k1Hl|;}IWlq_b8{5`uG?hk+Pe4DD-D4@y^aNME?>Bq
z0!n@>Y&*F=^T@8fSolPHz0B=RM+M#$UH=yQ`w#Pxtr?3h?=^ik=ib3Zaj8}(SoRy7
zKh$D1-!yfR>&&Ir8_x0T-uZG}g5za-Nw>jeF%HfJzd{U|+w0C8JkfaJsBznG^|FJB
z5^a6KhhOfW7SYLkh<Rby(T9)A?W-Pss`#?As#Ju-lkJ+FBPb83IlEszBK>Kxs|Be3
zo49^oRn6<L!+R!Vf8W>qBzHp-&zD6i)yvWhx)`4F?0h)6dvBaUXBD^bvb=qT*8GJg
zU;Sl&oSo_V@pk_H;9QMhvF#uFV}ciUY;kk&Xjkdie5SZ|N}I!p_WxCfpK&oXd{uPe
zZmF4i>g&h3^K5F(*2P_!E4Q)iu-IIsxho!<C>{HG>W#HP@WPjW{r5F;`aY1UIV*TE
zUE;^FsW;nrvZXn^jf@_J$h5kNKDlZq4k~5T9=i$GzKp%haGpnYZB%K_-m3KPZ;kJH
z?{VN;lXRqdt<^N6A^~~6yiJy-<qtop$7d~(E{sXsGI5#j8jHKZ8x~bh({s#nd0b`f
z{hP1&ta|#{=wltl??cu+(kNZXqH#ml$Mr|kCy@mT49jK;n6fy<PnxW5C1L$&-qZdc
z2R~R|krD`sI@#V(aA)S`gv#G}dkarriM;ySjk_hPmaR90$5?u%@k81FuU_ZR-lltH
zWw^A-W9{O|i*qyXFHLEf6Q1d>I(2z)vf7yo>vqU1a8>j5t^T)kV(GCtNB88&K3N>l
z_TjDC+C}V#K4|&Pn<1L`CG|yy(M%p$<-m`n*AKREUQzvOlxI>RA~w&u;J|_N`%QG>
z9A-q^DVDb`ymhzw)0IfRU2*>-_8U~rnJ8-H*f~4n|6hLlpg)q|H>eyu;OF>qn`|}n
z@=GTdx=hsH_x0dZ21SiWzVoM7s5&GZKeR8QM<*zonZwy<?SWMxyBD!K?JY9r?U?cR
zgV)~vn2yvh9!DoWE|fkPd#{iCbImRP&{&3`zu#|t@^-w?zUF3|{6za6ZPnTbC(U<!
zQwUuZk-4p8x6Ea6j^M67=1rS>R`SUDs!d*)tnzB^RL-xhA*(K4ym0Zt#Quz+$!hbD
zCbiW!a(4wxUl9N5(4tLO_D|Oe{uHH{Zl<BG$@7`J+vC=GkuxoY?>;dzW*)n9R7E12
zttD!SO#J5?>!mL4Z%_5x;^3iHcKqF6mgW2ctKNt)t$COF*m-wq^#>J)I<*TkyiUH=
z=bfYTKJ5G==5{R$kNFGR?y`3kiij+8<8PU`B0TL`j<V|H!o??3UP!dEJx^(M-*?N=
zee%NO={-G}XJ^$`{@Edz@Zi?2Wd5&<vcyaBU!Oj8ygA}(?w@D3-xoB8IJs4AF7*Dj
z&n37}q(#5O!=Lk*+1%<~oT^jvw1icUF;7U@A8D*`Wl?tFpD8y5*2}Y6>aCx9i^b_4
zU+L78lWf!b55IRm_>!&V-kP5mA1~KFx#qfm`}6eqwSqfbU#4ayJ$7@k`BuX$wD1(~
zugy2VTVLndd60YNJ^A`Y`$9a^UVappN|05NTGQ>&@k3iujc2jSqQ#)5g^{GywCB&;
z*eoBrIUncP@L~02^<IX@)1vlx{F+#*=-V#N5!S2tez_xu*(2f21vj&Hu^Y<nd?F_I
zGvLjORa<A@*p&KOFYop0-apUfFFAULt$F-0bEEfB>E+iyez+*SC)J>N`}r#^AF6Xd
zhRXHG#%;@D4rWn|kg&Gl&%e2?`r@XmF>HUtCM3*Saic%YNzboMe$~%_*FR2Per=xn
zRHvV9>FV;0e#{S-{J*iA`@Y*cmcGZ|-<upx=%3cN=<#k1(J8KLGg{YbJlgOy<$9#o
zCLhI_eJjtLIdg{R<jNwkKj*Ad&qS|JzbF0t_vLWW(wWbc&!0K{`;$UT-xW<OA;CNw
zsb9021gxBn?@&Cwil3+E$E(#%hR1eEw74_ttHrExbZ_c&xlpLd_2s)<NlTyew!hyG
z9`wIg7j1CN%EBSSphsUi{8rul&<74LJT6S+u*y5Z`+ZBR_6v`$h#i04?QSx>_L0%)
z=P}`o{?{58WlL0Ec(}M;mauxi=e^mA)C+=EeZT(gKYl#?UVXfVWHOI{n&a_FxtfO3
zc`A22T!OcmUb+1F?!NHOSr-J&osM5r*s(3-*O$ruF29p|7@aOp(M>cL<6XRtDfz<0
z1<HbFEBtgER&H6OT+-5)oOmNCF}X5Q#p;-Zf=^@LRE?IJ3x<CeC=1H++__Pj*&@9#
zSxD48XGdYxu8o_NB$8jTbKG9~xaJ&t(aZMf99BYSpVm}fbac;c?mOBmoo`+7!DX?c
zMDi_O0k0B^kb+Mv;Bc9$F{NCp<ciG;i;bDV-L2}03(rU}x42%;3B9nmb{_Yx1<DWI
zlvI0Xx%I5p>tvT*nEX<F|BmXscTZleiYV?ebkK-bJXxk`RoPUa?C8EIcbes$%b!!7
zV+Bi&^ak(U`#n@^x&K@tS#Y>`9e>;9H%|c+$Qjd<x69mcyC7)(%Ky0R{$HXxKGi*p
zhs<6?Y|()#nX=`4@e{!ru2xR&FLpfdudjKLU!OhCPFEsXh`A+8>p8QB^M#3*mMdSJ
zcwzE#*^-vNn@b;;#NU4$9)CB-thFt<hw;#3Ex&mRO?@n~nTqln8|EvSJGsw#`#yhT
zzzefu5(+jF8WxpJ9OgoKOQJ;jB-*U*I=bJRxOhRcc-)UKz2;oUBowYJk34@+ltq@)
zYSJXGWh<ldE(ls_z4)+n`o4<qcbg2^I7%~?Cog7IQUxUn)!Q-?+k_q6XKp%rX!`rz
z{szYw7T!|R<z^PpT&V2mKCAGp7{^m-wHG%^OKj?XKFzoJHY1^j(Wy0b@r3Sbr57GA
zFHhwAv2G9BLgl<SQC7!vYCfM-XHDi2(8}~YdQ#X0<cf2x^Y(mPpj`4M&uZJgsYlmF
z->>_Xc~FA6MYG%l6r+L<-469W)d*;C=)KD!Tj_poLSo4JJ)izgj}z)KbeIvvUNc=g
zN9l#fg+NE?qGYa;<<_zbl}lv$B7Zzwy&mLYpM{yz#e0Pu-IYvB=4|m%&AB|kk44r!
z=eIsHv;5v~vl4nrg*nuHiqCevG<&*&QBe?-hOBd6yPt5mAZXrab<Uohefs@McY|Zs
z_&J_xmo4ISRrePVEK#|$<9xAOb=9?;mTTLk7e3zcK0a1s&7SY`5_%X9sl12?Ed0bG
zD44fId7*ih#C%o7!==9NFF0h6H$T`F^zw4Qy;#pip5_aimUvC?{%jd%;^lH-qR5sB
z{7Jm0*g!teX-VvE?R}bhaceS<z_F#C$CVcz->N3)=<c;YOXS!wZ=E|Fvb(4B2}_&Z
zF|p<4mSk?3yYO*c|77(mE-n`)c1^n}_iX_v%Lz-H->Z9Zq0`OT;26Whom-BV?$8Sn
z5_ELevi!EwfzQgx{f@=X%3@G9NmM(=@Nh}$Uk~A~M^89IL5{awx7ePk5|pOz_r?Et
z^ls<Q;MJ>}HooB#IAwnE<*PjzA+9bgvM(Fn_emb(H?1-Qhh25G{E9ID`BthDr++ad
zo+{B{b`lj7bUdDHX}@iL$b~?)I~=m*e_w@fm|*BoQ6_tyHKr6K{Uy4Ksq*Vdc98Gq
z{5&i#_w)AsSs*nUmmePZeY$OqPraIw(u*4h7ZunT{(k88f<rd__pf<7eq~+E0Y&tm
ziQj&%Yhg=m?)wBX&hxa_l(GwgR!+xj|NaFT^CS6f(VK|EOm^AMj)KQ}*ZmrEFH9_d
z^5B@Wc-)UOzUG|AMEC^qHm`Y~8&rBb*HodU&&B0J;kDu*WyzA3z6&2us7~Jl&LeBt
zIG)b-S(7EQjNj&khl@))bN(HJeODzM-QR`zZdyD&?$@Wi-?@%$kyY@S-{<{Pp?2Ft
zHzlR06F&`^o;LUG5VR^=_EURZ#p8{~S(2sr1eW<9U%c?Ya)FYndDzuOVTr0-rwhH)
zxuSHB{ntGnYUw<w!zfOb>*-H$!1y$^=G%R2N$`2eu<#dO=`+{GSM2_;ntxkA<6yp`
z{F%8Yr{^fvKl5&MRyvj8db#K9GL07;vXvJu8k~yWzVGjs%S{_gtsN|0FJ*T+67l;`
zUH8ufL#}74Z`5zr*lD;Y_P+L3Iu#PUZK+J-4p7JiUS1PldiA&dJ`IWJcIKAOxi*b|
z?S8+|*Vz6>ync%L{O{+t?cAJic>eAZmnk#9?dY>P3{G>J8$L9L#|g^HCpQ%APOV*?
zYxVVc@fZGY*<XKtt}FWHy&!+H0oRW$6FR=+?|+~5)Ew-@!ZX|cn;Cp~n7y9!n2?0R
z6c1Ke?Mv$Z0k(As>p!XfPx}2b;>{&5kq=d&N|$yfFAO*6vFOcVlPy#(ktv^3&&#K`
z|L-=B${t21)smQq*H1X#Y?rwI&2s)hvBeAITIZZ`bg9}lg?}H*!kWh`SwKll$Ku?6
zcJ}alwc$(5jxj70vXbN6TUvKM-L~%D`dNpb*LB%xt#Ork<>6u#*6mcu?&N-Fh041y
zUABW)TMzxeS0BH{{usl;-1Re^<mEo>EiEx}5vhCIvESj~=en+-f@Fh|DIFc#BEt@v
zTt8>9VDX^^$|ZA7Jk6UiE34*HXM)a3#zPjWC36bruCsfl_~T8^_oFple-5{Na&%X^
z_0%dzVG6&wllzMq5yC(JNQ$jn({bdOghGhJaoKHGefj@|+C7dJYiZ*wR2Dp2mD?a-
zwTj2e>G<2(W_OK@mCrjJyW#J(?QiPst!v~`<=8}brvG2DYBJ|SWkFdko619u?k_xk
z?bx`b^0RC^-`pG%mSi8fmLkms$(EZvR=Dmg64CPro*?$gF?M#m-3t$w;-3m`;cAZ^
zK}FZ{Z8?ptJ*6@&TrVu9f8JdFP_ETG*K&f`R?7?)E1^J3uC8U8k&dSqDCf2G?XIeR
zKXbnQ)?Hc>$yyFK7_H>^jM)yI+PPO@%9o!$5>`SNTU5E7UaZ(Gy-@k>zpLxzpe06f
zRb#-S+I_QUUO$#|Lf1`pfx^`<28xdEizelId;6DzYEF;K`~Q7yzMA#<OXfj|(*hjJ
z@8&dYxV7^*>&mBD3~kb#B^kGhC#lHig*do3_5J?!OYZOQ`-zIlGZ`OF$$ecf7}Iy?
zU9e=njOq)IE%(cX6=X`DIJ$pzJpT9ZU;nt;tr=#l$**Nvf;aB)stONIWHvc*JC(yq
zNS62SjG()qf?&tT13#b7PgG292-r8NYg$Ny0PiOikPBOD1eiM)B%ALRw36HVWKw$m
zE>8nCj;BEm$CG#M%h)n$30o$oz@#iIp{t7u=I#KMye}%=Y&spc@44JT2?d}1m!f2O
zY;@1h_5Y)5)DrEnQ@T@4SEpUt*xNm;yLJ7Y^7#oo0$Eq>&R_jt^ii8P=u7>#cZc@(
zD!+gH!#<>Y>DohQ<~-&WVPZdeVCqg@_ifI+lXXL7%tRg;EY>WmG88*=Ct{<H{rP<5
z`^N%9s;8W+Qh92<-al~D5-s-H{b}FL-Il6I>oyC#=(x0X*7M$!1<EfttZs?x{#v?0
zAmjiO$K$2GR=Ioro}TY)WcU2f>6(jEGELiG|JL|hTO|_St2D)=#O3xEs|(yEHFoJw
z6pk-)H9dNifmzH!V_(QxvvYZ}CQbETWxt$`^?mZ4{baV?&zbwH)zW&EE(mt!Z5LEv
zkv+<8#r3*XJm&we@Z3zz8x5=iT<1jntzBn6dp@r|SY7Vt;WulhKbs%5^UbeiTXxsI
z_kVuw+TDFu141IE&7J!9lvC>V3ICNV8JQO<UJ#Tukv_2Gxy=Q^yqKwz9>s54vvCnq
z#Q`rTfn`}HJvUp#?5$n>PX74wLH~38A8VU(v5)%sM{i%h9PC{?@73n?SKOa&uhL@H
z)&2kd2v=E|*qgh)>(Asm-Er%fP+_j5&IWRHNzDzZwck!yzc&dDZ4`(&ugP)rQsI2f
zIJRCP-^sJ;m8*YlFSw`tZ?2{9pX{|g$M(;gH}BoMdrpc!^{bse-REodx^pgllm815
zUZ)lZ_buOA#TRX3Q)J9zkv+QE;Pqwy+gVu*oH`8!0WWu)UU1y-OV)?;)~QbV|EKLQ
z)jb>b>TAe+yU^+N(a++Gi~s+b{Py}~<?HF1YCNpXUuHdA?ep{5DUN$GZXAt$X1-h>
z`<I(?sEW%LE`BUEw=d#GTr{^|0%J?_m2E#PDi6usXL{3K|0O{G|Fbh^qJDhelbRpr
zeK+D&;rCDL7b%tfb6vNO|6>1z_piCR=PYh3{8xOlP-@`|0Vdh)FSg84V38GkF=I+e
zOu9+k?yOMv+FGSz25yBbS-<uD9A>P$Dzj-8`<eA=c_*hV_+$O^+wAaMX)l{~tAZ;{
zemzzEKda*Bb$#xa#}C*0z3+ScQrNb|;kYc@-CI+pyx5q`U*fVLc~ackUFTA)GB>kE
zMLTk@dBU=AQh`-fXN}Cq%NH{ZkLmuOlk8@5ZvWTXAK`M=|94Dda*9f~ud=_$-mBE&
zaJ*KH`DVZQ4#CDgPv7IbX`9a++GfVUtexqoF{kf|Vbh%j;)Z^1HveA)w$`hQ3H-me
zV^^W9Z^25d(oOHCo!NhG*)sLa;|J~a1n%A1*K1eo#4qK_aj<u$n6mXB2ltkF=~m15
zB#Y8sUvsFgK9s@0t>AMxi(MzwQ$yDHj1h<H)2Ti)#hm}A7Kn%~`1}2b`OF{Y%|E^$
zj$R*sbHlnLUwuR8o!LL_lhMOJum9H_sy^QTu{q$4<`fRa3m0`~-mql1Qfm3QYUSa!
z*jsydYYQ-#ZJ5N^;&tfdj_WA`98TuU95<_jYER9#e{}!P{*!;A_kZgPeir|B?QEm}
zQqr6iN<WWpm=d{IBzE&Dey8Ox92avaIuts4ow8D8TXnE^fijcq<u?BPThjdnbdGpQ
z32-fc?6){hfn%<ivZLSCzW-nSr(a*ErTA~|pM`!8<2`KtSFDp-dRzSNWA|cyDOL{F
zc7a7V)4JGhGRr!;vsmTHS%33#bNk-R-oP&AaKihzZq-DEk`*jYo^_G`w|Fj<3qQVo
zKi7l#zqSje?cdWN+%hxmV6&T`Q^ssZacx#dcToIzMIY<m|MFwYuH6Uubs9dr^uC_;
z_mRVlmACj7W?$LRb!X0wXY+qJE@oKxK)`8tZ<XKs#y*fQw)@R+&<QbP*sy`&(2UO>
zYJtseS8vPdoU&LT;KlO)ioD6L$FE)NE148q_-62)KT=en{G#K*F<IlZC-Rm|Vo8iG
z{*#>rIBF+(s`5VDv&le&=Twc?K5vdGj*Hd%RDYcm=1_dHMPk0<RR{MAf(z$vPMiAV
zS=W7@156y3x8ADr>fX#Zqc_PR!*n&H)9>zO+ONYd>pN@Q_{tG@a?=#Y#b1AJpIZNl
z#TI1!p0Llx=@KtGBrQ4K&a;))5!uh+^sVJ`;r0cNi{nHcUR3;;^}SE_EoZC7FL|b|
z4jOeAGB&6G$v8LJQf86=JO>WN*=nh_J{(p}eOfJif8OTXKYQw^_HjRh)5nrKi5@}%
zTGM-`Jx@`+_Cez5;$tP!im{TXf0kP6UNmq2%b{ozk$W+dv*pcN=LN|+2YX*U*i-p*
zy52$clY1DP>a6mvy=J-VtkE3M+x1qGYu=;(kNkhS9iKPvc)<y_L&fs-2Y$!S<oz?b
zQNXEVxh$LQZZ^l`Dh0|fG*qS-*4I6~x;lVM%t6AoQQdz9%OUO8*EGtytpBxE1wUAB
zqbT#6@8Mh7_|Ns>fA)V_pzPGKe6Jd7%PTgkroIKrMS4+Ryd4?WG_eY}oz%^^up)MD
zF^B)YpR+s!j6U>VYrb}ETJ`t3ofVC*_*j0`J@^;7!X|23>74(&KV8yq+2P>c60q#3
z#fd-7(vI$TUT}zA6A^dTiC}n`d{Z}xt=CE=)S)8f+?jXm{J)w4Z2sShiaz!3Z`ISH
z$ZMU4YOD3?{$;*fG@bwKoM&>@mu&M)IH$=4edCN|?-hIUxjx*<Zy}4Upp%#0Ns}8}
zK#BZ<;L;@(|Ng$8HA!fP>snTUyh~Y&r^&5<D_-)cC3vo^)2gkDY<Sdv?bY~qHD<5U
z=luWoy5noy{#e^&&q_Zeas9=^bAryY&N_nfKYqmjcWHK>dCo6{t#{j&3*1F@fqDxS
zTBHS?>{dte+y*7I@YPDa&n|3A?S1<6LiaCjg%p1QS=YHX4<}t=O8h$W@*3$p!%zOl
zB2@n0iaK>VYhA4F>2s5Qet-IWXLr1%O?8$1pT&oTeqXDOI`%R7%ddqA6KdD_oLjB`
zkxy!BPtsO4E2Wl8TcrZ!Al_PgHG@w-`dUaN=i!cchJ_ARdEzD+SCnTy%D9l>&(HmT
z*R9)`zbF21Z;uv{yHWmf^^G6XCC?sUIrJf&ue4ONBbD*t&wl$SwmUB-H83B&B&fK>
zcm3@NlZ+e;6hUb{i_L1?<(GYXzsD7qnyNIb%C$JX*b%AD))IHsp(6F}t9@lj=7}Z$
zV)uv5n;q-&C;IEr?cQ;=HtB5E|5yCu_uCSE_LH$LTNQWJ@f&Qt@9v!Y>DsxgR;0v*
zL-VcC356#;^ZN>v4^2~ku_JE%`JZ1df4db`!RF1t(fZtb-DLH;ipTf6<|a8Q+&vLq
z{dm`z{msAi*Z%r+dujJP-TxX-f7Z$`n$7d_Qm|sP+h3=>Ee`H2-)8gFFtNxwx?d11
z32AICEtQcuz{F9ytFFsmpljE3o#44Ujh5_q=g?5w9x&6vx&627EW^;yf13JF=bLF}
zKfIrL<i%Ot*|%1$e&R0}WOBkRW6Oqy|GPhVDv7o{aBGp7RM_mc*u_s+?hYs)?}#d0
zeDlxUS*EhQynoCNFmc=z_B`%W95mO)@#2E%8)ik6-99Ar`{M`2sXyHLPyUJi@O{tr
z`wMRKeg6Jt)ep1n3pXtIyL`Ttv{cjFxf83KbHaNsCAQt`Ocwt2gp<We>B&T&CkJLQ
z%U<O#0eNWl(V|mn+*`ICTgIr<P_WrgT+o`y^<v@tlM_<Z{X^#49ks{^sXR2ZJp5E~
zSew_MKc9W)&M^I-uYSL3Zd>28_xB<v&JOnfvwEG{zl#e+4*veGyiHGZ$1xVCsFJms
z?@tO#m}psD5LA@5W&(vB?=ERa_t`2Zb#n6i@3KZPB);h^O8zw0CUDM4tBjDFxz@k`
z?S9zn==M+Z=Q5uOKfgcAE_sshZ=Gxjx6)iG|M13p`77!#NX@M;xtEZ?@Luj2j@_I1
zr2alpzBgIjAe^mpnX=RD(x|e#jeQ&?EV8W^3~O&}*c`pRsWoC%bAX8K_LpDV+ajh+
zdhn$4bauFAS<=DKaQEYD*Kcog%-BBb_w)OmmG!kp_Rm@K@27jdz})&b-e(;b^Su#J
zx>(|p(H^)zaB*kclA90QE(qqa$hz(-y!_$e^lxuC*_aIYrv(VCa&WJjbw4Z2;e>>}
zZ0)41X1DnN;=dPM{BW~*t*B_p@_3d1YN!7!-ndlU{{NIOuFKC~e}2ENr(SXEkK<+;
zUs%4EvkE93EOE(Lf70PYGJi>n^wCR#jeWD-dl<MkhA=FAu_x$^!jt8T?`t&&{8?~u
z-n<W&t?GWx+$QF~Hm2<1XaA1+BWriv-hOM9R`t*CxAU2PTz|jdVq3alM#vg=fhOs|
zwwb~$3l=k2DP0gOxnq`hXKPQ-J9hpD@@rHW7X}*%-e$AkU2}EC#{Ba+7cy?zesf&h
z#hH2W#(4*CZtnjYTYnt4%P6^IaZdkKx8q_b=LO0|o@#C<K<$MW9OlQOZ>#(4cnYeb
zh2;z*7#=!q4&>mFpJ#J0%BN(F-Bj_{3j$dy9{pVYX+hu|o5l(Dc~1Kx96>34fpV9*
znBN=^oi}&A4={0Te^KH!TX^|iHA97xwsMZp6&9Z#C|mRH_+@1vvZ&?5`%Jdpx?h5R
z^E|$QJ0gFym}L!>+4EeQUhb&Aw&u`c_k&J4k}Vt6<yx$J*%TE@R<a#BogKm6t95LW
z@Q!(}G@NFYoT~oBQpO=D<m<jAcD*+rxUukp!|L5k+ubVW=FjR^A7SEXy<E6DPMxJi
zZgr%pz$Shv(WCaM2Qq&gx^km$c{p2dT6$sAg+9l{9Gzv#w{kDsHks97rk1ln8Ju^k
zpP!o=*}*DMq|(r5x4QC!<BP3PAxsY+-ZaVB63oLP`NQ4SRL<7@XYn$}#jdS?)csGi
z_jPb9vRKI(NP0B%sB%Hd7#GRU&;C}t5@}!&=<1)?m*>gAp*hvTW9yw{X%nrE`nkTo
zYek=yZqE;&dunm-zGK$qP6riMb53<!oNJO%VzZp{Xp?{<i<Om*TiHKVG1-T17X%wy
zzp-*_>BqB8W;n!h!f|(&v(Dco*G>wrYTVFOcwq(CpXyJt%x916=XxaHYp?rt$GV$l
z&-VUJyLPD3{n?pMzB6CQS>H<Bdg0^uk~^(M^Auk%xOjAZ!i5Z{c7Yc!rk#0}Eda_B
zpcK3AXm`D)2E#OlLp$CzL^3Mo7aC=3(RkdDq^|g9^?Cl!=WBIKlkaWX{_8{jl)p!h
z=g*tsQzZ5{cE0(QtD<$>ZUS*X-b{XR-yx|1<bzY!moLfM`pO$rR)L~g<ouyohnyy8
zo^;$1x_t3Am4xaZwoP{wmTPh7um7i&Ch+Zxjp+Yb)j!LBiF|xtHLLf>^t}cDChpw4
z_*4I;Xx)cT+Es#oyua}NeC?0A^yI~V&MAfoJbQod<WE=2!cQzt9wxHeUzEJz@lF6`
zlROq#Q>pve>#t6m!r<r0=k#sc5npSbUkBM0pH4he)?IkODEa;G>o?eY-R1?@GyK=m
ze$D-9_4zsbUVn}8_qW~p=WX0S-?=KE&u2+C)L-P0aeKT{^t97Ky=mvy)NJ@PCnrx}
zRz!Kp+O!sdpu@e^Jc}G48A9m5p|4SICq6wbefrb^^#+5!7asYA9xNPt!z5eYY`pyO
z!<v@|&&^=(b>lF&aOqP=z1{n-Urdamzj<@-__17N<_pUyhqE~M^L-5Zd0<VmTX(mG
zV@5i=;!-AAL8pxMf%8{gY}tG?8{B<YGL5(q63OYp*z(cIebdbc%@_U`tn2aGdgr(P
z?*$k4EslBd%fIrw{-pZFvge!XA3nF&Jegeo^K!na=|+C3+|R!APOv*Io`1ORPl*f1
zLY~cmjEdD}ELLj!q#fNa6gJ1zKl=N9_Ucs*nhgOqvaypgFF0ycJJ<?@J)Ik}#C!qU
zRC`4(xmk8sjmxf>A2GZ7<NMhUivKbvb2i@Bi>>+gw>&@Z?xnccyXDme(;OGCFUk}8
zwdRlmhq+RV#&T6Q0X1Q8qBbs?aOlvT^LE+m*Rrl)aGH3tlC8JsNdRw)EBj5h-fxy7
z`@S73eR^Cr%sc;y)k&AX@2Wl3jywEWZ0k0&-dk*L<#&6N@-OS|fB)S2xwpLQ_A0IS
z=2tE^3fI1s`e*xnLEyDLVVfP^H1=^Q&cAwQ-R_j7piz&ez7uH%0^HWGUL9EF!nQE(
z|L&u<9Q-qQoE%>8ID5BBu=i>SE%u7_v;LXeVWRL~!?j1yzkqM^ujPJL|EAm5y8o$8
ze_Hxz{(0@s>vwoOjDPaG-AQCMn=)JPyPHQjowlb4t+u!zs5oWa)h>2LaFOCwuz1I%
zGtcC&t$Dd(y}y<^V+&8`^2HM-t7}ZpQuy<5YyHON329wzyLNfa;gf6$^UnD*+vwwu
z`Tu{seH5Ph@21%$*X8!}?XRES|10B9Fx$+ah3@5+o3ad&E@b5KsdL0mdLZj`0o*+E
zzM3`jQpTit;Qo{2ag*++C0SVuwu&C{G7!kS{93Zx*(&dPw`Jv_wYPFx+SC1#<xQlx
z*j|43RV|-$xV^>K!}jF<{I-2RI_m#N7M|VqaNY60pLcFH`mdGxuk`P=gXiq$E#;9~
zx_#T~`cEuDQ~Nj;#=0>l_AgdhqRa#;$4h*stITZ8&Gpn!Z!oZX`C>blb*0nNS^s}4
zKVA^{ROiR+Xmj_6_ZNky{L77re^n^>U#g4i>T~(mp^IbRzWt&Y+5fa-nzIRqqkGGR
zy3G?0*DX-?N&|H#9zRPwd@ld?w*`A`Uz)NCbS+=(E>!rbWmU7A|Gxtk86h7<9oN}d
zzy7pJfBl-+*jHtLOTN|rS-o2LuzlNYj+be!>-4>h+$0&gAGo!!8SXwhW7$<BR&%Ze
z%6B>*xP2_SV^s6wscrQxCdLKa3Lz8w`~=ng1HS!`Fu7Ge-=N~Z-P=8#&*h~#^y~g<
zJ{N!b+@kf90F$iXqjS15Z#e$Ab4d`~2)j`Dx<l~DA%zGIfmI=GD<-R}Y;~xp49#hF
zn`-~l_8+H!0y78qw>QuJEUGbV3}6M7PKu@u99D;VYyR3-KYu8G^yc2b-|efW#71n~
zeq;AWm&I!R7jNu-dG*U8!Q074*}R0O@G&J#Pg|-TG)1kWM03&mrIYWc9X?lUtYe(>
zan^Zrm5X!d-rV~3dhxl^6@4M@;$M&bO+KE+%CaXTe|bY7N9nT}H=iWVR-Y8UehSCJ
z8t1*<FX#Ws^A>va`-fYrmeUIxkS3>Zd@>96zudXsJV<tBU&||vM-O%smODA`j@z@K
zEs&%1@rL8M^DL}$xn|iPb<(hixx#$ZadG9&+M2~px_)9#RmxW<PGF8>u3nuU;=W4x
z>O=$O=MR2-yx^4j?&MGQR)N{lRR^}VUWlBn?!?P0wKreh<dsZiaovR#5~(#;Is;^1
z_O|?(EhFNzN|{}jbMHh|_x~?17b_{>b>`M=DVnpc&+n#9;j!z-4=lL&M8)yK3Tvx{
z78ze2r`A?ZH#qh(CULQq&?;rihq`=Hs$lB_nL~~*Hck^!QQ6_XS-SN?>Q%!dkInp_
z$k?ZqF8`PJ>`hhgB+q2)xi4lpE)H=7xz|E`i`I|7&+Uy~w1l{WeDi8WWAf(oU~b!R
zj^6O&!E)OxnWS02iaQ<DnZKx>>s$ZEzpHi&r2UpREco2=F+i5{>cp1FJqv4gIg~zG
zpnP@WE00p1n*V><SFSWM;Y!s1c;u|G=jt$ymJ1GlU%z^jQT=Vr&P9)IHvgXbGV^L=
z<XThHQ@jsWe^Rkx?^RR#Qu&$XZ0{?N6@7kb;xT^qp!fl~@m@vN$48g8m{du%ZV;C-
zt*pH9tg~a~<liDDt33Z(-G232^zZ6@Gh0;!zW2#E@u#1<b+xcteBNBUr(Y&G?%=K2
z?ciI=DRuVsV`<SxZ@3f}nqQLU{3mhg?)MkHZ^D*ZU6Nke=h!W7f9k}7wSgR_g*UPn
zOg8hEkTi*k(BPL6-CBO?>-v2!7{Bl@wS3cBzqbDMwIjNf|L?4MxiHyn<vq72yNv}a
zyV4I7zmhk(bw|do(rJFng`19xTV8pTs<ivMaVmlXWr@|K3r|n4-n98;j>w^Togcn_
z+i+HRY14whjl5dZQWw`xox1+(`)g+}eeRrb?f3M5y<0EacmJHS{``HOPsjdiwe(4L
zwn#s<<mHr#-FRlLxxc_F<%I%r#?_L!*`SEu9lEmb%Ar?xVrEIV1{{-2=XfZY-0aq$
z_44W#{#r-J_wN=mU)az6`uZ{b$R(@l7wrD`b4G}K^ZIiBH{q-L+@74e^W$Olb}=WX
zQk9V74Ed8EO1YITu?mvqy!z4pe`mzzXP$L-e|w!)^gYj=x8vhw{;1Xq%O?Ezap~xT
zht6AH%opgE><^TysoLPWGE{5s>Nb{Mxwp|5R%~va07@T*H<H}e^=Q?#ygJb%vr74D
zV0amiguvER?^sVx-9D!qa~<T>bLSc8Wt2QU&ZH>P!&g>XYGUeoes*)QViDhq`JaB|
z@jG~@-`;Gc+~hWOxs!EvJafgIS=!DodRtye{8P&au?7VJIFzrra?hVS?b1_?mj4BZ
zZa-;sT&$}rrQLEWd4i;{QC3C#7yhe9H+)PMG?e;$@6M4_@6Ba7$CbEL1KF+{BylIj
z*2Tr&*GTVXR19&idVG)Z*4_SB9{EeGjFj8&t>CY(tUOx((e>|Q_w^M49F6;LUTzV%
zA}W@_BNeLT@S5w>;%Dc=j`(-~W960q6!m|ZZ|6LF@u>&0@7Ff7oqM$7#;GqQDRY!2
zKXZ+qy>{ZG{a^T{ax?p87+qZ3IzeES^3{(A4lo96{nvia103=z`>cJJeZIZT)V9)T
z{p)6ds>+p*;+!f@oVHxe;jH7v)~h!6x`atrU0}`8S57&CM>?0^mq_6M_5JPjoBz80
zEj?%xy=s-!eEaR+eQdLvn+y*v5j}l3ii2~ZRgmo8vvF3^vf$uK*{=0+ubA2OD;M6$
z2p(dNi(B<Z{K2MIFGLJEOgA~rs6Dek+;Opm*1Gs$BiH6OUOs8_XZe4BSKPdszwgka
zgY6p)FW8F+1^(T9-Tt*$^&j>Ct;ye}U$D>kay&Orx1}XO_9UnL=XH$CEnm8?2g<JO
z`{K4r`D)?xqmw?pUaz}#Yl)3)OF)D7>f{+mFPr%vn9|~;5$D>mRk*T|v7BG7LPGj)
z|G%x<vM$*#=6AfH5$wiUm|d#kD7I0cYoV1;mg3cm9HlC|b*G)SF5hNqcIiurxRb2G
z73sN~Ch5hzJY&N4B`AwWigjDmjjJ~w2K`dspIdUQh+k1L?`^Njl}CH44=_ZRN%DY#
zVMSljioWWa+W73mVBy;HoK7!vN{?hEEUz)++AxEMTWW608PSabUEu+HN^JiMv-c_;
zI2QG8v4D_MY02fvL$)6r+83Ay$@YGBJLKrT>hZpZhu6Qoef{1YpVyb&IbvgE`zx)F
z^ZH3jnM6&{=aUk(TB!YMz6JO4y&Dy4KCv9XH-ExEAtxt~Gdm1J+&O>mWwTOi32|S%
zcVd9-%D#}}e-F1Wm$$ss`KLxsN%0HMhRR2G666K*c2zP}-+t=2SV_G^Sutnjy1qz@
z`y06uXBbAm<W%h3ye#(q9>ePM>n_b$vFlCFpP;q->Uu-nIoo~Xet9c^yj*&Pf0gpy
z!v7~GUUA|VKh&(I-!b2<B;>e&a;re2_9H{5a=W;FTh{rn@!2hCm9`|=N#fmU{&y`e
z91fjXdEGq!#J$JiQnHcLYu7LKOcmI#r#_o^wNT$|QN@x>ix;2-Ty$aLtBQ;}J7zO7
z>fgHkvhhF1Lr4Afc{|n%JMo)D&F_09k!EO=@umH}tv|<Z*9QsmZuNWuLQX<yK6|%i
z)_%*|e`&>u<=@|xWt>jTUcI_|u1VkKJ|(6apLdTM;d$N0rtZ((3m5c6)GIWcRtR1X
zcYm_y;N@SEIrA)@CQlN6p>adu{Yue8>&~6KZrc85&xg*(qKZ!#6cybj7}TEH+WY$5
z+gp)BmG55OwSLRXyI#gtZ+%2rSx2j+<tmo_oKmWw#JYFl-Bo!@`rOt0TEw)ReMFr8
z7Is;&SvqrkbYwiWod28S;$StdCbzpmOpUp2e$~m!UJDv49`fbB=Xjo8>vUv}wAG7S
zZCii+Q!IZyeZI?d<@9?jy<D5zIKfe{#A=t`@$@q%dV8+Kb8EKv1s-RRH|AOU-|>P*
z%sGVs=gnSIqF=>dw=Y>Oc<<KcZfOoq!@es^y?0qz#l0-QV=t<(Q|2bS;+3}5E0wQK
zyypQbx`j8ViK?kc{HdJnl(EN3PMEz{%4@<zr-)fI625AGziKZdaW7X(fBnwt<!_w4
z&UHTK{QuWsUtPetne#rmaw<yv%+}Jr8qC4$@1^HHA$QqTwpdV`D8${Vbcq$4ZbZP8
zSzd}I$$xy$2_8yNZZ)_aFJSWO*01(mF2zTs|9X3#<F}f-HM#oKF4Mr`^!YOl_+~D0
zJj~|&%8&O`*%>zfNS{A1JZ<Kk5On_akH_EWlI)+*dpB<ed|6;)srmlH!7uvu{&5D|
zkDnH--~7(Wqcp{h@9M-?FIZ+w6yA~%__9}8#Hsx08sip&kdsplnH(>yIQ=qS{mc4A
z&+f&B{O4+F-t_NQUE<$cFLu6n`tRh{&mm`MlCdJ+eC6w9O)>T!5odS*xY+(OzNX7^
zul4Q!J9ZbdCne<l|EGQ8&%fE9i_`W>a({XIRAQn2Hjb>wh%Q+JURT$rKVHvPZa3QZ
zOR4gq4SO7u<-^=d_dmYq1*gD^o&mDW;`(~t{`J}|A0|wnKDGIs|Bm&-MX85+MGmPH
zURY85b-mf|dyB7dcl}$M7s39Q+x=_)myQX7&du$=w9NBY*RNpLda(a@QuB-(Jq4fr
zds~k9O4X;H_3F5Pcte25$62T47b|@)FD{LizQ(XGBll>1^!}ww7cE-3Wr@Y3GogP%
zPtOpHYAu+d|EhXD3;U$HjoJT>UGqK3{rvT(MJF`njblzvUSPE;dMdaEn-{rn&#Qa3
z=f$0RceGly?a05dqM_rYu+^+o$Hm89$EO#kKE3}-T&Sk_dEb@Z*GbRLZoF(St@G@1
z^B&O;_obZ5Eo?n(_WUYO{n}-HyS~0cZHt=r=gQn%{kqm$vH~Zz_;1e=IdtazzKJ%K
z2QMmH?eh^zDzsHxVihF&vNyzi(PXi(=T8DS8l_hxPw2myT$H*-E_C)}UjN`Gx87^^
zC4GA@?$3D<pP2E%cmMt%^L6e2TzzEZ&C;G^|CKho@h^<^*K&JBvGPrhhmP|9bnj1?
z7p7Nz>+FSZB43)0`AOV<Y#Z|<L6ECwQTp0lRhD_DSoX&0bAJDN)4E_m`Y$<XRtu74
z=dsvbmRnk9*LvaV)sIWIznpWtSMb?<z7V@h2cNEqTORwr!R3F{s#OYe`t_GN{m=XP
zcF&GX=QDqH`dzbU-0&`LYA$EtHi2Ja^LsDsU-iG<Jv;R3*R#?}?fmZ)Gq!AT`I2(J
zsQ8O-x8iShzB|?l4*hQm{bB9bAG|UWn^V1G3k_Q@lwSR~VzQaPi-dB^gmvc0EvH|1
zcTIVB*6w9|c)0i0(Em<(Z$ItcQJH+EdfoDRCZ!%p0o&DrPP>lo;@SA+#>UF?`R?&w
z{Xe|D_TK3g&%09_7X<1o-LWTWX5V{$%Qvb5PK@tX_kD2#wc`UoEukQe*on$<amQZI
z7vAM&xHCQW`GOjOH<AD2_Fdb*e5Yl<eyk1;_uj3y-#?n>yZ&qbB<<Jp8M;^gf84a9
zPvzO%i{jJ&nm@k1epC7Hr*c2!uV_DhtuOF;(yxa}C+3M&yRiCiU$x+Y^hfD~Yvb#u
zvG%&Tcg_1zd3N%a^Y$-~8az2t{)E-D=*;aUvEM)eF-_*K6sXRbep2NB)9GJRQ$?Jn
zKVCCA=V8yp*u@{VTmSxc>(sni|3dd)+kblcyZM~E_oiQ8x^{N5_?cq$zrwd4NIuS;
z@XBM+eaX_7kNflfe=80w2q?Y9Ym&0>P@?eHn>Q~l`cobq8+&!@YK{**Ql>Hg=0u1$
zvS(khN$I_ok`}Tgu42->Yf-VieR(lgvTA?0f8o*i5*xKIM8c%%#R2VujTV=8TmPH#
zVt%dIxvjmg4Wu=#T3LQrsI-9UfvXc$-5;Hcnz1D}I=FPJH21^A$(%B;+N`-BN_KDm
z+||-1F){S&x|)BPp=oWOl)p#)|5TLvE8S3fY5lu+=_TfqUTjoeSifSeEr(rf?c=KK
z(51{@cYSMPdlB|$%gITrZBCyS{v9E_DRIL$*^Byti`z7pFJPH&P@Hw>i{_86St?I1
z-1?-uQ*sYW;)NI6<Gtg&|NUp}Ra*4y)2jaWe|}n<B_8mefBnjed5nqEzMK-;(q$3-
z6BOW}p3|!rEM>FLUO4n@mQ=Z@Q}2#$D>iF?j>9@^Vw_Ve4{g}Ec*4(_9}XtD>`zc`
z75mGax1gR$nD6`5x9;t)JcQDHo8KOo8>OXPlJoe8u-e(`@F&Tl;=!uQHBn&)?*Dwe
zeOi~fxz0M_qyrIKx*r{y^gZ6DUT;_Xv`?RI-QGUW{^GCivsxL|RknMbi`XM*lGQ!A
zr0<nS=@RoG*-qgrh5bh-{kom6yLGFacFVg(eaq);sbtcqx6RoitX0wXkJDkNX_MB9
z)mD?HxN?`oKVJDq-O3~RSbw1GLuckyFF0?#nwOUQJM8dW=T~B8QzH&LwN6~P;?v5q
zI<9k~A+k%|D~l#QvE!_}ev6&+3ft9*0kXE>s_gh)vC~uMTHltE(rCGL@usxDhT~#C
zrI`PoPL2P5{@StsA1CLw8NG8^Rr9kwd=CG0YM$nhaKUe@Q$_i5gA9?@-FKRQKmDH5
zYwSD6cJFbkds}(4uQt0~EMIk*@$HoJ0+X86^eq-LG;&qVF$WcWkly8YUb#O}+|tsT
zEq(#+sh?YfIbY6RDA=r&!f{owsx9=*uI05__wU8U*Vnz%`OWoktM6-7|41?MZcFFh
z@BNJSPnsU-1U`Pze7W(J<Kn=H>r1Sxq@*7&_g(bW(;~~v@sG))o1jp&g81+6;r9DC
z_V3@jbEeac^)iOD&+~4y_<VWu`t8aujgBPoxh769^C&eb>Q;DFvA(KUA$yCS_3ni$
zPK5n;Srk#Ecc@O*_0ewQi&9!ubxX<@eObQskY%0E&(@Sqfopfpbj>!26EInIzELan
z)bIC(;ckaK^JQBmfGe0FS=*D+Cl3lL8~y!jefyS1%U|~$o9)GtdzOUHoue|vcF~t(
zbt?tZ-hZ4N@;~6;Arpln_lb60JV82(0{mQF>i_NbpMP(!@-314Sog&FdcwA8Eh-sX
z9v-Z9>B*|+G_Sv<wv#dCe8T^hzpIaF9S!G`J=-t8a9Nf8hbL#{w=dO;UF5Rxl%k_u
z+GEuV75Pg*gCbWazFM(ctWSnhx8|aKl!qdZD0}a&b5Tx08IDCgGkF)e^!yWbaw*&=
zB!5C->O8v@kAk#5*{GhM@a<;U?#(HVi#dKCSyug4U$OGwop0&qTbw&{bGO(1^faCP
z%r$$pLreTEJ*PFhs-D&*Fl_n!=o0^vXtB-?f$r^rLGIxG8>rs<e!TwAk7#fUIM#!s
ze}>Pj0&T?*Gk=S@2G!~+V#X>0$KH9$c`S10ZMVPkD>J&VBI4jh<r@o^KV5TTVY8l2
zT!(HY>+wJHm)xzGA|P*H*>v&M43m1l-4<V8d%9H}>RCA{MLgu>gjJusY7*AQ>o>c-
zp0XgY*QHOUOE35&Z$giNsb}Ja6%Jm;`+iPRS}y)@-#IZSP@w?sV(w}dyT{G_y6WSh
zvn>~TuNVg0v~g4~X}l_Uf}3|^#pBuoRqHt7^UuHFR^9mccuL)8RU3BJrPDqg|DR=~
zquu<h)30Z~k>dUT1y7%P_a5aBoc+pd?R1;^zK7-i&b|2Mlz1VdHqr6aqt;LTzg-s|
zTz`apOPFfLm-TNa&5~pLQ}tB(21`dp&`I7K{enq1_o`%U*|<bvk@v*Q6aU8DZFb|_
zdr=PL(7UTbjxQEgcjDg2dg^n_g`ck~4&9D)(zp?pUnzZu|G?if3-{f-p(cNjX@Pt5
zSGGq*mmh1d4)5^ui8Kgb<aYhqdedL$lm$(yo^DD>dH3p8=%-c6$GBAumqY~R-_NMZ
zeQXtZA!Cn1MhL^Vh>~qvI_9nYbjkI1Zp(_GX)g1G=QceF^6|LzsN_k<$u0E{4&<%K
z5?Tn!WbRduPf8jWDJw5*ou|@rF8ui7G;tv(2J25JF2%o?&FP@>!a(Xua)*?m%Gbk3
z&9~RK%S?Rr`ue8w-z)8Oe(v4r;T#z6ec?ibUV!K9j9SNi8nd3h>$6|%#%CJF(f&)U
zyV>pbylZK7zo)*DY>T*LKiOANX_Cm(9q$|$Z%%(O({;ImlnDQe&~-e|BtlC=URJd>
z-3r&-_#t42=c1LIlRUdGPkel@OCYNiR49PQG((OzL~iC17XG;0vNgcG)aLc;$4P!K
zgrCgYx!CKj{+qK`;&-fH{*%A)VZtB&z7{jTlInfGzBihP1fJILN<3t_>o9v@hj8r2
zk3U<cH}(Bo^x(2#vYSM#;u%4f-bW6fyw2^j{gl4r>*xMhSy?6d)qAE$nP<jq4^E0>
z?|t@4)THY1W!*^&LQIaVI<`8=D`4KT#X4scb~S8dWw)8|>VzYB%oH?cILFxiq7&Cb
zzLwo7XSL2G@om{r^6dHj(*5SY#6On3kpG;()h{pl)c;VZi@F^T?>ixul&MFLX#_3d
zQc8*As++Ct?|H0e{zcJ4CLB|LX!Q0SsaBel?wX-$_f5gT;p-yNmEtP9mEKgRp6}YZ
ztFAZ2+m4MX^t@N34v*B)##Cvmb+gqS#q!%_`@wkwRCb3PpWxapw`^Gu$8WACpBOVY
z`AbiY-aYsIp4@8icJf&P&cLHOg~vj!3UB`V?^Q-th%NU|)#vHw1!6yb)3@)``~Kxz
zE=%vJ(sl3kEi3Qse*5+7qy-m`%nWvYzGzlgOhC2#=6~<^?%%fho>|xYNecqMyvP!}
z<rsOtRyk_o`aAV!b{Kx^YC7n&W6=w_fCD~p7W0*sizn8CvM*?)?~B`^Ny#rJsrFyG
z^vjv!ukSKB%SUZ2CtEK3T=3n<<^KlBg})z0EzG}VcX;OKOm@#mi}hP~{hIn<$F8)c
zuOcPmYcGa<53yZsZ2$hyBGy9=v%Y4>m6dfdWhP{Q+qqzRxK6X1()Ez(*QGz7)5yG#
zk@#v->#CsXAD=$=O<j8JZtXXx8-HE|-Z@ep@;k&(PLp5iYTbW{_fx*Cv9l0ua15CG
z^1{RB)tB=)E|;7-rMEuDZ{lUa*e^Yx)Cew?1*3jg7+?PBwBkYBD~SimW!+0}f7qh1
zcguxk@0Rb7e^qDuN?uXplxNxNgGWNn@7nb0@w8K1SA!o^Z?L=gbkegkLZUAgxOL?0
z+*0%M?ftrAe%w0hNA$Q}e@~hmcc*3JUjdV<!k3fsL|xZ#>2!Bi{aX@sNoUoG87tPb
z$ArDy)Mb&e>e%n~duzFub2L|O`>&_9ZkkuKoAJIsK36t)$vjvfzNQm2>;i7`1<ET;
z(_eq;T-iQ>UDK_!W~<+6?bv_zLJe0&nZ3ZLTYt}#*k3x{75P*(aemdq&c};bg*I@!
zK78x-{DluUKZ#+9@?5_zPS7@M#*?nn@9*}#`MbsBRlX+o^Vddh9Xz5JLq9lexcztD
zeLkHp&I(#Gp$qEo{@=dvMdOnDqPAPkXSX^o-fF)2LxbFG*ZArmr=D`Kir!_@+Pl*G
zo_J=#y~h8ZO>Q42$^OvRReChzWVaS*$OTmY|8gpA5wkma_N$1ZNt|rqBI`O6``>Bq
zM`xPPVt3_XGjrW<>~+`w`W_jlMeh95If9P1rj+)|7(cpqPS)d%%UkWlTPeQJEX!0@
z)vuS<_wKsd8j#ibBEa=w;B+p<Yngj4y$pCKS*?(lb5mod#yvexNin0&T=`Fd{@HG?
zUuSbI5xHqFDSYnFui}%gH!g`(l@1eM(Wk!mD?ey*BJBw%WY3&9c>ToI>})PBn|O}W
zz~h^FygrI}T-tN<#nK}mB$!-zIHY9R94E2&c8Rzue+*V%^gnp@KhD0sV{R?$Uj!+-
z^!3GQt&n*+zy8u=S8cr|Cz{;MzwDV}|Nn&I$=_`ku1n8O4XR4~c<9_UG0zJbhqicD
z%+L#v^^fcka&pQCbw@!%YIoz}Hb!r^)7D%l@QvYB=EUaOkOc`l%v3Vpt=Zzg{n@+w
z?H7$$w%jPwy_S+HC1_HW{Ce5+MGG!IKR<ET%G6p`A&dOKf0&=WxM2NDL+{(4-Nyd~
z4`~Wt5dFC-pFM@mx4(+hEXq0lW#NLqUq2m}&)j%{-Ep}LpVU#Q{yBSh8&+!u2A>f-
z6&&$cz$EHVfQ-qk<=*akR|6GY+7|>mm8NXh0*&QVT|4w^lM&a#2?C7*Tm^mRLQNAy
zbB>+9yZ?J&jgH+E=L2yM1=16=mRi;xbXdUbxVUrkvZwM^4Yuqa?4gm{_WhW@=G=|K
z<PWcY<;91F>%SH^iFy!W7~pv}vpR~K(fPQ}p75FPCNE^^&HL{xWHL*iPwJ@Zf}0gR
zDIJ1#`k#ZcFTCh|J!wH83+uzgT@Ix#Q%dYJcwlwkrt3L=e?FaVbMKcCKeRZlxZFog
z``<gCfcdQxUU`(T%fGw0e#Y<pdsi$>{5iWIe22v!<-}hi%1v&si#D}7F5drdO_kU#
zncXeiDyIZ>ldT=qBkI?`beN;*vrI#Uqqu6<8l{$bp>g|Eb}rgeEE@gHc>iCoEj95H
zCcEO~Or-dIx5m%xFbh19-apaIvbrpDC8(+vW$(SF;kdZUvDD_kg1}YEFZD~8m<z3X
zY?uFjihNy0-6t1yMUe+(uOuGin#HiL>~nb_y^ZxiQ}VymjfN*gCi)a)+6$~<+Wq4E
zf{VY^uQt0)ettf4N4&-+wI1tR`xIZOU5)5|osn@MtJ);O$tCdXrt2zmo7|jT%oFy{
zm7f~TVWXz2SbAz%9lM2n^)8i+Ex&%5hJ2V(E^00Jo_)@N0Qo(?Qp2aeI2Itf<<ydC
z2mStNEZ~p)bno$d&61kQFMHk3sCfx4v;vKndX&Bi*ZuObQEc0lYf`E$dCU8bpI!FP
z#CDbPLG?PG$EkI{x4w1%Fxx)wb@N|Nv9n(l?b+te2@hNE(4VoL$A@E*MTUv%*P9nO
zxOxTWPJLe=VJO48LiX6VEl*B~%(J-0e{9~~?By3cckkLz!1Q)O#?#jGuV*~d(mY&d
zVw&{YwkgphYx7$^=Rd5Cci7ghm$J7k?E1S&;LV(d*RNjRd&1J>ws+4KCw(RG*w@5Y
zD};a7*6RQL7XAA2ayIUTAMdT`wwh-gcY8&j4x5;aZPPP<lj5lBPjA+lxCgX<imj5B
zIQDw&GNlbmbj)_G+~Ok0d52%Cy5n!lX2t)(l@fp4B}}5eIDB~$A<y3~csKpdl8@V-
zy7WjXiLqX_-;+Fp?TB&rALDOxFCP21g7<6dF7JCOTb4@|2EO?qu=ix2$$B%B2Xl|i
zzO%Y7b%uSJ>!Q2YU-$$Hy-2ou@N}u*D&>XXR?ru>+MD(jA42W-Z#(ApoNM9dtA>Xv
zBo|u=Wy>#E6rJ(S`QX`YJ=Y>auDElC>=IiTA;8d5nYG`X=Tl;YU&@kLS=oxToXrQ6
z9951lFjC`@nrrI&_2<Sefu*`vHw&0Gr@r3yEa&&OCG{UQ@972RsRw!fPMqxi+c@z;
zhOe7d+@^O<9aF#W(%E&OpQFz1&d<l@ExUKUS<fw$^Reya%f7OFl@@4Q=;MJ2iWd%j
zTc(!Ix$rZmu|;^>J&%CXSz4MK|8A&z{yl!TyLH!ZEmx+tT;UAXBS*x)`6qC<CVy9Z
zAGY<Y;TiL!WAA?o7hZUAD|FR#2OiFEM_12lTIa2r5h7~y(7RB<_fvH-tNJTTvrg+N
zOLi{PtBg-qoWj<dWiRj~SfnPZFfF{T<>#-A>o%(v7lJ0GCf@TXwJ}L@x%Kbw+p}l$
z7YnpSWR!=vC-2->c=z+HdRD8{+~3=xV^>%x#az<pFp{m|*{Kk*sr~Ke6)|6H*DLH(
zy1aDr(xX+X6NQ<cnk6(>>@mprV*Yi(MQ!cr$t!oAcpXqW<%?bySIG;<z56n2?Z5mA
zi`%79wf9Bd-fekX&xMPy_nzXPVVt!mg1a&4{ax95t!%}+Oljv2oQh#7TP+0YBE0e_
zwXw+xnYO<^JvzEv(I(Aob<q`NgR0Lg3$2oD*3V{Dv|T#8;>nxa$}d@6=e75JUwk9s
z)udKm)uTqDTe<@$u2%k)5USt4m*Z>eqXie=@1J-_i%s8kb8&_Lg!<$!5)ThwNcgzy
z$8s;PRr?n3ir$vpqHlAgu`Pw=K$5m?)~Xk8LhEYovKF04DH8p-*h;8MnO$~epUcHV
z7Z)#V)xUN7sFTJq*{c^{oE2_)Rq_1%{k2QYQg@s4Y?v*uZ{BoadDV2~MQ(gozps;1
zSL0Z(zQM6(>J4SH_nlU08)Y3!#MI;#yYUF#Rq0x!AHPQ+byvcJ3m+B)?%%HxyL;#F
zqt+5VoKm5E=bokc1U^b<{pD@Qbn1op_Gc?@indO;y9zY@{A7W$rCr^hw+9?D7TP(z
zIQ6RH&TLU9=7r{uKGzmj%us4M75>Hlmc35uLz}=)TzqR{u9si8nWpM7ZN}pN0xK6T
z4V;)^cciS;Ly*b-;zW&;yN+yE7I&91sfzNxu)_9&YvhF&I}F>{d-HB;2pT`x<m6Sl
zKVy6AkBrN%hYhZUEb8fb5UkpEJXt~gD0nt}MPG>fs>PQrElacNO14~ddQnqqQUZ#n
zYbmL>+KLy&h?ys@`Mb}~LSkRI#J)`#jeUK;EHndCnk}-7j1^YgEqk%}?AE25oGzLE
zTC|q;wf2=}xBs{FxTR{#m%Rwf|GVYvNyo*-=_i}qjE#FZq+Ip1d1SO7T(-NpW{;&D
z&%qmq9QE}rOPp3IgKDyuz2}bpbjsLb)%N>R2T#kZ4vT=>(=M_%GXA)be}AsV%hgBj
zIhC-z+AdSyw)c8uK7XX<sZABt24y$CZ3#1S)8LAn$l5C=cB0Ac`Wg|o-ms7_?iXI%
zn7F?F2aEgRzx&vFg@lp}oquj|2Cazz*|)M!#OW_*@`V+Q0;_8kgN|O?A@FZul(<%(
zg|ZO;lD3q(zpQd<?2SqhYV-DHt3P|Ka@9CPT5H-OF2yPr)#(SO*_@Pk`1XE%pzZ5V
zU8$cI1a|J`YId`>`lX#=5-MX7b?^9sK&L~kqE3dO@_8Y6Ny9HEMV_<^D-tKXeto@c
z+qN6;ym$Ql%>V6`2EWu%k;rd(_SS!Aw}`TG+}5!a|M=zH+i$<>J1_U1mEL&RA@-FY
zYsaa)wO6lBs*>HYsfzW~)J4CK{QDKh-fL!>#Mz$gxOj%a5#~8ECR%=;sxI8=wR`zz
z@`%`jhMg}+uj~tPmu>m5<K`V+e&It3@>~lSPf!&5$$V*B-lkBF9FZMcN;>}@Uexw0
zt>)iJ?T?MJUkYq|rYlBo`u0tCX`Y&;!8Y|@3{hgjs#^Suq|)x6yLHy-bnv8B$Hn5o
zuG05buZt_x$q+fH8_QIC)JK_X`CYCh2I+gkubbyzSnb5|^w`!Xe0Rh-EFbN1@_>c@
z%!$eZPKJ3a`tH~~)KDq>CGwMbLFM-Pzc;tVi=5OpT->(W&LZ_-jB2Ip^u-z$9$#K=
zR{69hgHNFPMm5J0NmH5KVl9q~`BNPiSG-laK9!~S*_)4to7k_u)-<(p*>ElOe)jtH
z+yDCUWW5SiY-wMecg+2)a9+=zu#HZ_i#i{tP2OAz8uwHQad#>ex$Lf3!d-ggYW14W
z0%8o4pP%viU*di5-`*Qj0_IO=S8Z7F<p+=Ja^~FM#t(HlC#$cpGvaex%>V9m`NVAd
z1!b$kJLmuCOJROE`OB7h;bAqKB5(4p2)~fgYmy<-EjA%#vEG75+n3tB+!H5%ZSwQ;
zmH(DVNp9#!J8NIUz-ala?WTaxi?vTqflGE!Yy6#l%e&Qm&m~N>8qUtYsNBBDJ9z7^
zt06&6@2A@5ZugjUYj$MkWwn*lh1-8>)lS_d!*QTT&hExPtq9@&8fI=w<_g4ym_Gfu
zYNfnhn?mQh>fFClHpk?0?zLa<Y;v0zuNCvhAm7YnYj_w>pvzCc?dM-R>zIf+D>{mO
zR@B!I1+6#Y19b`6Wi?y=F6m3xXp!oeZ^Cz)|6Shyy+3?3j;N(?pT9^(?!eEP!K(Lf
zYupg%NG<f*>3?YQ7U^xei<eG(uJU)ODu>k7_YR)HU!C}w{JWNYGI%t@Cfw4SBTZqp
zm$!@f-p39XGF*>d-MU)Echw5LZ{N1=&&chaZ#8k*L$L`4-R5`J_g~-yC0NiDXAsA4
z7ma2&)|kkRZxRax!d5$r?&_~QdfZ9y?nhVEv-9R{OHF=v?=FW<<+RCbmo&uvd*OWX
z@kfc@YioZn)jP)q)-BA7eq-RJE^;Vw-;Skrnh#D-_f<VAx>B60UvB5u!{0Y1yRC@h
z2!ENA7go#E@#rgW_S5(Gwwh|sziuOVm#OW0$a$}M=F(Fg0x!Hcn|uEx`_BtLw{O3@
zsjWTzvdJA5w%%VE;`XZ+D}r)Z3uv4|fXz4~#NpsX=Sh{Dm)tbI^G<ZCy86m}G8Or6
ztQUuLwQpYL$PwE9%Rv4{vLWy5Pixc<+HC$?=AqT{a(?dA6Z5jpXFWZ7<xuj!$oqA3
zcU2@_x!@ReuklR&K9SP=M<@Q?kNf%3!0qLmq*bpXH(pv0xTocXptFj2>)o4HiZ4E%
z-MRZO|ExCYg9`#z%<?Xr5Fl&$!UI&ouNIhRFgy37hoX(Eq6p8G)ViORO)^*A_ka4V
zpt!E=`3LhiT>Y~R!oD=DIz2t)bZzfZ{y@I1^?#l|^^RV>Dun&&Cw}=U_j%kN?{e)~
zv`4M7=2UgDwUo50Q-_&{N>-Am^R@E(4`xnHv}bQv=CrP5Uj5@;f4=Pb`&;F3b%k{6
zPb<geE{==)g&#du@0}hm{`ORWS0{^B`1&0af-3%KTw~T+{gbnhyKkm%fx&f94G9@4
z{`i0Hhi}_h{Z@2ES3f?vz3#KinHLXV%-r+$bN|uAg)4$@hNVSmvo4N*+W%4VZlw8|
z7Xn}2A6xcyMw(7<*P7ks*Rz7l>wZTDESHL{{X1*dnUYe`c^1o7`7cWSxV`R<+J4U^
zle8{Zg;hH~U-IPR4%?Q49VOhYURQ3G6g-m*4m>WbU$o+Ik^RGEy_u6gKGxgi>{{ho
z`ncNqpU6wSCb!A==B|9mUMrBbP(yu@UYBOroYsA*UygrU<gn^Nl99s+&;0A6;89(0
zl`o=rrEmAD$G0EX{kYRpxK&%ezU1}t+!;Tdt}eap{^$1oKPj~Zr~X(fxgKn<p0aAr
z52t`ap-5j>uT2S)-rj9<T3EO;Y`b3Fh7<pUPK5?^xoC#Q`D|X>S!!akL@!FAa*s{M
zmY*M$MI=fm{0}_*F89B)QGff|@87<6&NtI|WXr?-vT)k_UsYc<kMzuIa;u)2zvRXI
z$2%rj2?;$({^r6A>43Mq@=z?%F72t9-Q;HIsurZ#a(sbb>TVhTkf6hjoX&fj+=Q3;
z?fG(FRop&i&0dZ+FSS!8tJX7hb>CX{N~`kdg^=@yuAf=IOZ@nT>39BVohr<H$^OY&
z$5K2|dxGgq$rT$;o}PE~VdA3l-D|gr*%wsI(DS=-@rsIMn9Hj(ckS!<Zz!0TyEJ5_
zwpM?j088(`RaJq1WL>-~cfQiRkzAPk*vkBW>eC%O0zye2?Q)E67Ojxp;<8Hl>czEJ
zCJJyZ6yAHWu#{)>9$mAJFMUk^53h2StMSebP2Ilg`r!!*I*H+bW&UgEg-QN>rCa#;
z_<>~;S~}J1tA2}#@gMMKa59>IZ)b0w!;`HE73XIqbwvkl-Ti5a%T@6v>9(GgUsC#H
zS8^=Wn9Aa5dG{O3q8ZCx`BlgrwNy<oITyw;F}*o|N;pUHw>LtZibk0N0$uGdog#fi
zzMVdOIr~ArsQ9Fh^CE7yO}!UYx#xLv@LoQtqc*D^zdinLeP2t<Z!M=A)pzblgBD=%
zSqV8QmME6;)MmE?aE4W8<~Mh3QJLGm_NJXh_4B?ywXYZTcgV0^s;d6F#osKsS^kUL
zHiw62U&#J3czt`l%GWKgUtjOIC7x)_8LW0=d(XD8@YA#945zG6P2ak4g+}VZn3JcE
z1jNLCv%MYcrF{OIg~ZH%D-AM2B9l8F&C|>Neo>_BU1VU!@+J>)!MR+S;_SU~BEBBi
zQqvzZo=yEffA8jmKIzOuAHL5|vVNMJ1_8?qjAzOo<5o{Q-e<_OEV*XRzpO0(Su^L}
z{cO3~clEBIJ`?3n>%9AS{jRnC!D7}g-F%zHGV!AL)qp&kLyvDaH5G7#l!WAkl!TOA
z2`C9skf|z}Glxan>6LM2=IsxcKHK<|hfeGMTp{MT=$Na^*7-FOl4pW<-{kV0sIRoP
zJ&RjYws05sn`cQ9cROvrevK2^GDq~%tVvrpA5$o?d@${aoaOc_2XF8P3BP7{N+}Im
zz92H`uBDKE=GJHx)^ruOY`dEK_O7$cGEKik)TVen_|w<&;qk$rDJexB5_)$(eVe_m
zafisMe``JO{#2I{j$gm<#R|i$j)s7Xfe`4N{GzcSCUK!l-Q<Ty79G^-(&wAp`m0TR
zzVqKn-`4*7wyommvLD(hB2&fZd6%7bb$JkPbGfyG=ZCv};x%!nEIvl*iy|kPoDAwB
z%6{vHePZzybnNsOdF$0T+iHf=)ee5^8jZ_mb#x?8%#-|XGwauy?_FP_qL_Ia3|v~&
zVlqS~x%*x2uRoo)mvd`GR$k`6ma{89xZFM#y2Cqht$4rgg1%YW^4?RDcT|524Ee9b
znDsZJYF(`J#lYm8g$#*BPSUcI`}?~3ZoOEsaH65WFXfkaEcR^(IG}IS#wfdV@tMsN
zKAl>WG`Y!VcVDXe??u_`&b&~xQ+dd|G{9|!Cd;h<n>aEfO5IP)m}tIPiFfL{+4m~W
zGPgW=^g;JP<#``*d(KTwZ0FZ(n$Oc_ru_2w4ym*Hw*M7EcPZ&A>pCqyJ;!PB+_@_X
zkDYOfTb7&u{gi0fNin0za?G_SdgFaLginR}B|P0*ZYa1{GGlU&;dk~c?i;5qyTGb0
zxBSQSSPiQzAB|Ii3ZPU2!dEVwVBnbC*Y`=pI!3Uo&(B7nzSWi6^SXhKO~Lu%m8&Mq
z_R{|DzpCK$?)=>OhPm&5l~!Cc?U$dujh!cPlE#~(H=4JZTx!@5KZo<|`3>z~lQen1
zUWr&Hb|<g)|6PvXik*^?nsGI3C7!1?p1gIAU9ZYk-EQh>!)?7MR<!-lF3OLc{@L5#
z|MnWmip%b2oNTxwy`;YVS-M9?kn{2l-t9Mv7MNxo2<^5v6_IT>Sk`eNW05l`_3RA1
z80g$+@bZPlYYhe6=Sgob`%gMiq$rctkRoVow1EAgOoQc&uSJ$8E}l?7BM^CF!_QW?
zK$Fr$wx_e^s&Z=txz1(Xq4d&)eep-m9%IE@3q=Z|o<{F*4NGAA*^=1u?d4t(4`b#N
z<%*Yujw^1Ed?u){WuDJr^Z1|nrj?sL{%WyvofIe%cG{(Vc>2C;VzUhXCK;djJVA@)
z^xA5N)Ghx`pEv!zeBp~9_m6&=*m}QD!cjvwYw_Ymix(|6v&zyCkTWYeQmMq=xZ%l`
z$x+LFzdp^4iheFz9a3?s@c*>4dYyrCzt(2TUyIh|YAIf&x9>oy&aayen@*f8F7Y%^
z{KfwNNVJS+*RFNqMT_+e=Y=+ZiMeEyyE$Dlbn3ZJmpZbWcF0aBo7`t%++BRYSYS5S
zk>oY%!QX!_pEvuAON4o;l5FiJO^1vx6Zf~3{QP;KZg%RTy=SI=QBLttR&_MgefPg)
zg43HPjiRikQ>6dzo>3YiXd)rk)z{T`sux5`akV)2_eC&2R}c{T^0m^2A%nxERIMg|
z!VK;EJKnuie=B)t`FsYgH%98cym~W*6Zkh<XIJr-O6r|j?E2DZSHeOO;jCW&g-g$R
z<z1;y>eM^DVneURZ^gbMjuttAvvM=_j?R?0f4F7aF&nj@>|a*Gw$m?M-=rJ5w@oPc
zrihZssf+Cb9QFTSsvF+n@A<U(yujZZ4|#ZbU61=T!pjv<$|&eaK6PSIrF(ymyPm<q
z)#rp81n)&ue0{3;``}ilSb^8`HpDNlyL9Wtjz4|T7fUvtYnmQ*uUI|#(Z(0Aw1fOF
z{c+edagQ*w&B3pW+LHE0$b48cw?$<At`3h=)~p<<_RFSCl2+O~@kOp%#iSA?_D%Dc
zCv>K)c>c#TxhZia@8lA#OGh%;ezdwR%`00Wwxwx<c}T^DfRZyGC4vRGDh_w`N!@y}
z0t9>exLO|fODN0<2;unGdgMc~^383H=lJ-AxB1NSn3;6z?*g`$w+<iNb!*aPzisDM
z?Ryk7U7Ts9O^sk`#1czhPyg#1*NFB^nYXU;%femf?G~O8{#R1Dcr&NN)+L7XYj~JB
zvz?0mKl4pZpU3s};S%}683tVz3~_h-{qv@WK4dEmu5S~_@R2>g^yD&yg%_Wm-gM0V
zv8X5CWNFnj#h{*5ArsCoEc|j}$>PU94lzy85qAdVIZ)oa7}#iFBgEVCxV!7n$NV1`
zH@^Gq@9~H;Iiff$TdrQ^t=}3uu}$m=Cr!Bnj$A$9s!%dF@UZ0kt;va719^LwC|&G#
z>|#6Lv&-N9oyJW6`S<dfnHvu{?^Ls^7Gtx1|K{B)uh&Z%yMFiwuz9Y`QrSCm)@AE}
zVBwh^iHp6(w*LCmJ@YA-mkBG!S*5Kj8*^J`JZ8VwJOA68WxbnAZ;3n!nts1>c8T}1
z+6;|PC(l3mAZYt+z3|$L5mVJ{Ut2_$qzcJ)^+l~+^<u@H6<1erwRk>1X6fGQboayJ
z<fA{+-^V;F{=8W3l7I7zbAfD`N2O0$+)g|H<xK8OBh9$OnO@qb&)F&4rM};__1Z@h
zTfS+*X}cG+bhh+-{h4!>`FqrI1(o6r`})pEZ{7Orma22dn^iOU(ih!2^-F{0SYCL2
z^z7yAlR7k7gJx$PW9RIx%UR}L8p-}K|JN1W{QWy0t-F2nf2{N46Pz^`8#gW#l#0DG
zDcFBW!<`!I6@ngB2VY%z!n_bvf)s(v5vIgP7Yoxis&E#YY^XQrNIKiR_So`!;pJ5#
z&r0=7&-t$3&(*c#S>E3VvC}VbKL{^<={oV_)8}&<0~h`c`TuoO`q`}Mi<Onk>#g`U
zzT3I{XxyPWhtDnTwmg63neC*Of0L*9p2!bscx8P1$G6uZ&PSO|qa!8xTIQ_sSXGpN
zQY^3Xx$c#Kl~ti~7fw9ABm4E_jy)ZG1=kd(ExbBCj^+JP;pP|ie=9u%c06nTuA%pU
zeNBc7N4SrvaIJK@NcXy)Hjp<UnCam|XZJY^iX=HspSRkZ{Le;w<AzC7rl<dE67Ewx
z`efEQ>GJ)ui-I$@tStQa^}5Tk&oyqrNfwV=uXlelF)``=cP?s)*8#tY&uo82UaAV3
zp_Tn4(CAY66_Z!DCtO}|y#L@jg~IExp%bh4u58|DXH%dP^5?Qg*qZu(kv|V~p9)##
zxYhXC{Me_de{*mDoELQ0S8amblNljbpLVEBe6{@C9CNkR^1JNkzkB#*ao0X+LnW1c
zR|86}xVgK!ySnF=geaV`JJjk{Y@~JG{`vHKa{gS|kG1uigs<)V^2W34%p<}5)#mHJ
z+4lB*S-!KyEwW$9JH>{}aPQf(|F7vkJT6}?^~(CR*X#X1c;@<?bpEyYO-_88Q4rrP
zt5UBNt4@o<d;h(Pu|F56Jj-fcNSjB`v+RtFHI;83##gb0&b?;)J7igr{uZXBK;g=-
z%JvK7bgDd_<#K0!{y)91Uv_f+_Ck|A=1Ug(thfU%XFz3*!;DBDv4t1!@NJ4X_V%up
zm{x{(zt#3dJZmlfHS75(oBVQWS##pSM6uIX^!ne(%Xa>F@R+e9%e(BA^@}N|_-q|C
z{{1-n__*scrPAia1^ct6)Onl4KEAqYW#cvPtdkncRmA@Ml#-G<owqa4$2zcbqG`}!
zO{?wm9ONpWU;1C}{@DC*oyL=AS9>mYIL*`g+I`I|o6Y1zRiVS#%@WZO6D+@KT4`Bj
zZC$l!ana&q7YY|MJ!BD-I{S8o#dn{36RQ_2tvsXg`be(uv7KpeBlcXVzi{cY-zSdV
zpu?WFSt(xOk(yIu!#c(Pxh`sZ6Cdsx`8Pbi=KquAtJC8rN&dK~^W;X$a@Npv#jDFJ
zn2(in`&HkP?OnNGb=uU3il?cM1eF{#GNY}nvNE1{Gb>satQ2zpzT(|y|8kwUEBEgm
zTdh5vB_u0)!AEZ2h3<*_XD&*0ZESeS@1iyH7Gs#+?yt-K?4Bvy&B9TvF-2NbR#bK>
znEY?f=<~_F&hX)##X<*KX5X*4s$A)`_SvV~`JKs6_Vr4yIa^x)=acv0@c1RR8hM}e
z7G7NU>C&go=R11xfBf?PmLuD5`ES$g{1fM9GH(t2R56cHb@|*Y2_~_7xRq?fWalzR
zZ~vjr^<Zby-C0fMJNK^POpkSS?_I)TX{F_Q^w{U)vDRzvEfgvHWouBb7pYS(yx?F(
zvSO1@&RZQ_!(aZd=hwHr7iSmBKX22msmxv6%K&mX4F7k(bf!g~`!lm_x;i7rYCS9d
zSmE%i8aJ-R#!C8s{Cn;G`y`JNg-dc%w%k}>>$fm4gi-nNb=$8kUqp_Ie`4DzUpwJw
z>*5;bYf7dM-QBG?>w9C@JYBWc%IcnW>h>#JA61Aw`ls(M`QlYn#n-0~O)OMitXTLl
zK3wy=8Sk|T!Jd7G)pOG9KL7daxGwXs_j&!jFRO%JW`0+`Cg_{&9=-jOT-REU6B3Wb
z{zWWYamMS6>*x2|&GzolxW2;=R5eM<f_!1h!f{yn;|q(;7S}T;%&5;Xv~;K!>t^Kf
z4qR+0eWLK`**`z6m@DkxZ|7e3#mrQ1=f7DeejL3X=Nh=8bdSx$)RL2P5`WLRIcd?7
zlL1;Gwih=h>^pI}S}g18nklZolj5^qEByQV?GmSFc;Z=i`88D^_H}(e@A>sZ!PQM(
z!i!H%`?I6k{B^sci0syq$q^-AMI%mpxcTq9^^)Ql%l5@;Pg`5}<KWNZ@^hmUc71!P
z?y^}t+2J3zaM+x3v%Aet-u;*q7FUt?Kykw4huY5=ope-H>QBg<L^d}W9$gW%a$f!Z
zBauf>o)^%vf<pl{S=r^?7czvH)_NZijj439s$8XKbDihjheMl_R3zj*TU8b<$mHMt
zs4v>qY4PfJyRD~9wyC^*<m0-_izgKQ-m)^2KdS7QW{1y*C+yL)nnF(qgtPrWa+Uwi
zY3C*FY%2?*3!mqH>}0C`!Wb4;Qzv%E^#76M#EbPBJKo(ies8hxc#reNK;|vY^}DoA
zIkN@t?B(T|Zzc3nQkJ#laJzAwpw)|*stiX9uNeVJ-&aj-FR4;r-sgTiqKnDk5|53Z
zemo0@wYOLV`<flE%eF20>m7CP%EV8{d#A=uE%N`Q^-RGeD!@QXNZD;hfEui)>r<d1
zAQzX%<9>YQ&TQ9=z<*ne`WX#`SkpE{ER7bQ65GUA{!=xDX>IiaiO^FP%7L{vT|aI%
zvOmqdwA<C&&x%i#b4uohn;o|p)<wisHf~sFJma2W{W_V`Qx{E{n<AOF;L!I)>r<o4
zOGUre+$}zzqC0)nofVGX?_MjvKkd7C+wngeYk!%Dl>Cm0GAR4LJ9W|1(+}nyV~Z1I
zEV7=ix9nErmS`Wf4R6+5ZrK-6P(RUkc3kz$|3QTgfh#0E7d%&STC8$1)tBR7QOvS{
zhF8<)IF_GUvqWWT_7hdX<<t9}7PmSim@yhcA{W$UNUm#Pdic=w_{oze1%xIw6{~Sx
zUuznrpSwBzSbOJhCTmX1u$L><os#?(UNl_1=3o2WsiN0RmPID0$H-i>{j8$8%sX$#
zv@{hhr}B{SjdIFd-2Pt97pG2NYWwiLe6@vW<V@FheD8Zr`RzRx&gyyiv0S3gx48dB
zK*<)1(6;bKz1?rqe)0rsNgB2CMHIcfAXUb9>`d*`z2y@_rpt2ie$rD5{d{r?{{mN?
zl}^Spq5^(CQkLoo3i-J+{m_Iz)5Z02L>s28*!9F|Uuuq%tjQmypZmH$89bMiS9o)r
z;hxOQsaxmQcsN=-`x>-iR=VLn17`SWMo8Y30Ptu=M8pgQg(tkWLGShMESlf0GWEvI
z)6G#bQj(jWJ!EI%XWwbr>ZW~4>zt*s9qSjTuUBTNs6;%eU*XcRGwDQAubo-yruzIz
zAAX$8-^Z88^-onvME0{KUv1*g70yXt7PFmG;{5h_U93{q>}$UpSN!}?TbSywX6f>M
z_X6Z=8{Bfz&c6zM^p@|R?*7MNKPJdM*miSsk7Pp1a}T%D@KBGX=DS5pRUHhCdi<Ph
zn4gA*{K!@OYJTDB$u+jwVeXq|-O&qLyvQhPiI;1}l<ls6bWeFNym(Ss)p>^WLPV|n
zf<wShN9&XOzs4k`IqE)5+}tek)^Bfae(+<lqjLYDu7^t%#igb$m^DRAp<2!OfQ(Y;
z0@ry-fs5j+9+xVbt1qvM1a-<p0=rc?HFr-~JwfEozq7OXLUZb7U3)m!>1oJz|HwMK
zf(9{{#g{ZqS6t~hX8kwIuA<-fL%L05`*rW*O_iIRKk`hulc19E{i#2%h`8S#77nfW
z53#4GDJf}%@BMc2_>KNKS~Cws$Z8t@i~0U#@=x}bV0SUuFi>29#+^XTq24o%0ZQ|C
z6n+czWNO}Y+27IO(BUZG#rvLqwdW7LW@uC7DIV`JVQ~RhubFx0g%zd?!cInQ_>-xA
z;KH4R$L8^^-~VNvxq4z_Qea{BjZfcZKiq6}+Iwcxt+n+MOXu}G{H=Pj>{7#*^=?a&
zG-O0O{fhFg&Hb`HH$D6Diu|>E)YZ=)(scc%<9Ofbeo0aJB1U0}H>X1OE62^!ifets
z(;*>UuOxe=sBMzvndLJA=R`YzTSSl;m}n`WCNG;VqORtw;rLf&&a+e7HgZOuoB!?I
z)<;U`TbF&;_sQ6DTh*k?bHQcx$2%6U_~$fPZPrI`_V)UJ|Ew)NeG~$wJ8FcM1e=P;
zPCnghJzei%^IfA%r&|*vHgbPXI4Ka+elnCpw)5)l&>2&#{G%9eb}{&{i2O8mGTOg>
zYpQ_S{&?Z_97|^h@-Xx&h1`it`s)1s@~z|7D&F;Ff84FMD70BY*hVw{PxIH(f|XCS
z`d7@DTcZGNfUXS-EeTQZv9ap<?6S#8#58qd)YZx68@SG!^h*oZiL|&~oLs=!JBiI_
zH@lGXZ`JuHKkj|HSgEA(f8E>T@(GS^mUE0|FG`kMpe%DVT{_cu_us>=&rR#T^JW@u
z;NpFF?PYM~<U^~)mMJ`teDvARpj%%&!~K~qUun?(-t-5{uE%B0HDeXLIRD$5zP+xu
z+Mm0mtoy?LE@BVItf`4}Q&m?+nX>40uxDi{%@bI&M9(%LRCKnaLO{&d{u>g(0R~oL
zT^*ow3&NdztcO|_KEA@j^zhT|Jh70?0rRUDT4f76eLm>!m?7d+{C4e4j^3(fbq~3M
zi5uLXw_S<%cV>=D7uk6++V!(gX5+d~mv;HvAG_?66=^CY-PI@dV4=Ui*P6%Cg17G0
zdc1R;7GG6$A#Y*kws)WXQ+*S5t$B9%dj<QEJNs{1^RHiVZtL6m_OD#{ZdAWNCNg=(
zz3Tpz+vZdx75ThBd+!AY2h*h~s}fu%u4_tSwf5R4f9L-0&FAlB9CIv8+wpDJwcTy$
z_MhL(Tr++1kIMVsOMfoR`+ZtJCgYu=@049K`>Vcif6!_BzUE81sqJs2+i^AL)G9dH
zp15a~e{+)x{y1sl*=uJyvsc_b^nTUeefQ!f=L=f!d1}9JVql(nA@GGpo`@BfY-=CW
zq3Hg;X*Pmow|-w0Z{&Y0sS%{TBl5)}i-Ow47tf}dR535*>DwkgyN!2~cuC`>&aO>q
zzT%FYvdTd-jh8>O|Cn*?O6Q(qZzso#{bM~+XA*gS$=0e{9P_7MVK6Qd*PCmR_<HI4
zeX<;W7uIDO3e^ew*|_pv(%UA-eyL&mr0sFX`Cc7kzw{~hzfg&Z`t2|d*De1K8d_iW
zRc_m{*X?Fn@8YsVB`!90yEp1<<qEF*3NE-1*xcvjzHl)c#Odpw7#K*sRebR9|MM&C
zZ*ComUs^HY-j(38`h8!j+!kN?HK)SCQ^-o_xr6sM<1%m6n*aUxFN;+Dd^1yT@x|%$
z{H4C=ryJYPGS$#sJbT5?o#$3|-%V()_cQs^>neDDm%~f$ueax1QqEdu(D<2i-ik2S
zEh<&ZZ|zJz*#2!l+XL0L^TJe0s)98?P1ecEU1zSE8GB_dv(v)GpwKN5vGUr>erPK*
z+m|&RY=@2%7)h0O<s0s3V4L^!f#*8@TNziRPX0*#e&N(p$;rnzyH7gOJA1j$g0#G+
zB~9`Y+%~~m=U?YN+1YZi<l?PM|95;(7C5D(Hed3xT6N#4efi&3-rc?H-t0*tCl+sh
ze&=#n@e1qIx~2D@T}e`3H^(;m-$nK{KQ^<hlr++qVOF+evq$_2%d<azC!D@FpFMg~
zP{u~F?Jk#&y<jYF`E{fh6q-8%UudxMwb*J;+F^LG$L(-{x^@{`(u2(M&ZYZqe%{z%
zfBi<mzYh<UBWEtTH+}DSzjJ>#|MvVfU!}xnz6GDT-=X_2pX7Mmc6k$b(Ad9<t4dAX
z{ow=o{g&OS@_UZ2n78)&n%KAZ@~7!OSoB}xmob0o?;Qz;BrmkjF_<>tdmi(QH*$W`
zb~9A`Pirla^3>$_GLe5^8?W~`Il_fE{_=wsqs6rk-s<mF2zf1iv|UJmOV;#-Mu~`3
z)`dVWIgZ0pvdN1Ne_bD~e%5kA_WS9l^TZymIT|wQSN|JvmaJP}Z!XU@HT`#AnXBAj
zhV(9u(hYH5yKHT3+&s@7lAiUsc&_U+&i-8OH)hYzd{B=0^gu$!QTI-3=3a*x8`92Z
zRrKeDCTuz$7nU9;_<kn$*|XOsWr@F6Dwm6oza3-uzxnQIyJqQ^f^Rq1@M->;=nrz1
zIV4XRxVwAL;|MlYImYhPJl%h;R@Kke{kFc7mYfwnCUf@IB~$nEk4lBJdNoh}-v7Ie
z%d&X$fALe>&+V0ON)o(qD)q%V=H$oj*USI6&9e=8yYA)1rJ1pJ>gtlOTv(H_<HeaR
zCl5=n{&KfGC#dkfdHluZS+)Ojx+aUx*Eu)C>f}x4l&02m`{n0mXB|nMqWEyn@n=>y
zI<KCU<t&{N_UH5b`WZ)BKyeO9r2_W^OJc;&Ie3JtZ}`4FcJXz+_^_S+ujW79H(NB%
zvm(<e`%CC9-Qvr~`)=+1Vjs5q_OAoA+x&DVa)^mZKKU%~TAX%s&-R_(=e(A2pI;TO
zw|tqq5RaZt-H}@x3+$HK+;g2=rr>c*vFFdm{hJpz3&ua+zVF4?a2xCG=V}{DxL!3X
zioViVD^(z_Au*w)&&iz^TqH@AhzQ)PD&e{Pgi~Gj!-4bm-%QMI+>8r99U<84|5Se8
z{NER39yVU_=P;<fqj5;W!<_Toge!v1o8QlLZCUnT%y<jW-9)*=2@9E9&ai)yZm;y|
zUtT!Hbc)c4mke1aqw{CP3eVH~w_WC($M*Y4O-f8DYwx(rJ&H|8d46^E6h{9ycN{$@
z&zQNvAVbt@UGFYU1xPvR<X*V=LZCy%Ytds48TFHreslga%|Cnaa?)}4_s`GGO_pq!
zBr@?(>h;RGW@#<#&u4uuTBvEIQvFk;>(!FOpWka%yfXTlK2fMl*3bX3<F?%U+vA%%
zI2c}ADlXgDxIN*=OP!#_#_BVS*;jG27rcM|U0hl{$a&}O8IwvD`@i_yf3VP`^i0Qw
z!}bdw|60MAaC`2Q3xRh)xd4*fj?DOwcF4NDeiBPF@5|p}0ReBn+_M!qBJp;y@#V<#
zbIg8z*|+yX$W?#)FP{p3@B97B$-A4m@!Dk17G`~pX$@a;q<t42%XeMB?}~Hq_hSF(
zYc+3onf_<4`)t4Ao8LaxGn{d0XJ_$63o+b?3OaKo>3VS4yBGYOeUFaqu;y!d<OV5?
z!Li5jIR8>c$Rri6j3*OIDreSgee=z>^`tFN5&znlhnb99|CH$c3DKHf^F~XeFJ+b3
zwWb|apJQyoEo7Yif*2Dm{WkABXnR-8NaXJv&cko2->cm^*k7aOY`t#U9~=L~`s<fe
z*UYZw-E>{XwN;*9BKfHAVK&#A6^kzzDyoGv1c36NRhM*Y-zEENZmu(bNedji_eWx(
zis!ZO5u4LO-}i5N=Kmyj=N!YQUe(h6iYDh{h4klspLX<h<m08gJu;@v{-MkI*RxD-
zPQIQm&kL)y3)NmsFV$*)SEayQ{p@M<#)`&j<8=n&{j!VaRM=jhd1?Fo1($a(-n;kq
z&&@0I4*y!qe=py5so4>UQ$kkvv<h#1+U+#y1t?XQuI7?mTF2YcsLj-1u;K})=OhM+
z+1I#}{`4~?f3r0%tUtJPvYKa;<cSJ}|8o_s?B_+6tNxBn_{REoQHs-pXNT4<3Xj`T
zDy1*EGIi;Po6DR2#eMy_aSp?(pZS8nj_X#r+<kNWOG0$6?(2x720z;Cd6tCluG77J
z>-B4onvJjKm(Kjfz4phfq?W_4J*Hmxn7>u)P9r3!Ag&T@?0dcV%kjM`cfYvEr_C-n
zck@-V`HjaVbxs)*CKYpw*hEHtT>iR<>9X`BVa<s<&s#>vo~`=&>Aq}%63>LGbGhv{
zy}C0|cjgoJO?;A*J~oJFJT&%ao9%2Nc3$FKj^>H-^|u=q?d(zNYJa!BlTp**^*^g?
zkzUKQuiZ61;B;!no0lK=_p9W^SU*_zwEXVYKlA_dxFk6(Tnws_N<_@tR0Y`96&OlQ
zRf((>+ka1Vq2Ii?V^cWaMXywDZ>n$6zR@3QUzfj4yFf&D!5W8bld_;k)>~Iknk8K@
z<NuArN7wK5spOrLtlnAwj(Owx)Qx)=9$fj`w1j=%`xuk?o20kRsn{6N;{5aX=QW)o
z72NNt4=(D_xmBW6se7#_E7jo;r{&EkhtA3cv#*>jm7IJ$yl&Hur5hNW@^p0<ewz9J
zhjOD$ppaFP36}ty)&@wBy8T<Q_(EV;jRKEliBDIjm*fw7uW2eT+ZKIGWv;s&Uvn<@
z&89VF75!{}+D~J5*UZ$C+@>8MEX_5q>QBM3v^Bv!EAQO;em4Bg@`@7=w<Y~PZ)&<J
zZto-h*=9DgCZFwpCgZHbvVL|@a7Ayj`udG>Z_j=|q~7+@Mft|BmL1Le{}xpg-)eo9
z7UtmcD@1qRJh8C-m)Bo4Q(gGjH#2z)W1@f%ICp?bvJ&scg4mEL(b>wbjjH|(jf`F|
zZq%zLKK3-#e?PJP&e=H<X}i8VR4ou;VO<iK-pp)x^$X9ruQTR3MZSOVet*=t>W|Xv
zf2}SPd12AD&Tqo{$A5kvdOq*jyK9!;i@MX!omnYdUcYb3^^*K=pR$Yi)?{BZDogy!
zR4-L*mgkkY$uRdzLEV&=zP;gl7$4?NgH%LTT(V0KG#V7R@>v~oW$&nebgWKm<)7yA
zmmf^5n!ab;x?@yplyRhgOYN@mOMf`$1&X@xc5<3$Se>2wo8j)lEB9|@W!?Ewx^!(X
zqwDuHwhwQ1uKDb?S*SEBbf)5y<A3dI!sW$JTc+4BtebaS)aIwe+0_+`g0}NK`JME`
zGlS*bvYKE!6&@dsmSz8zEV;elNMm3?WQ7N~gw47T_(I~Kk;0y}T{Q|KR$hWyLAP{e
z84vrfYHHbkS+J_=|Gwng+c(~rGyV0wIln(NUwc@&aqHFGwJ-T&KS*p8*jtbjt?2n~
z?%cVhh0?aaH~wY$mSMZ}{gq4iHm990NaF15SzdP{_S(zfujY%Bgp&O=D?e{_5c=>t
zXwr_t)}N<bCV@&2P}TE7LxD%X<c@%-&3;bVr6<B}?%B?}bb+byXP1aJxx2G+Un?xC
zwqHB@$<EF9;=*q~ZZs1+!N&a}*=WM$Iecf7XG*RSF3MnT?_;n``n$vRw}yVl^aYVu
zc6x_Sh@LAeJ5ByZvfG}ka%bPVacOeOhPUeqtcnhOp-~dDeU*wrk3dO`{3-{Hk|{IR
zBzyF4^Z6Y4@%6TAyUqM%%8Q=!NuT*V<t~H0jOos!7V_)wZuiK0@n+q#rF{}b%>mU~
zy%OzJb_)yD`oT?yM>|uuo_g$h`|iuPqTS+~GOqu7zyGU!;rUJHclFt(ywUPpxU@8o
zIqXj9^<L3qSJX>HzzwQN4F+E>7RIh%T6iI_D4<>LG{b$SorX;9(aUZ#8*4b$PCjEK
z^8dUXJNH6Ivw%m%#j>VW_lg!Soq6S}oc+C*d#iOkF32-`oV{?%eY@@VFJJ!!|6u<3
zbJH}w^IMY-w*NEWob+htQHKR<J%T(kn;8?|tCqm({Dq4f3^G)Ycd#ApU8u3gr10*R
z61)BS-M^173XeY&di0?ZS4pY#wdb~G+s*yeefpO;`W>Efw0=5YP*&c*^K3gGYA|aX
z-F;p!zPbKdaM$VX=hqtJ>(l<eI@*2Xl7Q9={uT?zotu6ya=-F8=9IchufXcra<3PC
z+5Jf`DzsA9bK$ZbFJ`kiA*xre?aUmRvrWGGEBNftb<of}V7u#kVSU=Zq`4EG=n4FB
z_|Z5!SK`3!?_Z~fJmHzvaZ&jzqrYEVd`9NROGyP<b#F!YBw8$g@l?F(jl1cERgt@I
zH81mdebMyQdd8^rD|xw?CX2}?Dt+V^$?@<~$)3l*|NH9HdFG$)o~%wtnaEKschKvB
zlKqE_Yhp$`N97bXH0{)0l?Bd+l+>W?tIz<-z5;Cx7gvaQvUt2<l<jX({qoP@#PL-H
z4UyH(%=&*+H=Xhq`+q-4k7K%#O54#x>GQS(?#-5!HApG&Uw(u=sL12#r2fC<!R~xp
zPq6R5sB!VF80$r4w?_hpV^6PnZaja@4NuPtHQ5r@drDrZte14*sbdIITNJb-^7I-R
zg9qn==0ge-b4X!gwA1jLSg)X$le@)*f)#d(>!v?-(J}o0=l<zM;!#}OGo~m@u9voR
zm+%cNTRi85rGU4@?74^K)H>cD(s?v<)!#V}&Nn(pG|s!V`F8#_C#MCbt!66faqnk`
z{i!yLZ;|1CUj0$=t@Op8C&kUDU#wH|j1oO2qfv5Y0jTm?;pono$g<$^TJL!iTKXOY
zWJhZDIDdU}?8o%l^FF^U`TzaXe)uM3fqc|np>i=P<+-*Nx!a~qGZ6Dwz!W<r_5I%B
zy$-Fb#q}n9ez!mR*SXnuY_H!Cxbs6sPajnEJCyC&zwKDS{EIQ$FTPOuzING`5Q+Xv
z@@;zCE+sc^{L}ostp1xO>tS8v<vZDxf6rFQ%nf0A3=JA9E?L%=h5dcoO)8y)%*|BP
z8k}9W@8(TNklW)w$AaDBL(=Py_O;@zM&%2b4(YW%D9yY1V9x)@J6T@7h5Db?JTi~F
z`}b$i>AvNhlMDAfuu7=hbyn4EX>Jko?85gaPjPu%%{MvapwQhT_{`2keFD4Zq#n2M
zd!^z1Lc(0KSJ!Hlh*+(P4t2QU{$hrX$)r3%t9QS@WzSNy)|<0D`%8wO+1`m41Pfoe
zxmzU8)6h?T`sw9m^|C3~*F<i8eOYzKA%^fJrW^WhruDlm7P)N0&m^m<8?{XS-n<=a
zFRZRyy7%n)nbrGE`lltdM6Z-R^spvmhsc#J%L1yb*Je*S|Ni8}{5w;eB3Mn2?YE7e
zw4|4<<)AmX$p~sgJGnC^uAh1(dvT!WEt|S6KiAxdnInC2L&e6JeRp;iclaMLX=Pw5
z*X`rFJuh|s=E-sw-&ChrZZCRvCwZUImnpxZtqjk9c`UE$DCfBS`Mdvh+x{MXp3|_w
ze3Oj*`P59|8iuZxY5&wcg9^Ml-pLAZ$sUDuyKhu0+_~_+(Lm7vWV6+Cxu8$q>VKQ2
z8piF;PxX;;*K2CsS?-u{@!O^Cap&uE@?L#7cy8VnLFdhBKAy5>C*n(0?lSIJbi{q<
zdEeSOkNuO)dsIFxoc#KhsT0RR`zZ7O*ZPj;cw9c-tCTiD=b%H5<x7#&J0A<&tR8oy
zuUe(yn)LV3BVEG}Q&cn!m-&O6g;zigm=`M?kI!o~C|KL?ax|WwLpAfl{x_}<FZ<8A
z75Z}Bq|z<hw~L93+I(D*d&5LUE%{JHlH9Fb*;QYB?yZ<(Q5Nzrxc~jnn#|;)M=$qQ
zTbw$lqOqv#uGDwGS!Ry=zU{j8W#eL-diO`ConC9cKQ+tr?=gWF{SD8#mTXF2l3pnF
z&1uq-=y^69U-dOXixzMV(8!#4q$qh!!-o39^E9)cUD-0xx%$q|?32f5R5Atne3>{S
zT_ioCbmi94+s6J@*2e1n=8G>bj-0vek+|vMUpsos78J)?Ret)kGI-hv_l*~C?)l#R
zKW=x)%Exzh?%By-aqi*eZPP?Pi+Px4KQpPnD){~4w5C6=MC*5mzx?(@*T*ufX3vSR
zcWYEUqpTnJ3C)ERGFDzrM;<g9BwZ*>{%;^P)r_~VEN*$f<jv5P(&n!YoVTBMb3eZW
z(@Ck|NxkpxESi#DHp@jbfO*SN-C*@lomu%h<qLP-+$+C1K+5ubnEaQ=O9M4H8^vxM
z$a&Z}zfPm>ZK}bfX!g3Fou&6)<hkkAzn9(Ib#Tqm`dfYc_l$d%%oM(KdSA8Mvn7Q!
z4{GCU8<+B){4_1{eVzA7>GikLw|)6zt>-!ES}UgjC~-@HMx&UVL}tD?@$jS}^DkyW
z&xRQ9I=SS!t=Zw9l|9k|(%;T{_TRI7Mea7YfJIDe9ZiZ~xt!1ZQWLcMv0iiixfF%R
zt=IM9)%22H&#C?^pYXpte)IoVN4s}V*Lzs-eXX<hzX#WT9&X=m`+Lgf6YV=M$d>JY
zzdCi>qrjKZ`7u_7hxRo+y>dI%UM^~<Qt>GkaiQZOI&<>ZEnGPHg@&h*)Y9xLx`qoc
zz&f<7Ew#OUf)i{M9j(79J)al(V?n^d)73v5&(G`OOg>TZVpHbLS-!af)&VC9et$my
zVcMyB{cSz$3}<5RY<AuB<B~i7cl(P~?jLWP#B5nL_bf}$ug~=!QJy<P<#!*ff9;Xh
zR=RZB+3MSoDk~pFBr?8E=a+j>EN1hM<NoUh`u01y+up2<`)9p&)tB{5TdqiGmcIK}
z!nxF`P1M$Z<*$d<ez!NjF@Cjlp};E*&!CtsjEN6~z(W>J$2%O{Jsl*1Ud)i#c2Zbq
z-`v#C_p~bCie|HzKHBv9&qZYy#|Lj;-t$*sHq(vRFCgJzdj2g_m%fJ2QE6F~#hjmG
zf)}&u{*cdIUO3&wZu$A*-`wYKDenIFxij7PsFjq(?hi%5UHc8E3aRd0xn+`5cHXm=
zzyH3(>Q?TwyC%ymSta(@==P;OJByuEt^`h6(lTR3C^Op~4?U(g{ooQV3lz9t83nvL
z6JKj9M>4M6yU#B7iovCOmA>4nKi{XX`X+6CuqArgUstam^-=THzv*7L?)_k^y&zGk
zYTd$vkFNinefCT1?p#yTpZzu|+B^C0`Oi`4zFPn1*?FxTkB-esD!1>Lc(mAVZuK!X
zs*l)SH@7})g8%7qo8kpsx72zU+@4=86~@yyf9=1_e11+&Syjnir`o;KL9QwRHMN#L
zXb|w8>aay|k*NHneMUmhW`?}|R=4xbf&TmN=lo}6bvS=#ZskS;VGd2kI`QcK_fenn
zkDn2?4*0Q3JL%!#@Bf=t^WWdTrA@B8E<k2`U;cfzxKGMcO|m*|%_?VA%&FXBFgHW{
z#x9G8jdkI(o7ClveU?ge{N;IbJdKTSqtMcqQ=ZRS&tqm>H{(t1<mGb(vV_dNF5S{7
zSm&<_9VB;hf4Qttz}3L&SgVkL*GgyhAmQdIR=a!S-Yhyic?H{p3zwOqetuNCr6VX^
zQ2B97Mid82;j42>lPe^;Hti_C`TU>z`<M@k+Z!D2WviJ?c@|;0H-CM-aY@wXs--u#
z?}+4nAFxdLr_GdqIntMVZqKW>$~_`b_e48^_tf3}QPKS}%O0isKR+<(di+MWu$A){
zELK_jx*9qxB~>z|r+dkPMuSZ|3zJW5>G7I!NMa-NiZh=lyPZ0=#Kk67WAVmE-)|q;
z-Fisj^^T)oUcAa&Hmh$h*WtQrtWke|umAV=XaCu^Rqt*ZUt{Vj*SK?nE8~^_5{Ktf
zyZa99ywbb!=H_&ReJ6e`4OVZo{jGOFC*noUg6mV>w@UK7INg6FP$J0duYjy-XW+LB
ztl*LFI~pZZSX%m&BxOStc_b$uIJZH@bl0cy`x_@oF-<FaH`}*gHRb4nxwmauPgz~R
zlH#`D-{o!lf6R$2&)ZwSZS4fxj8x|s+rPgnm1YXuS-N@3sd-!HS-o5Qv;SPF^n^?9
zS-LBauHW-wy~(V(D`R_1lk5-wnfJeQ(uKfDNsHOm$Tb|A#|ar6UKJfGB+zDPrFJ@F
z%k@QPQuT}8?VbH`{{ue88!L_$Hr2-ns4WR9U%Ixp(kXr7MQb0s#&w5ZX8yZ8<At$`
z@`SrTE4~(PY>-KOCuZ_qP`T#K^0%9%-Fx5JB^^6|>B&JqAz8kEzl=jVqci)T87}MT
zeB2dR#~8<|`S*XPjHi>kXIFn`6C3jsP&JV!V&%qQ<;8U9g7a|?pLq*bxn)^iQ`@oj
zj@pOM-EyauC1)R0Syj2WKH%33!JdZ`?+0uztj*5sJZdTMJ8pAUYqhk7N3`16rD6L%
zcdRJSHZe8W{HEf-Bu}SR6K!2t^AhdbOy21Q<Yb=dI#zp8a98%p<9k(XJ%y~iIt|Sm
zoBndhwt{C%E(E^vR+ys1!_n)nk#bP?$&$&-%e^@+$K6o5_pqlVqMN6rUti;&w#^jD
zopE-2d^XXsZxao8TyxX<1D(^=1wXGz{_4qjvA!>|{90~AzNo!-;R5|Bi{!uQUN@D}
z)njtMyTrZ1ws(Q=N=<?H3#XoTbdf9PJ|wN;c}L@`6h~_xsQv*D+q3ewYzz!E58BUo
z=*J8XgXe1^H%qa5uPT1FFlb{%V`0ce@AK^LQyoMOzL+{+hpqk2_5+IQfA;>kI{l7A
z#nQdK3+x{$Reg?q@v0>`^UaYdODnVaPK19uH`~SW%DULI&M&_$S$^ea%*G1ElIw*J
zZG@ZuE$%4Wpi+MCokZ`a_)gc;D?T)@kZixybIW`q?<AFyDc8R7e&vJ*5f>AOtgD&T
zv9|r|d8Vn0t#J6ZYi)pp&i@CoyYyxr=VnQ}<j%ic-0vaxW?yD|k2A8{9ab-y%=R$P
z^C`>c$dk1hei!1GBt86-Eh{_i-*JHjzs0UCSo2sZxsy+=W6D9Nd8aqb|8Me%P1pR8
z8r#}Eo%y`oA2!$9YkoTto?w0}{fD}zlY6G~mAQ`Ah2ROKJP|9eM&`sN#mOs}6f@uS
zFkM?0?;ZR4n6>7VNCzgqnT=C6-<VK*-shIW!*#;er_P7GUEbqX+oLsqD*M^e$*<<v
zXZ7#%VtA9`x6PF`YW*@+tp_VkcI~WUQ=k3lalwCGfxc+*ep&6>-@Mx|YKSdZ6aM!@
zEWg`geVfy|0hO=kROhNDADS^))LMUw$@~BBq!}AjIAvK|z+=3!t$mM<%~Ms_^H@kg
z>U=^T=cPFs`iFOXVzXYo@Bg)+b1Ms3B|cn;3i`ABwb5-KHD>Plb%z=R0wbE2tvM)U
zS5gxb(RivaExmO5t+1O%Walp0(lhC?`%a@B?`K<9{@K{{Cog&y%l_0AwL)@^chAc@
z_+MIJdGH7S6TR(vTegVUd|dH)>6AZuo{Ft~K`~n-d%Zw&8IV4xz&*<nAFiwR%U9fr
z++=xlm-G_TEn?!4)=PJ@o!B7XSP`+LBFEt5k;7(}Kdevt>h&h{fwPq3d6^YS6Zw3~
z&#U`s>CC$o`tr)(8LyLD<IcW4Z+muwyl3sS+k7Tb^~+pY*%VKevs^Cb_{jh6>zl~S
zjIO7u()r~WVjKg$$DZnBJACcytBJa8Yg9aitkm52Bdiq^)=q2bdle=MZXqxodLTN_
zZLvkxqwSfgdeSYQx$kX`^Odo<Tgmz4<wlQ_eQAE*>$YvY7Z>i$dMS8;^8SN4mUD{_
zxGwj|s7YPw`X_A;pMUq`+kbB^4?FXwb$TXG|6_ruphSDEMjy7K9TT;-86M~2?(w_(
zHE0rN_Vu-mb#tZCBwYV{PEyJ9dG&27XB;S;KqXSil?BP~8w0#L`fizg&|lgzX`Ai$
zEi<=XIet8<c$s^o@p7Td&(BwD)W4sroqk@*YiDeP0aNP4moEPUQ$OE(bZuu_Thnp*
z!c+Y$n>Ks&o|{*?Ze!z0C$osz8ryGWWo@ub)#|^lkgC65Ke@NQYTY?M<I|QO9)G`L
zQ+c*z=>-2tOFA6g1=fK^SisHtM{Wxr+do>gs4DC~^PvjnLkF&Wzti!!dt%_nZ2jNw
zFTL%2s9wHNv~>ODOP;Y4OLfxk9IRc_5c=-{*CW*(-Jv`Zo>@oZd48Vi-qWh2;=eq}
z^PPOC`>DdV?&aU#J=EPjT`#e#KlcjH-wAEuzBl)5|2d~2#$n~J{QZR$#ZsKYE|(^|
zoG*S`I7!7*u(R*=;$L#Cpne%-66#f$sRB=oU~gX`Tg!Iez4}5yTQ_^yvc39K_{z+|
zBd)31_WQx#Ywu2(P!+A%x85#KS$p}nH)>h^X5RNs`y^D?&RwqNZhGnN$&&%{sa93K
zlAjmHbYAV9{3d*3#=otnr@s_g%6|2c%$mDbbmh{I8|6wQFxCB6bnu+i(kJ~}jssF`
zgOfFn9Eb80>EI@Xy>>3{-Vd4geyjh!wR)~vP*;&z<a6Jvv#mJYCG#F~zj_i8A<Mt(
z_vP|~a~RUUe!9=e{3Su1x#h?44e94MonIlp?W)Y8@++QdM?Bi1r#WqWzgqu~{JbYT
z-Rm`~ezKm|^_-+qn4I%P_JtHE!GgN#Q(F4|cXao$U3Kym<ZU^qo&Qdz;p~}&OYVH7
z7X-b}cdtDjx%|TO_e@JKq@SA~R%yJUMeA(R7FB!Dq_)KN36AH}Za<jrY8o-MUoPY{
z=aTX(c{elWD=rmW{QoU`-OrN~uKpMCoTRca*{LJ~(Weq*Y-!ZKbkR^#ZAqg+?u`Xq
ztny8vJ=~9&Uad*@llc7K^UY@eVD{q`_qM)2oqAm_c9F?*iQY*u^)Ih@ev7Wpd|<TV
z@u%l3Ne0OaPPnqKeBPU>+-|0FEZThK{|L`XDw>*VleAkvBjBK{;L0W7W@V)&CD69b
zZ_3oDrkZ=r-*0=pe7$~x%n7fHpU?mJ{@!45;JbZ4=B!QelPO=d>5x`e<Yo2hZ;#mz
z=P2gRueOVS^|N~Ehn2_Ao0@)dtLL(b6nXmoyt2&vNOv|4%Ol0pXSi6Dy`EEj=d~Kh
za!a-u6G6kdpcJ<B0{fwkXUC4bFkm>eNPOPbV;7fAS#rknam31hZ^fn0Yggo~%ik~A
zYqojer^l}6ls2Ttl;=b%>gnIuexvH&9rkavThAQhOSC^9D4FbjbzS7q4~pmJ?`UBA
z*WNet)SMfEeU`rc<*J^OmXrntX4~#M>!Q*r4N6pni!XeX|9J6Y-O;aWPPn^wEAiA`
zT^E^avHfxL_a7S#H78zI*|wao^JD(G>IeI_<t+}}aWT?I-n1u6uDfjRz0JRUuGVR*
z+$!Ca^!!}^z4r@qOMg6={dY^F%2Dr0DxT5`2O2~ztiVMwD12G@S{k*TE*knYOz=|p
zlV&^La`Upwy(eEUyD~-2Jb$LuMXfq_v*kOlujCT5`+4KzqPJoBTV5Z!xcJA!Ng6Y%
z|G)8V{&)5Iw^e^5CaHL;__Ods=dGLjf&^Y@ND6#wd~}FiHuw-D$4Ztky*P&b4|y-o
zm~nvN;ni;OmrQSOcBQ>I(6%GO?C^xT(~?Id5-)n6&#(Wsa?Q%g@2;2&S$R!TIqJ@w
zQyu{;896za!&4R|M=&f*l=J+UAjkM|?p^Vng4b`?Y`87^<<G>!k(brlpIsLO=~O+^
zkeH|pTI&I6@lNanEus-S#Ix-29n0*mEF7ED{r28Fr#tz$wZ;r93oDcTeLDgtsiX=$
z(tdpXmcjHLpx*A41&dV_c+^X_Jn1Y5{Cq8k*~yJ@yU)xAJGGg3^h>6wct-Ivvgs~d
ztOD*N9qna0bZ>F8Qv~C~Yt`@dD!(qBbJO@ponS*BDCnD(J3<tK#_c6U1k@TF^g216
z?JJ#@?(g}yxbuX5_4Birw#O}(HcPq?I7vm*Y*#*L$`scA;pS)#u6dGmc|kx5Tj!si
z=KcS2!mQrS>G^xVX6dTMDxMP;?%2ob1ZkUqh7%4lC$cPFeBm{pR_&31?(5&pk8gYO
zw5+Uzp)p)PmWjJRUpwdAxmR3%KHf{yBpC0<zR>Uta=HN;z=zC2F&#Sb@L0-27kRDX
zOFJfAk6Zcg@Ab#Gw>MTUFMDsb<<IxG=WXBKyf$MF2UpzgqSXJ}<MZW=FNt-YV;5PQ
zeI@D3(hbktJSPbyE6H<QU8@C3+n-Jd3ba{SsePZizGsSEQO4b0Td(WImqj^PuaDa*
zK2=^{Df{BKTshl6G0x20?DhXHhAr`Mb@vSVbmW(YJ7~%g63VPCwf%kDH7cFFq|Hvm
zh1CAfy}j_&r^@`_-{;&2<a;)8*^L=94z%rQfA*%LJ}x`6)9~Rr{`=c=EBWu;4~so}
zYMsB>?Jkj>FEl*8=5e^aR)NKdX@$a+Jq{9QBo?|{PWyM5KkV;^yBiNRZD!{;$v=CL
z)g<@Ggvr+B2a4MN{W!b%{{wydjdee-XdXCk>~>>|W^1(iDX*2hn<iN%`UGcP_o~i)
z`)~dJCz?Bp-`)N9Cb-q#W|movfi$RY^_-N{%yj6%g+L)_HvA~xdGX>hmXjr)9acQy
zoPA%r?qy{^t44UR*QJMBeD_#P+ITZrsCeVj)~~Pb*L{?qVOlD*echJrQ}_SwTPtGo
z?ZZ-Gb(`F!)BWe$?M*koX0)^TT_=yjq?W!(BG;>53BxB8FBozt@Pzzj;z$m1`u9G0
zg698;?Z3|a6qZ}O^s-i+?WKf+i;J!G=CEHnXKH%s#?0#fZ{|c^UcK-4vc2oBJ>V@W
z-rsFgE2h77+b7pOZHvC2x%KnnZ}EOv=0C5ltu4G}Ir-h?<e!zfrtKA{X0BTGxt;&^
z!|QsnS~Y(J11F0x8Yp;vyvY2E<0q(Wg{06t9wv_8>{e}6tpdw^HCBASwN*D*?asdC
zPtMG9tXC7Ry}s+P+?gkz-!y6&oZmco-`Tb!KlG$>au{T7r#fV;?f&aGujGznF#GWk
zy|@!fhC)A!<rR|Vxm{MCeK}#z>YTFJ4fBt?O!*eb?zK7H@Alpj&XdA#)<kY~db>Et
zWx-;V#TWN6TS6T&rKRs6b7D$yaz{9awz&R=qC4A`&wueW(4z8C_`G+)FIK-<Yrf*p
zM-Jul-+t{1-mTSWRrkiCex6>ycf}(NaeFHS^HdBE{qL}yuWz~}<;nSnyYBw~xn%L)
zxvu|Rb2n_=!SOxt-iaL#?r%Ff$@#?YAN!kRG?^|0PMY*v0NRECrD`_*mWe%mit?@=
zuhq63I}mp;xj4V<(s_jm^L*NV9kB5#Xb;m{-uL|81jDi^H+LmGJtPu;Y)9ZWzsau}
z<@aybv^&H+ck)ZVR-wr4pBC)j{k0}oxLjNOY`Iu@%?G`|i*(}bihteMc4!yxYsVwG
z=WR|d-YLDKE57cbleh76h6zsMU>E)Pzm)f(e+jItZRHm@c7$a`U2C7G;l;#>FB0BP
z|Hr#+hLuWNo6m*SHTR;=Fj`%#m#C}iE;`<Sx$dQ1V@8FLf=BQ7`TeyS+dX}%p0#W|
z_YBkox%2JHW80>TY)`}T)v<1i-)#AKs5ZV<kmLBLjgr<&@@Cp5b6uEG{Jm$9`25EX
z&b~K{iXT}pc8W;8(D0OAoN&ltYaFCNa&ljoe4in4ztiz0FE;!<eTg?m<d>FMjmzH)
z&t7-r8r(DX7hnCdaJu}<lXtd0Np|R4QNG7Y_whl7^Acz5{Ug48lb*sZ{U~|urt-A^
z`}VNE+q~OV-!^~RLQ!tJHygF5{&eWS_~MzNveabZ-RD-`;@|p9ae`S$z_qG?wP!qL
zEHs@GXIXvCck}V??lbY~Mk=08?wWc93L@aH11QXPY@F^eL&WBXtC>}s;{%q@r6DKp
zXoqz$&vCG>a;)s-SKpJexjsf^kMPs$b0)tnTYU5T(fZsu{X%n|Yld)ma&HNm_uQ)f
zi^oOo^HwtjwjGx@>sWC&k@pts((3O!u1hv-Vd&g8ODbV%t{=0O-O>w-&w2()Z~1!H
z`(N!Eh56_G|FPWfzAQCa$Z+|=+AADpK`Ne)+$4M1ylX*D1C8S4O=)5{<ZyNU4#OwC
zZn{_ho<Da^H(1@OJLOkn#Fck_;<@Q3Ca`%&-><r#^WkLEZ@sxzFJJPVooD&=NMBLC
zO2Wg*{U7z@4(i@3U9@LS-Q!<ft)IWwZaw3~wDQ4Czgrg3pNb=oR2&Plc`p5<up`}N
z!<XLhwRR_2gXZ1bKK)s!d2x^;3&-8Pn@qZ+f?8EP1$+98r1rkO0-HT{a@XWgc;o&;
z;+Nav?q}t5tljxqtn2#^Nj=k(s8gzPzx%tq?uQ)*d+No#m3uFAOuMu8oYEZ6LoVV!
z=Gr<duc*#4%)XU!ZGGI1gva$|OuQ>}KHagMU;D~#&I-;OQ-xB~%_Ep*&dZWJdgj*+
z-jXd*wi{k|=H?#f;?D3-JvX5&_?yS1E9)-=dP&_-w@`-;C{CJjq2Ys{=8@f@!AVZP
z^0z(;k6ThKRCDOp(MX-zzoOC~l3gxrp0D(9<teT_*|Vp<oc|%1ld*SM-gm#S1ixp@
zlEGgTWVSQxX=|}4S7Z5Vs~zRkaD^vVJtqB};d3deipJe9zixWpJ+HnkeWKTT`y;BJ
zFEm=kE`sWM&~hym1((0PvXj}}@})$sE^S=6qRIXFw(HlMBYyAyd1`OPzY~dKAG0@#
znjf90`0)KJ6XQ#tD)XZ+o)3DkmMPQo%ez|(I@N_V&d0im-QC<#aVFxmrnvm!oU|Q%
zDQO9chkwMIOX?*r2PI)o2Mut`MOjo<l`*kp!D7b5hF8^jM=FnM)$tZ?e3#}oTU5pM
zLOk1+Bw6F?f0v7%-^so<x6j-6<?Qu0OXjP;5>S>b`Y#c%#HmA)N6+-#Zk`_#H8KLS
z-Y)aI!g9}SO@Iy0liQ#k?v#r!j!Ap_Xn>as9G)eu%9!|Kv9dJN@`L-_-Lvvk7^7yM
zn|sZ{vTvEMk;;tMn_bJr_VfxqJGb+Aad%JqwpUqsZ{v0y3DXc2;z*3scRA)<#iQLc
zMW!!R!`12Zl;y=&i>FNGGSoTx=kxlhJB!zqmIQ>ST=|f{f0l~pqzi_2Y)@YA1=T&E
z<{)UiUErHj?As~L0S+^+e}Cc8qA;a&;ZDhl-`O9p&$nJ5dwBk3`=0H8Z!Xu9vE@23
zb?@h8_rssv*yfaXbzSURop-;!Cux6)-CJ@puHd1`WYbzB8IHSiZ|&v2KYf4i)a5fg
zxmV9k4s17{2DbX)Gti_RG*JZ^ILwd{7H;^ZE#TD5xcdFYjfZ;NtgX1_*Ie-}ysj62
zEPKj@%KC@rdYo79`+e(vfY&3N?H>IF?)RpjukPkjncULRl=$`i{z<j@zwe%Se$I(S
zu=w4~muAZsW@H*f?oOK;<E-i_WW~1V$Zd9LOZ<gK$&@Arrz`vy4O0V39%$V7ekbD3
zt9ZA?=aNpoUVlN{YhuCkKm0boPcrA|Y9`eOdrcDOXy@IO;4Jj2HqRvah4@p~1|@;{
zl1?)28%0@td0835H>v6veau(&oTO6X^G;X+vi<{<Xj2?+eCHBYkda^!_$F(W^!?Jk
z3%Mr0-iE((o#nBX=f%zWmW4f%z4PvEKVHneIPg@D>FTfp(^fhsR~f&K`1*JI+pnc!
z>G@@g+b>^UaCwWMGn2i`Bo)s)62CU6gVShh-y=81#FWL#{_H26!Y#}F?L#*TzgTqp
zvg7eJnUf#bik+PGJs|$phDOuX;RW3{_xm>gFa6CXYiND6$K?OSc8{gc-90C%XmXVF
z^u7}o61D=(@lLuB=pdoFi`T)zKy6B+LGqgp<=K}R_6RRktzXOk@A}3j8!^we8#YBN
z-s>t~ZadPl%)L*=bJCNrnv#&55Pz=35J>w9Y>elN6XzzdIfeYqzWyNo`PJ1oFRNR3
zTie&Xzwqh)sr!}6wLcW13nL7t*cP>b`U82Y5&~@cumouZn)Kfr{DN8WN_mMl+mGWl
z3)U{-{aOF!E@R#+H-U!4yw*M0>*joCxUG~~z1^(JKQL-a$~GOz1M|PgC)rn~*`(-O
zEn2Knnh~#eS;30U$-TtIJ<sL%*^pDuWv}0jsXpZSLc{YQpRNK(*u6x=DvrD5BdB-b
zxp&qpQH$ffFFN{OXym<NIAnUUP%CHJWLJ03SMN<qT--}U%oiowaU8zO#=-u`i&Iwh
zW#*1`M=l7;?hJg<(f3o~jer1`tg7vcg%_8<-91A<_M#vN{chfHEnw-I$$i0>76uk7
zTY24@-)JBwyhz!6k+M}$vP{dzYaYjE*0l6ZGP0V|@K=umqzR<8(D?eVz~CjKI|^6Y
zC|_PRNyzG2-YaMKJQw$pCvHa_CGtf}=Dc>$1UaOBUWHWK`Q0oPAh&n)y;xBuux>)1
zrNWd8fk6x{A9o1KUJOjM;N+M*JFgoee5qeC%c&%U3uGB<%jyNn>K=JdJT%{)wpWv>
zD@l;E(wf<Kr=ySQko7WU29FmSOG|$69s(JEr=#yhN1wxu*?s?P6laD_4YImsz;XMr
z8z_8S-1F|}Y@KKR-&%LEsS~H{(w1f2j$rjKPV{m$Z`ixFVZ*bA03j={>&bFfMaou-
zl&x0Dw%qq{SD2D=G4PjViGd<0RJ1tM857IQxt!YFR2METx-~soL>8oW(c*>z*Sr|F
zb~n|TVWEEQ*6a&2Lrb2xm52z~F~~Ls2w7<@Prmt2rp?2?1?0*X70($Hv-o=N#Z9^p
z7+lMmXai0Q?j=u-Rm=`v`###vLtSA?3IEv_94#+SfFl0Riu+re4etGNc(JZ$Ny~-6
z(-pb`i@@$&wD^|ejyNl(g-ho6tj?O>Yn$id-VF*OhZDUH8lEp^Twa)y?_L6l0H#A*
zFBRVLnsh;s<D#If@9HkjX2!%Uha2jiPRIY)`@d;_IJxd#CB({8%nvQ<ZtBM@e7v%1
zre}~}-jh9t^yR?bg`|&%7YZ#ZOFe^}Uff`Ff(CPl5J&P|Q;x^FlT=D_-p_XE0J$XZ
z$%4hR96I_=M>L5%IkwMJ$V%?i2K}e|zdn!wh3cZk4F)n+eYfB9%c^q9_J0*^`FKH4
zwzcoh4SNNb<4faWYhP%1zT$8y@!^o&DJc7Og@ViRRGEFT<u5cme|<GSRCLcy!U~*V
zE(&s3Z_(z=ad!8-#IDeDycgt?jEfVc&)>E&j*GTbc;e<6bf*py7B4#bcoller9vn2
z%c^QFO_uz%k{@LL#fw{3-E!>cbLi-s#L@y)`@>*svw$ooudJ%(;+5an!KvZZO2ZNs
zr#v4E6RnadOIGFxuWSQFuG8@ZhZ!;gT(V2u&(2rxTe_z-KqJq^J<q2@x|uPt$U!4-
zN{Rp8Mgs{eNLE{v%r5Xs?VpWe$&@7m9FG@5V>R>Y+0zzoRf{M3nSyEx&skL~_+@oL
z!C$0oHLuw~&MGWG(8}wSm5G$8G)Q>S;tPfs{xd3C=}mQL>6_FrLHeShE+`S6VNtYl
za`kd@_be6$Mf*-@_Mad<`Q0gxI~tkqcDZ%*Ie{~94!fci)54a%pjWXo6QF+Y=wlRk
zR~B#5m(9naS~4Y%r^Pv-IeVcpIHN4qV|*yT`|k6-b6WepmuG}HxpQ({oG1+{Cjt`%
zwrw{uU$&=Kb>U)@>wXF@pd!z_Xh)#0g3oeg0k21HnR2H?US~&Mat6uFm$@j&aq*)G
zALsf|&leh3--cvI-vK$SWKWjEjC<ZYcC#&1DVg%Dup?MNwzY5jGjRUmkewgQ2b#fH
znfE+uf6gm$t5*{QtrjhA_^|Bdk3FX&m8YnbT#4~M(6aH`TTo$edDV*(y|eAhck}<^
z@vb__v{0pRag-xCoxXT6d2y3MPkW!GzKy4o`_+ZaA1;8y>SEyZ1_4=6XbD+q@wWWT
zb2<L!0?3mb7X>*~Ib|DRWoo0r-Yceu<~T2&)Y3OATNE0@Oo@B48#X+%nWw@j8~WP)
z?8GS#KrSgvUXvoA#dpY%yJeC}-Wu<{CTftP|I5k3&)4(H!$kbNs$P3cy0Ee3VLK>g
zf#O4gC9&FJ#sn2k+1CY{pD$bl7Xs#s9=9sE9KZbT@4`UONqHjRRJ)@2!bWRQcs`Sn
znyRueS?l?Zi(9m;7A^jCcLu*xUJav@XZYLq-`-g)&&}n0P*C=D%8ln1cfSai<)~k{
zzFhD1w9}zSd3kvbmSp`{GXF<A?;QV+XFSABe>{%Qoda6c3X09+PaQk@^!z<0ZTjW7
zVD@pthp%61fRdccad(9)rV2TGJybj`O?OwbyX|stU%1#26wM`f&TO^IvwF=mC*|S_
z70un@4Y1JLX~=S@;zfnLfY+o;Y24fM4?)Xfb1l9@uYbSDdlNlfUB%O(qwmEGVNk)L
z)+`{~o&+*v@iTYdG*AujLfyTD#i_(*i-U%z*Ngq%>u*m#EetE84R*d<Q_i^XwD6=Q
zYi2cY9$vWkg5mkz7a9sN+OqB-qhGTqf^(9x)uPAGB3?UhUiUZZ>#`f#%AQ`C;;Nv+
z%6!pcS<5>=Y&agD{qHB%`%J|%Yuoi~UU0b~DErlhqj_O+{>2QxNlS8|<#Um;z@o<s
zZ)i`RrV?qQRdR+0q_$B&mj7zp%rz>WYoRI3P`Kreg{Xp$*Q6^ZF0j~knBjSRWtje?
zB`Th~_vI?zweh^u(RU}~f}pJVa#o+#K8G3eRTvXhpp}Qq@nV5v)^Q$xyZi*bCP71W
zqVz>Wu0swlEVk(RFH!Nl6?fJWQdBQ|Y^30F{NmHjB`ThdlRyJ4cRKpsvpSW?#Ln~Z
zo^<8NQBZ5H#Kpb2?{xD7>E%&-Jc1^vd_CV3U=ArN{_rZexa$jf28nUBZ>wDv_hN>C
z)jH)8m*YnrI{Ip}LD9n6a=V!27`UYaa^sylWp|He{k`d_Zz|I5rs}D=mknCIy;z~a
zk!;%`D9f+Sv`~c;T1xE<3>08<I=(T&M9cG3X2xuvui(Pbd=V%}d0HkdS@O$8ph($@
zOZKaPz_QDRk}aU5IO&zQ^^{LrST-yK$%t}r*el5PZ~Z2xI%!GIud;HDr<u+MB_dX8
zEqz>D^aK_y1|^3Yfi`D%aKd#jxpSxV?&rH&HZL+jURW-~@K9;(EpQ#&(YK4K<)c91
zs@(W(`&axu|2S`&-=rnl8SS7-?$hMO(^wR(&P{ia$P>+*qQVGHN?fw%nVm{(t_f|w
zzo}%3ilwUr`wjMTki&wV+!b7oCtug)w=bEZ!uskosLpxO(dTshYx4x@;1lhAla?$r
zN!GMa2Gy;g#udvU7ArpONAU~3zBw^bC0AZUf?t*wlwOOJt@8Gj-Cg?bOO;jM(n!`<
z7Xrc2KT-N(U|rE3_C%8s9+Runm}}Q+d20H8Ej{4u9>01K$Ptefcv}08N4?+!)qu{K
z=X0llY9(;#DSYYUmC!V2chAV3HipwS?E|ILiPEes@@;+ZH)e#e$*OX4?7X-@*=o_^
zYm82LGN<}BT?m{c<PcF7thpGZSWuR=rL)9_Vc~_qAh+7xbG<r`gUY2l9eua{tbcv3
zdiJslg==^PPcB%z#75wlvwMjNsC?sS`TbYFdX-BFk6ARRUY&9!<d*gxc!rSRkWHQo
zY7}d({0MI;3+zjd{qFgq;`yf*9xE@eR{^s^o-I_ik^&`k7N?Rs@7Zq%Sb3d#apB!R
zopXht`qi9^<NkX4YrT5@8mjTDy<XkE8}izIs#1vyBw*AU1Z3Sojnq>s^l$IHCO-Qg
zAE-SFs?-WU=kBi$aR|F3vEXq?w0<3^F?s6Sjnd+^6G07bL0M31!%>1?cK%D2mPwB8
znk#o+o3dk~^u@y3=Drszv>hZkW%G5Vrd|m2%F=oplN|-}bVuJEj+Pfcw!XI64RVgA
zY?c`)3tYT-eHEw$_~KJbOW&zenun%ZUjPL-sCfG2c%nBsch98ydLb*X+M8#$LK{G`
zjRuqZ#CpAqUaZ*Sx_E0`R^61EwO!Cc<Ny8l?~@NLeObZc<oRNSiom()juQD|;ClS=
zsqQ8NIjdv4-*zourBV{&RjeD%0V|m8W5XK^B&_be)s>o>av{*Ncd6~QS(1<dHUYU1
zlvPSXypqqdfm8h=Wh*8{E4fqWsy}{L=aeng*gds*0;o-}Q&9Fgzf(y`rPCxHt7RrN
z76OZ)l|qa>$Ie1FCr_v2OZ>LZE3KIX4b8&OfA216?Nje|Q$2Zom8WdBZS3ujmm#g_
zj=t{-Jl~?M7Cnv)w>_%DDH}X1tCQ=4@MS@0zIgoX_jG;#?gs+0%sOw{Hr4L?Cp$@H
z;p325J6_vqg395GfiEif4plIkFM7QFU8=yb*M~hP@mTe7Hwnms17Aa7k6ww)>pVx{
zqQxo;lmC2jF?tJ1+mO1yaNXOWOWo~#lUn+mZ~nVD2h!OP5!kmebjQajEKVg;R7&=&
z{km{6NQ<ECMMKt>7Zum1iX2+FSmouF((Mzo{%!%K(JjjCvKK$<C#Ss<QlG~u&A`CG
N;OXk;vd$@?2>?6>3-SN}


From 11df30b914a1502a94793e37fd31042c6fed3eaf Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:57:34 +0200
Subject: [PATCH 19/35] feat(ui): add dedicated third-party license sections to
 settings (#6820)

---
 .../public/locales/en-US/translation.toml     |  15 +
 frontend/editor/public/og-metadata.json       |  12 +
 .../editor/src/assets/3rdPartyLicenses.json   | 347 ++++++++++++++----
 .../shared/config/configNavSections.tsx       |  16 +
 .../ThirdPartyLicensesSection.tsx             | 235 ++++++++++++
 .../core/components/shared/config/types.ts    |   2 +
 6 files changed, 555 insertions(+), 72 deletions(-)
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 6d827eb895..31ee42a8a2 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -8932,6 +8932,21 @@ manage = "Manage"
 description = "Policies and legal information for this service."
 title = "Legal Documents"
 
+[settings.licenses]
+backendDescription = "Licenses for backend dependencies bundled with this server."
+backendLabel = "Backend Licenses"
+backendTitle = "Backend 3rd Party Licenses"
+empty = "No dependencies found."
+frontendDescription = "Licenses for frontend dependencies bundled into the release build."
+frontendLabel = "Frontend Licenses"
+frontendTitle = "Frontend 3rd Party Licenses"
+license = "License"
+listDescription = "The list is shown directly in the UI from the release bundle or backend endpoint."
+listTitle = "Bundled dependencies"
+loadError = "Failed to load third-party licenses"
+module = "Module"
+version = "Version"
+
 [settings.licensingAnalytics]
 audit = "Audit"
 plan = "Plan"
diff --git a/frontend/editor/public/og-metadata.json b/frontend/editor/public/og-metadata.json
index e8aded59d2..65f1da789c 100644
--- a/frontend/editor/public/og-metadata.json
+++ b/frontend/editor/public/og-metadata.json
@@ -485,6 +485,16 @@
       "title": "Legal Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/backendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Backend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/frontendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Frontend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/payg": {
       "image": "/og_images/home.png",
       "title": "Payg Settings - Stirling PDF",
@@ -641,6 +651,8 @@
     "/settings/adminMcp": "/settings/adminMcp",
     "/settings/help": "/settings/help",
     "/settings/legal": "/settings/legal",
+    "/settings/backendThirdPartyLicenses": "/settings/backendThirdPartyLicenses",
+    "/settings/frontendThirdPartyLicenses": "/settings/frontendThirdPartyLicenses",
     "/settings/payg": "/settings/payg"
   }
 }
diff --git a/frontend/editor/src/assets/3rdPartyLicenses.json b/frontend/editor/src/assets/3rdPartyLicenses.json
index baf60879b6..3b606376de 100644
--- a/frontend/editor/src/assets/3rdPartyLicenses.json
+++ b/frontend/editor/src/assets/3rdPartyLicenses.json
@@ -3,133 +3,182 @@
     {
       "moduleName": "@atlaskit/pragmatic-drag-and-drop",
       "moduleUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git",
-      "moduleVersion": "1.7.7",
+      "moduleVersion": "1.7.9",
       "moduleLicense": "Apache-2.0",
       "moduleLicenseUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git"
     },
     {
-      "moduleName": "@embedpdf/core",
-      "moduleUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-1.3.1.tgz",
-      "moduleVersion": "1.3.0",
+      "moduleName": "@cantoo/pdf-lib",
+      "moduleUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git",
+      "moduleVersion": "2.6.5",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-1.3.1.tgz"
+      "moduleLicenseUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git"
+    },
+    {
+      "moduleName": "@dnd-kit/core",
+      "moduleUrl": "git+https://github.com/clauderic/dnd-kit.git",
+      "moduleVersion": "6.3.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/clauderic/dnd-kit.git"
+    },
+    {
+      "moduleName": "@embedpdf/core",
+      "moduleUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz"
     },
     {
       "moduleName": "@embedpdf/engines",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/models",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-annotation",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-attachment",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-bookmark",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-document-manager",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-export",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-history",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-interaction-manager",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
-    },
-    {
-      "moduleName": "@embedpdf/plugin-loader",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-pan",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-print",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-redaction",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-render",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-rotate",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-scroll",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-search",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-selection",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-spread",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-thumbnail",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-tiling",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-viewport",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-zoom",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
@@ -157,94 +206,185 @@
     {
       "moduleName": "@mantine/core",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/dates",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/dropzone",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/hooks",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mui/icons-material",
       "moduleUrl": "git+https://github.com/mui/material-ui.git",
-      "moduleVersion": "7.3.2",
+      "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
     },
     {
       "moduleName": "@mui/material",
       "moduleUrl": "git+https://github.com/mui/material-ui.git",
-      "moduleVersion": "7.3.2",
+      "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
     },
     {
-      "moduleName": "@tailwindcss/postcss",
-      "moduleUrl": "git+https://github.com/tailwindlabs/tailwindcss.git",
-      "moduleVersion": "4.1.13",
+      "moduleName": "@posthog/react",
+      "moduleUrl": "git+https://github.com/PostHog/posthog-js.git",
+      "moduleVersion": "1.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "git+https://github.com/PostHog/posthog-js.git"
+    },
+    {
+      "moduleName": "@reactour/tour",
+      "moduleUrl": "git+https://github.com/elrumordelaluz/reactour.git",
+      "moduleVersion": "3.8.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/elrumordelaluz/reactour.git"
+    },
+    {
+      "moduleName": "@stripe/react-stripe-js",
+      "moduleUrl": "https://github.com/stripe/react-stripe-js.git",
+      "moduleVersion": "4.0.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/stripe/react-stripe-js.git"
+    },
+    {
+      "moduleName": "@stripe/stripe-js",
+      "moduleUrl": "https://github.com/stripe/stripe-js.git",
+      "moduleVersion": "7.9.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/stripe/stripe-js.git"
+    },
+    {
+      "moduleName": "@supabase/supabase-js",
+      "moduleUrl": "https://github.com/supabase/supabase-js.git",
+      "moduleVersion": "2.100.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/supabase/supabase-js.git"
+    },
+    {
+      "moduleName": "@tailwindcss/postcss",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleVersion": "4.2.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
     },
     {
       "moduleName": "@tanstack/react-virtual",
       "moduleUrl": "git+https://github.com/TanStack/virtual.git",
-      "moduleVersion": "3.13.12",
+      "moduleVersion": "3.13.23",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/TanStack/virtual.git"
     },
+    {
+      "moduleName": "@tauri-apps/api",
+      "moduleUrl": "git+https://github.com/tauri-apps/tauri.git",
+      "moduleVersion": "2.10.1",
+      "moduleLicense": "Apache-2.0 OR MIT",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/tauri.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-dialog",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.7.0",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-fs",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.5.0",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-http",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.5.7",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-notification",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.3.3",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-shell",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.3.5",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@userback/widget",
+      "moduleUrl": "git+https://github.com/userback/widget-js.git",
+      "moduleVersion": "0.3.12",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/userback/widget-js.git"
+    },
     {
       "moduleName": "autoprefixer",
       "moduleUrl": "git+https://github.com/postcss/autoprefixer.git",
-      "moduleVersion": "10.4.21",
+      "moduleVersion": "10.4.27",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/postcss/autoprefixer.git"
     },
     {
       "moduleName": "axios",
       "moduleUrl": "git+https://github.com/axios/axios.git",
-      "moduleVersion": "1.12.2",
+      "moduleVersion": "1.15.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/axios/axios.git"
     },
+    {
+      "moduleName": "d3",
+      "moduleUrl": "git+https://github.com/d3/d3.git",
+      "moduleVersion": "7.9.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/d3/d3.git"
+    },
+    {
+      "moduleName": "globals",
+      "moduleUrl": "git+https://github.com/sindresorhus/globals.git",
+      "moduleVersion": "17.5.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/sindresorhus/globals.git"
+    },
     {
       "moduleName": "i18next",
       "moduleUrl": "git+https://github.com/i18next/i18next.git",
-      "moduleVersion": "25.5.2",
+      "moduleVersion": "25.10.10",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/i18next.git"
     },
     {
       "moduleName": "i18next-browser-languagedetector",
       "moduleUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git",
-      "moduleVersion": "8.2.0",
+      "moduleVersion": "8.2.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git"
     },
-    {
-      "moduleName": "i18next-http-backend",
-      "moduleUrl": "git+ssh://git@github.com/i18next/i18next-http-backend.git",
-      "moduleVersion": "3.0.2",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+ssh://git@github.com/i18next/i18next-http-backend.git"
-    },
     {
       "moduleName": "jszip",
       "moduleUrl": "git+https://github.com/Stuk/jszip.git",
@@ -254,66 +394,129 @@
     },
     {
       "moduleName": "license-report",
-      "moduleUrl": "git+https://github.com/kessler/license-report.git",
-      "moduleVersion": "6.8.0",
+      "moduleUrl": "git+https://github.com/bepo65/license-report.git",
+      "moduleVersion": "6.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/kessler/license-report.git"
-    },
-    {
-      "moduleName": "pdf-lib",
-      "moduleUrl": "git+https://github.com/Hopding/pdf-lib.git",
-      "moduleVersion": "1.17.1",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/Hopding/pdf-lib.git"
+      "moduleLicenseUrl": "git+https://github.com/bepo65/license-report.git"
     },
     {
       "moduleName": "pdfjs-dist",
       "moduleUrl": "git+https://github.com/mozilla/pdf.js.git",
-      "moduleVersion": "5.4.149",
+      "moduleVersion": "5.5.207",
       "moduleLicense": "Apache-2.0",
       "moduleLicenseUrl": "git+https://github.com/mozilla/pdf.js.git"
     },
+    {
+      "moduleName": "peerjs",
+      "moduleUrl": "git+https://github.com/peers/peerjs.git",
+      "moduleVersion": "1.5.5",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/peers/peerjs.git"
+    },
+    {
+      "moduleName": "pixelmatch",
+      "moduleUrl": "git+https://github.com/mapbox/pixelmatch.git",
+      "moduleVersion": "7.1.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/mapbox/pixelmatch.git"
+    },
     {
       "moduleName": "posthog-js",
-      "moduleUrl": "git+https://github.com/PostHog/posthog-js.git",
-      "moduleVersion": "1.268.0",
+      "moduleUrl": "https://github.com/PostHog/posthog-js",
+      "moduleVersion": "1.363.3",
       "moduleLicense": "SEE LICENSE IN LICENSE https://github.com/PostHog/posthog-js/blob/main/LICENSE",
-      "moduleLicenseUrl": "git+https://github.com/PostHog/posthog-js.git"
+      "moduleLicenseUrl": "https://github.com/PostHog/posthog-js"
+    },
+    {
+      "moduleName": "qrcode.react",
+      "moduleUrl": "git+https://github.com/zpao/qrcode.react.git",
+      "moduleVersion": "4.2.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/zpao/qrcode.react.git"
     },
     {
       "moduleName": "react",
       "moduleUrl": "git+https://github.com/facebook/react.git",
-      "moduleVersion": "19.1.1",
+      "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
     },
     {
       "moduleName": "react-dom",
       "moduleUrl": "git+https://github.com/facebook/react.git",
-      "moduleVersion": "19.1.1",
+      "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
     },
+    {
+      "moduleName": "react-easy-crop",
+      "moduleUrl": "git+https://github.com/ValentinH/react-easy-crop.git",
+      "moduleVersion": "5.5.6",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/ValentinH/react-easy-crop.git"
+    },
     {
       "moduleName": "react-i18next",
       "moduleUrl": "git+https://github.com/i18next/react-i18next.git",
-      "moduleVersion": "15.7.3",
+      "moduleVersion": "16.6.6",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/react-i18next.git"
     },
+    {
+      "moduleName": "react-markdown",
+      "moduleUrl": "git+https://github.com/remarkjs/react-markdown.git",
+      "moduleVersion": "9.1.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/remarkjs/react-markdown.git"
+    },
+    {
+      "moduleName": "react-rnd",
+      "moduleUrl": "git+https://github.com/bokuweb/react-rnd.git",
+      "moduleVersion": "10.5.3",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/bokuweb/react-rnd.git"
+    },
     {
       "moduleName": "react-router-dom",
       "moduleUrl": "git+https://github.com/remix-run/react-router.git",
-      "moduleVersion": "7.9.1",
+      "moduleVersion": "7.13.2",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/remix-run/react-router.git"
     },
     {
-      "moduleName": "tailwindcss",
-      "moduleUrl": "git+https://github.com/tailwindlabs/tailwindcss.git",
-      "moduleVersion": "4.1.13",
+      "moduleName": "recharts",
+      "moduleUrl": "git+https://github.com/recharts/recharts.git",
+      "moduleVersion": "3.8.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "git+https://github.com/recharts/recharts.git"
+    },
+    {
+      "moduleName": "remark-gfm",
+      "moduleUrl": "git+https://github.com/remarkjs/remark-gfm.git",
+      "moduleVersion": "4.0.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/remarkjs/remark-gfm.git"
+    },
+    {
+      "moduleName": "signature_pad",
+      "moduleUrl": "git+https://github.com/szimek/signature_pad.git",
+      "moduleVersion": "5.1.3",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/szimek/signature_pad.git"
+    },
+    {
+      "moduleName": "smol-toml",
+      "moduleUrl": "github:squirrelchat/smol-toml",
+      "moduleVersion": "1.6.1",
+      "moduleLicense": "BSD-3-Clause",
+      "moduleLicenseUrl": "github:squirrelchat/smol-toml"
+    },
+    {
+      "moduleName": "tailwindcss",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleVersion": "4.2.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
     },
     {
       "moduleName": "web-vitals",
diff --git a/frontend/editor/src/core/components/shared/config/configNavSections.tsx b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
index 260cbe970a..db02ad8458 100644
--- a/frontend/editor/src/core/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
@@ -5,6 +5,10 @@ import HotkeysSection from "@app/components/shared/config/configSections/Hotkeys
 import GeneralSection from "@app/components/shared/config/configSections/GeneralSection";
 import HelpSection from "@app/components/shared/config/configSections/HelpSection";
 import LegalSection from "@app/components/shared/config/configSections/LegalSection";
+import {
+  BackendThirdPartyLicensesSection,
+  FrontendThirdPartyLicensesSection,
+} from "@app/components/shared/config/configSections/ThirdPartyLicensesSection";
 
 export interface ConfigNavItem {
   key: NavKey;
@@ -80,6 +84,18 @@ export const useConfigNavSections = (
           icon: "gavel-rounded",
           component: <LegalSection />,
         },
+        {
+          key: "backendThirdPartyLicenses",
+          label: t("settings.licenses.backendLabel", "Backend Licenses"),
+          icon: "article-rounded",
+          component: <BackendThirdPartyLicensesSection />,
+        },
+        {
+          key: "frontendThirdPartyLicenses",
+          label: t("settings.licenses.frontendLabel", "Frontend Licenses"),
+          icon: "code-rounded",
+          component: <FrontendThirdPartyLicensesSection />,
+        },
       ],
     },
   ];
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
new file mode 100644
index 0000000000..5d0de982fc
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
@@ -0,0 +1,235 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Alert,
+  Anchor,
+  Group,
+  Loader,
+  Paper,
+  Stack,
+  Table,
+  Text,
+} from "@mantine/core";
+import { isAxiosError } from "axios";
+import apiClient from "@app/services/apiClient";
+import frontendLicenses from "../../../../../assets/3rdPartyLicenses.json"; // eslint-disable-line no-restricted-imports -- asset lives outside @app alias root
+
+interface Dependency {
+  moduleName?: string;
+  moduleUrl?: string;
+  moduleVersion?: string;
+  moduleLicense?: string;
+  moduleLicenseUrl?: string;
+}
+
+interface LicensesResponse {
+  dependencies?: Dependency[];
+}
+
+interface LicensesSectionBodyProps {
+  title: string;
+  description: string;
+  dependencies: Dependency[];
+}
+
+function LicensesSectionBody({
+  title,
+  description,
+  dependencies,
+}: LicensesSectionBodyProps) {
+  const { t } = useTranslation();
+  const sortedDependencies = useMemo(
+    () =>
+      [...dependencies].sort((a, b) =>
+        (a.moduleName || "").localeCompare(b.moduleName || ""),
+      ),
+    [dependencies],
+  );
+
+  const getDependencyKey = (dependency: Dependency) =>
+    [
+      dependency.moduleName ?? "module",
+      dependency.moduleVersion ?? "version",
+      dependency.moduleUrl ?? "url",
+    ].join(":");
+
+  return (
+    <Stack gap="lg">
+      <Paper withBorder p="md" radius="md">
+        <Stack gap="md">
+          <div>
+            <Text fw={600} size="sm">
+              {title}
+            </Text>
+            <Text size="xs" c="dimmed" mt={4}>
+              {description}
+            </Text>
+          </div>
+
+          <Group justify="space-between" align="center">
+            <div>
+              <Text fw={600} size="sm">
+                {t("settings.licenses.listTitle", "Bundled dependencies")}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t(
+                  "settings.licenses.listDescription",
+                  "The list is shown directly in the UI from the release bundle or backend endpoint.",
+                )}
+              </Text>
+            </div>
+          </Group>
+
+          <Table
+            highlightOnHover
+            withRowBorders
+            verticalSpacing="sm"
+            horizontalSpacing="md"
+          >
+            <Table.Thead>
+              <Table.Tr>
+                <Table.Th>{t("settings.licenses.module", "Module")}</Table.Th>
+                <Table.Th>{t("settings.licenses.version", "Version")}</Table.Th>
+                <Table.Th>{t("settings.licenses.license", "License")}</Table.Th>
+              </Table.Tr>
+            </Table.Thead>
+            <Table.Tbody>
+              {sortedDependencies.length === 0 ? (
+                <Table.Tr>
+                  <Table.Td colSpan={3}>
+                    <Text ta="center" c="dimmed" py="xl">
+                      {t("settings.licenses.empty", "No dependencies found.")}
+                    </Text>
+                  </Table.Td>
+                </Table.Tr>
+              ) : (
+                sortedDependencies.map((dependency) => (
+                  <Table.Tr key={getDependencyKey(dependency)}>
+                    <Table.Td>
+                      {dependency.moduleUrl ? (
+                        <Anchor
+                          href={dependency.moduleUrl}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                        >
+                          {dependency.moduleName || "-"}
+                        </Anchor>
+                      ) : (
+                        <Text size="sm">{dependency.moduleName || "-"}</Text>
+                      )}
+                    </Table.Td>
+                    <Table.Td>
+                      <Text size="sm" c="dimmed">
+                        {dependency.moduleVersion || "-"}
+                      </Text>
+                    </Table.Td>
+                    <Table.Td>
+                      {dependency.moduleLicenseUrl ? (
+                        <Anchor
+                          href={dependency.moduleLicenseUrl}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                        >
+                          {dependency.moduleLicense || "-"}
+                        </Anchor>
+                      ) : (
+                        <Text size="sm">{dependency.moduleLicense || "-"}</Text>
+                      )}
+                    </Table.Td>
+                  </Table.Tr>
+                ))
+              )}
+            </Table.Tbody>
+          </Table>
+        </Stack>
+      </Paper>
+    </Stack>
+  );
+}
+
+export function BackendThirdPartyLicensesSection() {
+  const { t } = useTranslation();
+  const [dependencies, setDependencies] = useState<Dependency[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const loadLicenses = async () => {
+      try {
+        setLoading(true);
+        setError(null);
+        const response = await apiClient.get<LicensesResponse>(
+          "/api/v1/ui-data/licenses",
+          { suppressErrorToast: true },
+        );
+        setDependencies(response.data?.dependencies ?? []);
+      } catch (err: unknown) {
+        setError(
+          isAxiosError(err)
+            ? err.response?.data?.message || err.message
+            : t(
+                "settings.licenses.loadError",
+                "Failed to load third-party licenses",
+              ),
+        );
+      } finally {
+        setLoading(false);
+      }
+    };
+
+    void loadLicenses();
+  }, [t]);
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  if (error) {
+    return (
+      <Stack gap="lg">
+        <Alert color="red" title={t("admin.error", "Error")}>
+          {error}
+        </Alert>
+      </Stack>
+    );
+  }
+
+  return (
+    <LicensesSectionBody
+      title={t("settings.licenses.backendTitle", "Backend 3rd Party Licenses")}
+      description={t(
+        "settings.licenses.backendDescription",
+        "Licenses for backend dependencies bundled with this server.",
+      )}
+      dependencies={dependencies}
+    />
+  );
+}
+
+export function FrontendThirdPartyLicensesSection() {
+  const { t } = useTranslation();
+  const dependencies =
+    (frontendLicenses as LicensesResponse).dependencies ?? [];
+
+  return (
+    <LicensesSectionBody
+      title={t(
+        "settings.licenses.frontendTitle",
+        "Frontend 3rd Party Licenses",
+      )}
+      description={t(
+        "settings.licenses.frontendDescription",
+        "Licenses for frontend dependencies bundled into the release build.",
+      )}
+      dependencies={dependencies}
+    />
+  );
+}
+
+export default function ThirdPartyLicensesSection() {
+  return <BackendThirdPartyLicensesSection />;
+}
diff --git a/frontend/editor/src/core/components/shared/config/types.ts b/frontend/editor/src/core/components/shared/config/types.ts
index a71866d0c1..9fa87fe915 100644
--- a/frontend/editor/src/core/components/shared/config/types.ts
+++ b/frontend/editor/src/core/components/shared/config/types.ts
@@ -32,6 +32,8 @@ export const VALID_NAV_KEYS = [
   "adminMcp",
   "help",
   "legal",
+  "backendThirdPartyLicenses",
+  "frontendThirdPartyLicenses",
   "payg",
 ] as const;
 

From 57bf17d348681395a917a8016b335fe47e43b8ae Mon Sep 17 00:00:00 2001
From: LFdev <146497073+LFd3v@users.noreply.github.com>
Date: Tue, 7 Jul 2026 17:58:21 -0300
Subject: [PATCH 20/35] Fix missing app icon on Linux/Wayland (#6875)

Co-authored-by: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Co-authored-by: Ludy <Ludy87@users.noreply.github.com>
---
 frontend/editor/src-tauri/stirling-pdf.desktop | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/editor/src-tauri/stirling-pdf.desktop b/frontend/editor/src-tauri/stirling-pdf.desktop
index e9e26a39c1..13da1b88c6 100644
--- a/frontend/editor/src-tauri/stirling-pdf.desktop
+++ b/frontend/editor/src-tauri/stirling-pdf.desktop
@@ -10,7 +10,8 @@ Terminal=false
 MimeType=application/pdf;
 Categories=Office;Graphics;Utility;
 Actions=open-file;
+StartupWMClass=Stirling-PDF
 
 [Desktop Action open-file]
 Name=Open PDF File
-Exec={{exec}} %F
\ No newline at end of file
+Exec={{exec}} %F

From 105af5110045920ace9f59cc0aa4daec87b1b6e1 Mon Sep 17 00:00:00 2001
From: "stirlingbot[bot]" <195170888+stirlingbot[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:08:01 +0100
Subject: [PATCH 21/35] Update Frontend 3rd Party Licenses (#6889)

Co-authored-by: Ludy <Ludy87@users.noreply.github.com>
Signed-off-by: stirlingbot[bot] <stirlingbot[bot]@users.noreply.github.com>

From f703a678174180ec629ac2107ba956b14d943194 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:39:57 +0100
Subject: [PATCH 22/35] Fix cert sign not showing under certain instances
 (#6908)

---
 .../tests/stubbed/cert-sign-wizard.spec.ts    | 21 ++++++++++++------
 frontend/editor/src/core/tools/CertSign.tsx   | 22 +++++++++++++++++++
 2 files changed, 36 insertions(+), 7 deletions(-)

diff --git a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
index 9b66fec1d9..e2d2e8b154 100644
--- a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
@@ -59,7 +59,7 @@ async function mockHardwareEndpoints(page: Page) {
 }
 
 test.describe("CertSign tool - certificate source model", () => {
-  test("renders, accepts a PDF, and defaults to upload when no other sources exist", async ({
+  test("skips the redundant source step and goes straight to certificate format when Upload is the only source", async ({
     page,
   }) => {
     await page.route("**/api/v1/security/cert-sign", (route) =>
@@ -76,12 +76,19 @@ test.describe("CertSign tool - certificate source model", () => {
     await uploadFiles(page, SAMPLE_PDF);
 
     await expect(page).toHaveURL(/\/cert-sign/);
-    // With no server/hardware sources, the picker collapses to a hint and the
-    // flow proceeds in the default MANUAL (upload) mode — no lone Upload CTA.
+    // With no server cert or hardware token there is nothing to choose, so the
+    // whole "Certificate source" step is hidden and the format picker shows directly.
     await expect(
-      page.getByText(/no other certificate sources are available/i).first(),
+      page.getByRole("button", { name: /pkcs12/i }).first(),
     ).toBeVisible({ timeout: 10_000 });
-    await expect(page.getByRole("button", { name: /^upload$/i })).toHaveCount(
+    await expect(page.getByText(/certificate source/i)).toHaveCount(0);
+    await expect(
+      page.getByText(/no other certificate sources are available/i),
+    ).toHaveCount(0);
+    await expect(
+      page.getByRole("button", { name: /this device/i }),
+    ).toHaveCount(0);
+    await expect(page.getByRole("button", { name: /^server$/i })).toHaveCount(
       0,
     );
   });
@@ -93,9 +100,9 @@ test.describe("CertSign tool - certificate source model", () => {
     await page.waitForLoadState("domcontentloaded");
     await uploadFiles(page, SAMPLE_PDF);
 
-    // No alternative sources: the picker is a hint, and hardware is never offered.
+    // No alternative sources: the source step is hidden, and hardware is never offered.
     await expect(
-      page.getByText(/no other certificate sources are available/i).first(),
+      page.getByRole("button", { name: /pkcs12/i }).first(),
     ).toBeVisible({ timeout: 10_000 });
     await expect(
       page.getByRole("button", { name: /this device/i }),
diff --git a/frontend/editor/src/core/tools/CertSign.tsx b/frontend/editor/src/core/tools/CertSign.tsx
index dd0668a491..4f5173b174 100644
--- a/frontend/editor/src/core/tools/CertSign.tsx
+++ b/frontend/editor/src/core/tools/CertSign.tsx
@@ -1,5 +1,7 @@
+import { useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { createToolFlow } from "@app/components/tools/shared/createToolFlow";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
 import CertificateTypeSettings from "@app/components/tools/certSign/CertificateTypeSettings";
 import CertificateFormatSettings from "@app/components/tools/certSign/CertificateFormatSettings";
 import CertificateFilesSettings from "@app/components/tools/certSign/CertificateFilesSettings";
@@ -23,6 +25,25 @@ const CertSign = (props: BaseToolProps) => {
     props,
   );
 
+  const { config } = useAppConfig();
+  // "Upload" is always available; the source chooser is only meaningful when a
+  // server certificate or a hardware token gives the user an actual alternative.
+  const hasCertSourceChoice =
+    (config?.serverCertificateEnabled ?? false) ||
+    (config?.hardwareSigningAvailable ?? false);
+
+  // With Upload as the only source, keep signMode on MANUAL even if a saved
+  // automation set AUTO/DEVICE, so the hidden source step can't strand the flow.
+  useEffect(() => {
+    if (!hasCertSourceChoice && base.params.parameters.signMode !== "MANUAL") {
+      base.params.updateParameter("signMode", "MANUAL");
+    }
+  }, [
+    hasCertSourceChoice,
+    base.params.parameters.signMode,
+    base.params.updateParameter,
+  ]);
+
   const certTypeTips = useCertificateTypeTips();
   const appearanceTips = useSignatureAppearanceTips();
   const signModeTips = useSignModeTips();
@@ -63,6 +84,7 @@ const CertSign = (props: BaseToolProps) => {
     steps: [
       {
         title: t("certSign.source.stepTitle", "Certificate source"),
+        isVisible: hasCertSourceChoice,
         isCollapsed: base.settingsCollapsed,
         onCollapsedClick: base.settingsCollapsed
           ? base.handleSettingsReset

From 328cd8c6649f107bf2f298e74fbab5956bccfe86 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:46:55 +0100
Subject: [PATCH 23/35] Claude skills walkthrough, feature-walkthrough, and
 before/after (#6862)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

Add review only Claude skills

### Skills (Using
https://github.com/Stirling-Tools/Stirling-PDF/pull/6655 as example for
example files)
- **`/ui-walkthrough`** - captures every state of a feature's UI
(empty/populated/dialogs, light + dark + RTL) via the stubbed Playwright
harness, builds a single-image HTML report with a global light/dark
slider, then runs visual-consistency + UX review passes. `--fix`
auto-applies safe fixes and re-shoots.

[REAL-ui-walkthrough-pr6655.html](https://github.com/user-attachments/files/29594945/REAL-ui-walkthrough-pr6655.html)

- **`/feature-walkthrough`** — explains a branch end-to-end (Mermaid
diagrams, annotated file map, before/after, "try it locally") so a
reviewer with no prior context can follow it.

[REAL-feature-walkthrough-pr6655.html](https://github.com/user-attachments/files/29594950/REAL-feature-walkthrough-pr6655.html)

- **`/ui-before-after`** — generic branch/PR visual diff: derives the
changed UI from the diff, screenshots before (base) vs after (head),
pixel-diffs, auto-crops each pair to the region that actually changed
(full-page only when the change is page-wide), and builds PR-ready
before/after montages.

[REAL-ui-before-after-pr6655.html](https://github.com/user-attachments/files/29594954/REAL-ui-before-after-pr6655.html)




---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .claude/skills/feature-walkthrough/SKILL.md   |  97 ++++++
 .claude/skills/ui-before-after/SKILL.md       | 122 +++++++
 .../ui-before-after/capture-spec.template.ts  |  67 ++++
 .claude/skills/ui-before-after/diff-shots.mjs | 106 +++++++
 .../skills/ui-before-after/make_example.py    |  48 +++
 .../ui-before-after/montage-template.html     | 106 +++++++
 .../skills/ui-before-after/shoot-sections.mjs |  25 ++
 .claude/skills/ui-walkthrough/SKILL.md        | 120 +++++++
 .claude/skills/ui-walkthrough/make_example.py | 116 +++++++
 .../ui-walkthrough/report-template.html       | 298 ++++++++++++++++++
 10 files changed, 1105 insertions(+)
 create mode 100644 .claude/skills/feature-walkthrough/SKILL.md
 create mode 100644 .claude/skills/ui-before-after/SKILL.md
 create mode 100644 .claude/skills/ui-before-after/capture-spec.template.ts
 create mode 100644 .claude/skills/ui-before-after/diff-shots.mjs
 create mode 100644 .claude/skills/ui-before-after/make_example.py
 create mode 100644 .claude/skills/ui-before-after/montage-template.html
 create mode 100644 .claude/skills/ui-before-after/shoot-sections.mjs
 create mode 100644 .claude/skills/ui-walkthrough/SKILL.md
 create mode 100644 .claude/skills/ui-walkthrough/make_example.py
 create mode 100644 .claude/skills/ui-walkthrough/report-template.html

diff --git a/.claude/skills/feature-walkthrough/SKILL.md b/.claude/skills/feature-walkthrough/SKILL.md
new file mode 100644
index 0000000000..f2a4bfdc8b
--- /dev/null
+++ b/.claude/skills/feature-walkthrough/SKILL.md
@@ -0,0 +1,97 @@
+---
+name: feature-walkthrough
+description: >-
+  Explain the full logic and process of the current branch end-to-end so someone
+  with no prior knowledge of the task can understand, review, and reproduce it.
+  Scopes the change from the branch diff, traces the flow across every layer it
+  touches (frontend tool/hook/component, Java controller/service/endpoint, Python
+  engine, config, i18n, tests), and produces a self-contained walkthrough document
+  with Mermaid diagrams (sequence/flow/architecture), annotated file map with
+  clickable references, before/after behavior, screenshots where a UI is involved,
+  a "try it locally" section, and edge cases/risks. Use when asked for a feature or
+  branch walkthrough, "explain what this branch does", a design/logic writeup, PR
+  reviewer onboarding, or a hand-off doc. Pass --html to also emit a rendered HTML
+  version; --no-screens to skip screenshots.
+argument-hint: "[branch-or-area] [--html] [--no-screens]"
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+---
+
+# Feature / Branch Walkthrough
+
+Turn the current branch into a walkthrough a newcomer can follow. Audience:
+**someone who has never seen this task**. Explain the *why*, the *flow*, and *how to
+try it* - not just a diff summary.
+
+`$ARGUMENTS` may name a branch or area to focus on; default is the current branch
+vs `main`. Flags: `--html` (also emit a rendered HTML twin), `--no-screens`.
+
+## Process
+
+### 1. Scope the change
+- `git log --oneline main..HEAD` and `git diff --stat main...HEAD` for the shape.
+- Read the PR description / commit messages for stated intent. Do **not** invent
+  history or motivation that isn't evidenced (state current behavior in present tense).
+- Classify touched files by layer:
+  - **Frontend**: tools (`frontend/editor/src/core/components/tools/*` or `.../core/tools/*`),
+    hooks (`core/hooks/tools/*`, `useToolOperation`), contexts, routes, i18n
+    (`public/locales/en-US`).
+  - **Java backend**: controllers (`.../controller/api/...`), services, models, config.
+  - **Engine**: `engine/src/stirling/{agents,contracts,api,services}`.
+  - **Config / build / docker / tests.**
+
+### 2. Trace the flow end-to-end
+Follow one real path from user action to result. For a typical PDF tool that's:
+UI control → `useToolOperation` hook → `POST /api/v1/...` → Spring controller →
+service (PDFBox / LibreOffice / engine call) → response → review panel → download.
+Read the actual files so the narrative is true to the code, and collect the exact
+file:line anchors you'll cite.
+
+### 3. Draw the diagrams (Mermaid)
+Pick what fits; usually 2-3 of:
+- **Sequence diagram** - request/response across frontend → backend → engine.
+- **Flowchart** - the core decision/branching logic of the feature.
+- **Architecture/component** - new pieces and how they wire to existing ones.
+- **State** - if the feature has modes/steps.
+Keep nodes labeled in plain language. Validate the Mermaid parses before shipping.
+
+### 4. Screenshots (unless --no-screens)
+If a UI is involved, capture key states with the stubbed Playwright harness
+(see the **ui-walkthrough** skill and `files-page-screenshots.spec.ts` for the
+pattern) or, for before/after, capture `main` then the branch. Drop PNGs in
+`walkthrough/<feature>/` and reference them from the doc. For backend-only
+changes, show request/response examples (curl + JSON) instead.
+
+### 5. Write the walkthrough
+Create `walkthrough/<feature>/FEATURE-WALKTHROUGH.md` with:
+1. **TL;DR** - what the branch does and who it's for, in 3-4 sentences.
+2. **Problem & approach** - what wasn't possible before; the chosen solution.
+3. **Architecture diagram** + 1-paragraph orientation.
+4. **End-to-end flow** - the sequence diagram + a numbered walk of each step,
+   each citing the real file (clickable `path:line`).
+5. **Key files** - annotated map (path → one line on its role).
+6. **Logic deep-dive** - the flowchart + prose for the non-obvious decisions.
+7. **Behavior** - before vs after; screenshots or request/response examples.
+8. **Try it locally** - exact steps (`task dev` / `task dev:all`, the route to
+   open or the curl to run, any env like `DOCKER_ENABLE_SECURITY` or a test
+   license key). Make it copy-pasteable.
+9. **Edge cases, risks, follow-ups** - what's untested, known limits, gotchas.
+
+Markdown is the primary deliverable - it renders with diagrams in GitHub PRs and
+IDEs, no build step, ideal for review.
+
+### 6. If `--html`
+Also emit `walkthrough/<feature>/walkthrough.html`: the same content with Mermaid
+rendered via `mermaid.initialize({startOnLoad:true})` (script from CDN; note in
+the file that rendering diagrams needs network, the `.md` is the offline copy) and
+screenshots inline. Keep it self-contained otherwise.
+
+### 7. Deliver
+Give the doc path and a short chat summary. Offer to `SendUserFile` it.
+
+## Principles
+- **True to the code.** Every claim traces to a file you read; cite `path:line`.
+  No fabricated migration/version history.
+- **Newcomer-first.** Define repo-specific terms (FileContext, `useToolOperation`,
+  the `@app/*` layer cascade, stubbed vs live tests) on first use.
+- **Show, don't assert.** Prefer a diagram + a real example over adjectives.
+- Don't commit the `walkthrough/` output unless asked.
diff --git a/.claude/skills/ui-before-after/SKILL.md b/.claude/skills/ui-before-after/SKILL.md
new file mode 100644
index 0000000000..07a8561baa
--- /dev/null
+++ b/.claude/skills/ui-before-after/SKILL.md
@@ -0,0 +1,122 @@
+---
+name: ui-before-after
+description: >-
+  Analyse a branch or PR and automatically capture before/after screenshots of
+  every UI surface its changes touch, then pixel-diff the pairs to surface what
+  actually changed and assemble PR-ready before/after montage images. Generic and
+  diff-driven: it derives the capture targets from the diff (changed tools/routes →
+  URLs) instead of hand-listing screens, captures "before" from the base branch and
+  "after" from the head, then keeps only the views that visually differ. Each
+  comparison is auto-cropped to the region that actually changed (the bounding box of
+  differing pixels), falling back to the full page only when the change spans most of
+  it. Use for before/after shots, a visual diff of a branch/PR, "screenshots for the
+  PR description", "show what changed in the UI", or a side-by-side of UI changes.
+  Takes a PR number/URL (resolved via gh) or a branch; defaults to the current branch
+  vs its base. Flags: --scope <selector>, --base <ref|merge-base>, --theme
+  light|dark|both, --all (capture every route, not just changed), --no-autocrop,
+  --pagewide <n>, --threshold <n>.
+argument-hint: "[PR# | PR-url | branch] [--scope <sel>] [--base <ref>] [--theme both] [--all] [--no-autocrop]"
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+---
+
+# UI Before / After (generic visual diff)
+
+Point it at a branch or PR; it figures out which UI changed, screenshots every
+affected surface **before** (base) and **after** (head), pixel-diffs the pairs, and
+montages the ones that actually changed into images for the PR description.
+
+`$ARGUMENTS`: a PR number/URL, a branch, or nothing (current branch vs base).
+By default it captures the full viewport and auto-crops each comparison to the region
+that changed. Flags: `--scope <css>` (narrow the *capture* to a container, e.g.
+`[data-sidebar="tool-panel"]`, when you already know where the change is),
+`--no-autocrop` (keep full frames), `--pagewide <fraction>` (above this share of the
+page, skip cropping; default 0.6), `--base <ref|merge-base>`,
+`--theme light|dark|both`, `--all` (walk every route, not just changed),
+`--threshold <fraction>` (diff sensitivity, default 0.001).
+
+Shares the capture harness with **ui-walkthrough** - read its SKILL.md for the
+stubbed-Playwright setup, worktree node_modules + `generate-icons`, the
+stale-`:5173` gotcha, and the dark-mode init-script. Bundled helpers:
+[capture-spec.template.ts](capture-spec.template.ts), [diff-shots.mjs](diff-shots.mjs),
+[montage-template.html](montage-template.html), [shoot-sections.mjs](shoot-sections.mjs).
+
+## Process
+
+### 1. Resolve target + base
+```
+gh pr view <pr> --json number,title,headRefName,baseRefName,url,files   # PR
+# or branch: base = merge-base(main, HEAD); head = HEAD
+gh pr diff <pr> --name-only        # or: git diff --name-only <base>...HEAD
+```
+
+### 2. Derive capture targets from the diff (the "analyse" step - no hand-listing)
+Map changed frontend files to URLs generically:
+- **Tools**: a changed `components/tools/<toolDir>/…` or `hooks/tools/<tool>/…` →
+  toolId → URL via the repo's own rule `getToolUrlPath` in
+  [toolsTaxonomy.ts:200](frontend/editor/src/core/data/toolsTaxonomy.ts): `/` + the
+  id kebab-cased (`addPageNumbers` → `/add-page-numbers`).
+- **Pages/routes**: changed `filesPage/*` → `/files`, etc.
+- `--all`: enumerate every tool in the registry instead of just changed ones.
+Write `frontend/editor/screenshots/ui-diff/targets.json` =
+`[{ "id":"compress", "url":"/compress", "name":"Compress" }]`. This is what makes
+it generic - the spec never names a tool.
+
+### 3. Capture AFTER (head) then BEFORE (base)
+Copy [capture-spec.template.ts](capture-spec.template.ts) →
+`src/core/tests/stubbed/ui-before-after.spec.ts` (it loops `targets.json`, seeds a
+sample PDF so file-dependent panels render, navigates to each URL, and screenshots
+the full viewport - or the `--scope` container if given). Ensure the harness is ready
+(node_modules + icons).
+```
+# after = current head
+cd frontend/editor && PR_SHOT_SIDE=after PR_SHOT_THEME=light \
+  npx playwright test --project=stubbed ui-before-after.spec.ts
+# before = base, in an isolated worktree (copy the spec + targets.json in)
+git worktree add ../ba-base origin/<baseRefName>        # or the merge-base
+#   set up its frontend, copy spec + screenshots/ui-diff/targets.json across, then:
+cd ../ba-base/frontend/editor && PR_SHOT_SIDE=before PR_SHOT_THEME=light \
+  npx playwright test --project=stubbed ui-before-after.spec.ts
+#   copy its screenshots/ui-diff/before/ back next to after/. Repeat with
+#   PR_SHOT_THEME=dark if --theme includes dark. Remove worktree when done.
+```
+
+### 4. Auto-diff (surface what changed)
+```
+cd frontend/editor && node <skill>/diff-shots.mjs \
+  screenshots/ui-diff/before screenshots/ui-diff/after screenshots/ui-diff
+```
+Produces `diff-report.json` classifying each view `unchanged | changed | added |
+removed`. For each changed view it computes the bounding box of differing pixels and
+writes cropped `__before_crop.png` / `__after_crop.png` / `__diff.png` to that region
+(+ padding) - **unless** the change covers more than `--pagewide` of the frame, where
+it keeps the full frame (`pageWide:true`). Drop `unchanged` - that's the noise the
+user doesn't want.
+
+### 5. Montage the changes
+Build the manifest from the non-unchanged entries (group by tab/tool; each becomes a
+state row with before/after). For changed views use the cropped `cropBefore` /
+`cropAfter` from `diff-report.json` (tight on the affected region; full frame when
+`pageWide`); `added`/`removed` render the "not present" placeholder. Fill
+[montage-template.html](montage-template.html) (replace the `window.__BA__` data
+block; base64-inline the PNGs for portability), then render one PNG per section with
+[shoot-sections.mjs](shoot-sections.mjs). Optionally include the `__diff.png` overlay
+as a third column.
+
+### 6. Deliver
+Output the `montage_<tab>.png` files + a short summary (N changed / added / removed,
+M unchanged skipped) and a paste-ready Markdown block. GitHub has no PR-body image
+API, so tell the user to drag the PNGs into the description. Do **not** post to the
+PR.
+
+## Gotchas
+- Two installs (base worktree + head); junction main's node_modules only if its deps
+  match that ref, else `npm ci` (see ui-walkthrough's stale-dep note).
+- A view that errors on one side (refactored/removed) → that side is missing; the
+  diff marks it added/removed rather than failing the run.
+- Pixel diff needs equal dimensions, so capture at a fixed viewport (the template
+  does); a view whose size changed is reported as "changed (dimensions differ)",
+  uncropped.
+- Auto-crop uses a single bounding box, so two far-apart changes give one large crop
+  (or trip `--pagewide`); narrow with `--scope` if that happens.
+- `getToolUrlPath` is the source of truth for tool URLs - use it, don't guess slugs.
+- Don't commit `screenshots/`, the throwaway spec, or the base worktree.
diff --git a/.claude/skills/ui-before-after/capture-spec.template.ts b/.claude/skills/ui-before-after/capture-spec.template.ts
new file mode 100644
index 0000000000..fd8882915b
--- /dev/null
+++ b/.claude/skills/ui-before-after/capture-spec.template.ts
@@ -0,0 +1,67 @@
+// Generic before/after capturer. NOT app-specific: it walks a targets.json that
+// the ui-before-after skill generates from the branch/PR diff, so nothing here is
+// hand-listed. Copy to src/core/tests/stubbed/ui-before-after.spec.ts, then run
+// once per (side, theme):
+//   PR_SHOT_SIDE=after  PR_SHOT_THEME=light \
+//     npx playwright test --project=stubbed ui-before-after.spec.ts
+//
+// targets.json shape: [{ "id":"compress", "url":"/compress", "name":"Compress",
+//                        "needsFile": true }]
+import { test } from "@app/tests/helpers/stub-test-base";
+import type { Page } from "@playwright/test";
+import fs from "node:fs";
+import path from "node:path";
+
+const SIDE = process.env.PR_SHOT_SIDE ?? "after";
+const THEME = process.env.PR_SHOT_THEME ?? "light";
+// Capture the full viewport by default so the affected region is in frame
+// wherever it is; diff-shots.mjs crops each comparison to what actually changed.
+// Set PR_SHOT_SCOPE to a selector to narrow the capture to one container.
+const SCOPE = process.env.PR_SHOT_SCOPE ?? "";
+const ROOT = path.resolve(process.cwd(), "screenshots", "ui-diff");
+const OUT = path.join(ROOT, SIDE);
+// A tiny sample PDF so file-dependent tool panels render. Point at a real fixture.
+const SAMPLE_PDF = process.env.PR_SHOT_SAMPLE ?? "src/core/tests/test-fixtures/sample.pdf";
+
+type Target = { id: string; url: string; name?: string; needsFile?: boolean };
+const targets: Target[] = JSON.parse(fs.readFileSync(path.join(ROOT, "targets.json"), "utf-8"));
+
+test.use({ autoGoto: false, viewport: { width: 1600, height: 900 }, seedJwt: true });
+
+async function applyTheme(page: Page): Promise<void> {
+  if (THEME !== "dark") return;
+  await page.addInitScript(() => {
+    localStorage.setItem("mantine-color-scheme", "dark");
+    localStorage.setItem("mantine-color-scheme-value", "dark");
+  });
+  await page.emulateMedia({ colorScheme: "dark" });
+}
+
+async function seedFile(page: Page): Promise<void> {
+  if (!fs.existsSync(SAMPLE_PDF)) return;
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("files-button").click().catch(() => {});
+  await page.locator('[data-testid="file-input"]').setInputFiles(SAMPLE_PDF).catch(() => {});
+  await page.locator(".file-sidebar-file-item").first().isVisible({ timeout: 8_000 }).catch(() => {});
+}
+
+for (const t of targets) {
+  // One test per target so a single failure doesn't drop the rest.
+  test(`${SIDE}/${THEME} ${t.id}`, async ({ page }) => {
+    fs.mkdirSync(OUT, { recursive: true });
+    await applyTheme(page);
+    if (t.needsFile !== false) await seedFile(page);
+    await page.goto(t.url, { waitUntil: "domcontentloaded" });
+    await page.waitForTimeout(400); // settle Mantine portals/transitions
+    const shot = path.join(OUT, `${t.id}__${THEME}.png`);
+    if (SCOPE) {
+      const scope = page.locator(SCOPE).first();
+      if (await scope.isVisible({ timeout: 8_000 }).catch(() => false)) {
+        await scope.screenshot({ path: shot });
+        return;
+      }
+    }
+    // Full viewport (fixed size → stable dimensions for pixel diffing).
+    await page.screenshot({ path: shot });
+  });
+}
diff --git a/.claude/skills/ui-before-after/diff-shots.mjs b/.claude/skills/ui-before-after/diff-shots.mjs
new file mode 100644
index 0000000000..94ff5e2aad
--- /dev/null
+++ b/.claude/skills/ui-before-after/diff-shots.mjs
@@ -0,0 +1,106 @@
+// Auto-diff before/ vs after/ screenshots, classify each as
+// unchanged | changed | added | removed, and CROP each changed pair to the
+// affected region (bounding box of differing pixels + padding) - unless the
+// change spans most of the page, in which case the full frame is kept.
+// Run from frontend/editor (so deps resolve):
+//   node <skill>/diff-shots.mjs <beforeDir> <afterDir> [outDir]
+// Env:
+//   DIFF_THRESHOLD  min fraction of differing pixels to count as changed (default 0.001)
+//   DIFF_PAD        padding px around the affected region (default 24)
+//   DIFF_PAGEWIDE   if affected bbox area / image area exceeds this, keep full frame (default 0.6)
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+
+const require = createRequire(path.join(process.cwd(), "noop.js"));
+const pm = require("pixelmatch");
+const pixelmatch = pm.default || pm;
+const { PNG } = require("pngjs");
+
+const beforeDir = path.resolve(process.argv[2]);
+const afterDir = path.resolve(process.argv[3]);
+const outDir = path.resolve(process.argv[4] || afterDir);
+const THRESHOLD = Number(process.env.DIFF_THRESHOLD ?? "0.001");
+const PAD = Number(process.env.DIFF_PAD ?? "24");
+const PAGEWIDE = Number(process.env.DIFF_PAGEWIDE ?? "0.6");
+
+const read = (p) => PNG.sync.read(fs.readFileSync(p));
+const isShot = (f) => f.endsWith(".png") && !/__(diff|before_crop|after_crop)\.png$/.test(f);
+const list = (d) => (fs.existsSync(d) ? fs.readdirSync(d).filter(isShot) : []);
+const names = [...new Set([...list(beforeDir), ...list(afterDir)])].sort();
+fs.mkdirSync(outDir, { recursive: true });
+
+function cropPNG(src, x, y, w, h) {
+  const out = new PNG({ width: w, height: h });
+  PNG.bitblt(src, out, x, y, w, h, 0, 0);
+  return out;
+}
+const writePNG = (p, png) => fs.writeFileSync(p, PNG.sync.write(png));
+
+// Bounding box of differing pixels using a diff mask (alpha>0 where changed).
+function changedBBox(before, after, w, h) {
+  const mask = new PNG({ width: w, height: h });
+  pixelmatch(before.data, after.data, mask.data, w, h, { threshold: 0.1, diffMask: true });
+  let minX = w, minY = h, maxX = -1, maxY = -1, count = 0;
+  for (let y = 0; y < h; y++) {
+    for (let x = 0; x < w; x++) {
+      if (mask.data[(y * w + x) * 4 + 3] > 0) {
+        count++;
+        if (x < minX) minX = x; if (x > maxX) maxX = x;
+        if (y < minY) minY = y; if (y > maxY) maxY = y;
+      }
+    }
+  }
+  return maxX < 0 ? null : { minX, minY, maxX, maxY, count };
+}
+
+const report = [];
+for (const name of names) {
+  const id = name.replace(/\.png$/, "");
+  const bp = path.join(beforeDir, name), ap = path.join(afterDir, name);
+  const hasB = fs.existsSync(bp), hasA = fs.existsSync(ap);
+  if (hasB && !hasA) { report.push({ id, status: "removed", before: bp }); continue; }
+  if (!hasB && hasA) { report.push({ id, status: "added", after: ap }); continue; }
+
+  const before = read(bp), after = read(ap);
+  if (before.width !== after.width || before.height !== after.height) {
+    report.push({ id, status: "changed", note: "dimensions differ", before: bp, after: ap });
+    continue;
+  }
+  const w = after.width, h = after.height;
+  const overlay = new PNG({ width: w, height: h });
+  const px = pixelmatch(before.data, after.data, overlay.data, w, h, { threshold: 0.1 });
+  const ratio = px / (w * h);
+  if (ratio <= THRESHOLD) { report.push({ id, status: "unchanged", ratio: Number(ratio.toFixed(5)), before: bp, after: ap }); continue; }
+
+  const box = changedBBox(before, after, w, h);
+  // Pad + clamp the affected region.
+  const x = Math.max(0, box.minX - PAD), y = Math.max(0, box.minY - PAD);
+  const x2 = Math.min(w, box.maxX + 1 + PAD), y2 = Math.min(h, box.maxY + 1 + PAD);
+  const bw = x2 - x, bh = y2 - y;
+  const pageWide = (bw * bh) / (w * h) > PAGEWIDE;
+
+  const entry = { id, status: "changed", ratio: Number(ratio.toFixed(5)), before: bp, after: ap, pageWide };
+  if (pageWide) {
+    // Change spans most of the page - keep the full frame, full overlay.
+    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, overlay);
+    entry.diff = dp;
+  } else {
+    entry.bbox = { x, y, w: bw, h: bh };
+    const cb = path.join(outDir, `${id}__before_crop.png`); writePNG(cb, cropPNG(before, x, y, bw, bh));
+    const ca = path.join(outDir, `${id}__after_crop.png`); writePNG(ca, cropPNG(after, x, y, bw, bh));
+    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, cropPNG(overlay, x, y, bw, bh));
+    entry.cropBefore = cb; entry.cropAfter = ca; entry.diff = dp;
+  }
+  report.push(entry);
+}
+
+fs.writeFileSync(path.join(outDir, "diff-report.json"), JSON.stringify(report, null, 2));
+const changed = report.filter((r) => r.status !== "unchanged");
+console.log(`diffed ${report.length} view(s): ${changed.length} changed/added/removed, ${report.length - changed.length} unchanged`);
+for (const r of changed) {
+  const tail = r.status !== "changed" ? ""
+    : r.pageWide ? " (page-wide → full frame)"
+    : ` (${(r.ratio * 100).toFixed(2)}%, cropped to ${r.bbox.w}×${r.bbox.h})`;
+  console.log(`  ${r.status.padEnd(9)} ${r.id}${tail}${r.note ? " - " + r.note : ""}`);
+}
diff --git a/.claude/skills/ui-before-after/make_example.py b/.claude/skills/ui-before-after/make_example.py
new file mode 100644
index 0000000000..ec5eeee029
--- /dev/null
+++ b/.claude/skills/ui-before-after/make_example.py
@@ -0,0 +1,48 @@
+"""Build EXAMPLE.html from montage-template.html using REAL files-page shots as
+stand-in before/after pairs (layout demo, not an actual PR diff). Inlines PNGs as
+data URIs so the HTML is portable. Run: python make_example.py"""
+import base64
+import json
+import pathlib
+import re
+
+HERE = pathlib.Path(__file__).parent
+SHOTS = pathlib.Path(
+    r"C:\Users\systo\git\Stirling-PDFNew\.claude\worktrees\kind-faraday-522a30"
+    r"\frontend\editor\screenshots\files-page"
+)
+
+
+def uri(fname):
+    p = SHOTS / fname
+    return "data:image/png;base64," + base64.b64encode(p.read_bytes()).decode() if p.exists() else None
+
+
+data = {
+    "pr": "DEMO",
+    "title": "EXAMPLE — before/after montage (layout demo, real Files-page shots; not a real PR diff)",
+    "base": "main", "head": "demo-branch",
+    "cropSelector": "[data-sidebar=\"tool-panel\"]  (real runs crop to the side; these demo shots are full-page)",
+    "tabs": [
+        {"id": "files", "title": "Files page", "ctx": "Each row = one flow state; left = base branch, right = this PR.",
+         "states": [
+             {"name": "Empty folder", "before": uri("01_empty_state_ctas.png"), "after": uri("02_empty_state_storage_off.png")},
+             {"name": "Files + details panel", "before": uri("03_subtoolbar_with_files.png"), "after": uri("06_details_panel_save_to_server.png")},
+             {"name": "Delete folder confirm", "before": None, "after": uri("19_delete_folder_dialog.png"), "note": "New in this PR"},
+         ]},
+        {"id": "move", "title": "Move-to-folder dialog",
+         "states": [
+             {"name": "Dialog opened", "before": uri("07_move_dialog_collapsed.png"), "after": uri("08_move_dialog_create_folder_expanded.png")},
+             {"name": "After folder created", "before": None, "after": uri("08b_move_dialog_after_create_folder.png"), "note": "New flow"},
+         ]},
+    ],
+}
+
+tpl = (HERE / "montage-template.html").read_text(encoding="utf-8")
+out = re.sub(
+    r"/\*__DATA__\*/.*?/\*__END__\*/",
+    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
+    tpl, count=1, flags=re.S,
+)
+(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
+print("wrote", HERE / "EXAMPLE.html", "(", (HERE / "EXAMPLE.html").stat().st_size // 1024, "KB )")
diff --git a/.claude/skills/ui-before-after/montage-template.html b/.claude/skills/ui-before-after/montage-template.html
new file mode 100644
index 0000000000..ca0f69d4cf
--- /dev/null
+++ b/.claude/skills/ui-before-after/montage-template.html
@@ -0,0 +1,106 @@
+<!doctype html>
+<!--
+  Before/After montage for a PR description. The ui-before-after skill replaces
+  the JSON in the window.__BA__ data block below with the captured manifest, then
+  screenshots each .tab-section (id="section-<tabId>") into a PNG to drag into the
+  PR description. Self-contained; images may be relative paths or data URIs.
+
+  Data shape:
+  {
+    "pr":"6552","title":"...","base":"main","head":"feat/x",
+    "cropSelector":"[data-sidebar=\"tool-panel\"]",
+    "tabs":[
+      { "id":"sign","title":"Sign tool","states":[
+        {"name":"Initial","before":"before/sign__initial.png","after":"after/sign__initial.png"},
+        {"name":"Cert selected","before":null,"after":"after/sign__cert.png","note":"New in this PR"}
+      ]}
+    ]
+  }
+-->
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<title>Before / After</title>
+<style>
+  :root { --bg:#ffffff; --ink:#0b0c0e; --muted:#6b7280; --line:#e5e7eb;
+          --before:#6b7280; --after:#1f883d; --frame:#f3f4f6; --note:#b45309; }
+  * { box-sizing: border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink);
+         font:14px/1.5 -apple-system,"Segoe UI",Roboto,system-ui,sans-serif; }
+  .wrap { max-width:1100px; margin:0 auto; padding:24px; }
+  .doc-head { margin-bottom:8px; }
+  .doc-head h1 { font-size:18px; margin:0 0 2px; }
+  .doc-head .sub { color:var(--muted); font-size:12.5px; }
+  .legend { display:flex; gap:14px; align-items:center; margin:10px 0 4px; font-size:12px; color:var(--muted); }
+  .chip { font-size:10px; font-weight:700; letter-spacing:.04em; text-transform:uppercase;
+          padding:2px 8px; border-radius:999px; color:#fff; }
+  .chip.before { background:var(--before); } .chip.after { background:var(--after); }
+
+  .tab-section { border:1px solid var(--line); border-radius:14px; padding:18px 18px 8px;
+                 margin:18px 0; background:var(--bg); }
+  .tab-section > h2 { font-size:16px; margin:0 0 2px; }
+  .tab-section > .ctx { color:var(--muted); font-size:12px; margin-bottom:14px; }
+  .state { margin-bottom:18px; }
+  .state .name { font-weight:600; font-size:13.5px; margin-bottom:8px; display:flex; gap:8px; align-items:center; }
+  .state .name .note { font-weight:500; color:var(--note); font-size:12px; }
+  .pair { display:grid; grid-template-columns:1fr 1fr; gap:14px; align-items:start; }
+  .cell { border:1px solid var(--line); border-radius:10px; overflow:hidden; background:var(--frame); }
+  .cell .cap { display:flex; align-items:center; gap:8px; padding:7px 10px; border-bottom:1px solid var(--line);
+               background:var(--bg); }
+  .cell .cap .meta { color:var(--muted); font-size:11px; }
+  .cell img { display:block; width:100%; height:auto; background:#fff; }
+  .cell.empty .ph { display:flex; align-items:center; justify-content:center; height:160px; color:var(--muted);
+                    font-size:12.5px; text-align:center; padding:0 16px; }
+  .single .pair { grid-template-columns:1fr; }
+  .empty-doc { color:var(--muted); padding:40px; text-align:center; }
+  @media (max-width:760px){ .pair{ grid-template-columns:1fr; } }
+</style>
+</head>
+<body>
+<div class="wrap" id="root"></div>
+
+<script id="data">
+window.__BA__ = /*__DATA__*/{"pr":"","title":"No data","base":"","head":"","cropSelector":"","tabs":[]}/*__END__*/;
+</script>
+<script>
+(function(){
+  var D = window.__BA__ || { tabs: [] };
+  var root = document.getElementById("root");
+  function el(html){ var t=document.createElement("template"); t.innerHTML=html.trim(); return t.content.firstChild; }
+  function esc(s){ return (s==null?"":String(s)).replace(/[&<>]/g, function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;"}[c];}); }
+
+  function cell(kind, src){
+    if (src) {
+      return '<div class="cell"><div class="cap"><span class="chip '+kind+'">'+kind+'</span></div>'+
+             '<img src="'+esc(src)+'" alt="'+kind+'"/></div>';
+    }
+    return '<div class="cell empty"><div class="cap"><span class="chip '+kind+'">'+kind+'</span>'+
+           '<span class="meta">not present</span></div><div class="ph">No '+kind+' screenshot for this state</div></div>';
+  }
+
+  var head = '<div class="doc-head"><h1>'+esc(D.title || ("PR #"+D.pr))+'</h1>'+
+    '<div class="sub">Before / after &nbsp;·&nbsp; base <code>'+esc(D.base)+'</code> → head <code>'+esc(D.head)+'</code>'+
+    (D.cropSelector ? ' &nbsp;·&nbsp; cropped to <code>'+esc(D.cropSelector)+'</code>' : '')+'</div></div>'+
+    '<div class="legend"><span class="chip before">Before</span> base branch'+
+    '<span class="chip after">After</span> this PR</div>';
+  root.appendChild(el('<div>'+head+'</div>'));
+
+  if (!D.tabs || !D.tabs.length){ root.appendChild(el('<div class="empty-doc">No tabs captured yet.</div>')); return; }
+
+  D.tabs.forEach(function(tab){
+    var states = (tab.states||[]).map(function(s){
+      var onlyOne = (!s.before || !s.after);
+      return '<div class="state'+(onlyOne?' ':'')+'">'+
+        '<div class="name">'+esc(s.name)+(s.note?'<span class="note">'+esc(s.note)+'</span>':'')+'</div>'+
+        '<div class="pair">'+cell("before", s.before)+cell("after", s.after)+'</div></div>';
+    }).join("");
+    var sec = '<section class="tab-section" id="section-'+esc(tab.id)+'">'+
+      '<h2>'+esc(tab.title)+'</h2>'+
+      (tab.ctx?'<div class="ctx">'+esc(tab.ctx)+'</div>':'')+
+      states+'</section>';
+    root.appendChild(el(sec));
+  });
+})();
+</script>
+</body>
+</html>
diff --git a/.claude/skills/ui-before-after/shoot-sections.mjs b/.claude/skills/ui-before-after/shoot-sections.mjs
new file mode 100644
index 0000000000..504e531998
--- /dev/null
+++ b/.claude/skills/ui-before-after/shoot-sections.mjs
@@ -0,0 +1,25 @@
+// Render each .tab-section of a montage HTML into its own PNG (the PR-ready image).
+// Run from frontend/editor (so @playwright/test resolves):
+//   node <skill>/shoot-sections.mjs <montage.html> <outDir>
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { createRequire } from "node:module";
+
+const require = createRequire(path.join(process.cwd(), "noop.js"));
+const { chromium } = require("@playwright/test");
+
+const htmlPath = path.resolve(process.argv[2]);
+const outDir = path.resolve(process.argv[3] || path.dirname(htmlPath));
+
+const browser = await chromium.launch();
+const page = await browser.newPage({ viewport: { width: 1200, height: 1200 }, deviceScaleFactor: 2 });
+await page.goto(pathToFileURL(htmlPath).href, { waitUntil: "load" });
+await page.waitForTimeout(250); // let images/fonts paint
+const ids = await page.$$eval(".tab-section", (els) => els.map((e) => e.id));
+if (!ids.length) { console.error("no .tab-section found"); process.exit(1); }
+for (const id of ids) {
+  const name = id.replace(/^section-/, "");
+  await page.locator("#" + id).screenshot({ path: path.join(outDir, `montage_${name}.png`) });
+  console.log("wrote montage_" + name + ".png");
+}
+await browser.close();
diff --git a/.claude/skills/ui-walkthrough/SKILL.md b/.claude/skills/ui-walkthrough/SKILL.md
new file mode 100644
index 0000000000..ef6d4b9dec
--- /dev/null
+++ b/.claude/skills/ui-walkthrough/SKILL.md
@@ -0,0 +1,120 @@
+---
+name: ui-walkthrough
+description: >-
+  Full UI investigation of the current branch's feature. Enumerates every view
+  and state (empty, populated, loading, error, each dialog/menu/panel, responsive
+  breakpoints, light + dark + RTL), captures them with the stubbed Playwright
+  harness, assembles a single-image HTML walkthrough with a global light/dark
+  toggle slider, then runs two review passes: visual/consistency (alignment,
+  spacing, professionalism, dark/light parity, contrast, truncation) and
+  UX/ease-of-use (flow, discoverability, affordances, empty/error states,
+  expectations). Use when asked for a UI walkthrough, screenshot review, design
+  or QA pass, "find anywhere to make it easier/better for users", or before
+  merging frontend work. Pass --fix to auto-apply safe frontend fixes and
+  re-capture; --theme to limit themes; --no-rtl to skip RTL.
+argument-hint: "[feature/area] [--fix] [--theme light|dark|both] [--no-rtl] [--breakpoints]"
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+---
+
+# UI Walkthrough
+
+Produce a reviewable HTML walkthrough of a feature's UI in every state and theme,
+then critique it. Optionally auto-fix and re-capture.
+
+`$ARGUMENTS` may name the feature/area to focus on. If empty, scope from the
+current branch diff. Flags: `--fix`, `--theme light|dark|both` (default both),
+`--no-rtl`, `--breakpoints` (also capture phone/narrow widths).
+
+## What this repo gives you (use it, don't reinvent)
+
+- **Stubbed Playwright project** = backend-free screenshots via `page.route()` mocks.
+  Reference implementation: `frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts`.
+  It already shows the light / **dark** / **RTL** passes, JWT seeding, IndexedDB
+  seeding, and dumping PNGs to a `screenshots/<area>/` folder. Copy its shape.
+- Helpers: `frontend/editor/src/core/tests/helpers/ui-helpers.ts`
+  (`uploadFiles`, `openSettings`, `waitForModalOpen`, `dismissTourTooltip`, …)
+  and the `stub-test-base` fixtures (`autoGoto`, `seedJwt`, `viewport`).
+- Config: `frontend/editor/playwright.config.ts` (run from `frontend/editor/`).
+- Report template: [report-template.html](report-template.html) - self-contained,
+  one big image at a time, a global light/dark slider that flips every shot,
+  thumbnail rail, prev/next + arrow keys, and a Findings tab.
+
+## Process
+
+### 1. Scope the feature
+- If `$ARGUMENTS` is empty: `git diff --name-only main...HEAD` and read the PR/commits.
+  Identify changed pages, tools (`core/components/tools/<tool>` or `core/tools/<tool>`),
+  dialogs, panels, and routes.
+- Enumerate **every view and state** to capture, e.g.:
+  empty / populated / loading / error / disabled; each dialog, menu, popover, tooltip;
+  each tab or step; selection + multi-select; success/result panel; and (if relevant)
+  permission/role variants. Write the list down before capturing - it's the report's spine.
+
+### 2. Prepare the harness (worktree-safe)
+Worktrees have no `node_modules` and no generated icons. From repo root:
+```
+cd frontend && npm ci                       # or junction main's node_modules (see memory)
+cd frontend/editor && node scripts/generate-icons.js
+```
+Kill any stale dev server first (it serves old modules):
+`Get-NetTCPConnection -LocalPort 5173 -State Listen | %{ Stop-Process -Id $_.OwningProcess -Force }`
+
+### 3. Write the capture spec
+Create `frontend/editor/src/core/tests/stubbed/<feature>-walkthrough.spec.ts`,
+modeled on `files-page-screenshots.spec.ts`. For each enumerated view:
+- stub the APIs it needs, drive the UI to that state, wait on a real locator
+  (not a fixed sleep), `await settle(page)` for Mantine portals, then
+  `page.screenshot({ path: shotPath("NN_name_<theme>") })`.
+- Capture each view in **light and dark** (and RTL unless `--no-rtl`). Reuse the
+  `enableDarkMode` / `enableRtl` init-script pattern from the reference spec
+  (`localStorage["mantine-color-scheme"]="dark"` + `emulateMedia({colorScheme:"dark"})`).
+- Name shots `NN_<view>_<theme>.png` so light/dark pair up by suffix.
+- Prefer **stable test-ids** over translated accessible names (RTL/i18n breaks text locators).
+
+Run it: `cd frontend/editor && npx playwright test --project=stubbed <feature>-walkthrough.spec.ts`.
+Add `--project=stubbed-firefox`/`-webkit` only if cross-browser layout matters.
+
+### 4. Build the report
+- Copy `report-template.html` to `screenshots/<feature>/walkthrough.html` (so the
+  relative `screenshots/...` image paths resolve, or rewrite paths to sit beside it).
+- Build the manifest and inject it: replace the JSON between the
+  `/*__DATA__*/` … `/*__END__*/` markers with one `views[]` entry per view
+  (`{id,title,light,dark,viewport,notes}`) and an empty `findings` object you'll
+  fill in step 5. Keep `light`/`dark` as relative paths.
+- The toggle slider answers the "one big image + flip light/dark for all" request:
+  it shows a single large screenshot, and switching the slider re-themes every view.
+
+### 5. Review pass 1 - visual & consistency
+Open each screenshot (Read the PNG) and judge against the others:
+alignment & spacing rhythm, control placement, button hierarchy, typography,
+**light/dark parity** (contrast, invisible borders, washed-out text, wrong tokens),
+truncation/overflow, RTL mirroring, focus states, icon consistency, professional polish.
+Record each issue as a finding `{severity:high|med|low, view, title, detail, fix}`.
+
+### 6. Review pass 2 - UX & ease of use
+Walk the flow as a first-time user: discoverability, number of steps, affordance
+clarity, empty-state guidance, error recovery, destructive-action confirmation,
+defaults, loading feedback, mobile reachability, accessible names, and whether the
+UI matches user expectations for this kind of tool. Record findings the same way.
+
+Write both finding lists into the report's `findings.visual` / `findings.ux`,
+and add short per-view `notes`. Re-inject the manifest.
+
+### 7. If `--fix`
+Only safe, self-contained frontend fixes (spacing, alignment, tokens, missing
+dark-mode colors, labels, aria, obvious copy). For each: edit the component/CSS,
+mark the finding `fixed:true` with what changed, then **re-run the spec** to
+re-capture the affected shots and regenerate the report. Run `task frontend:check`.
+Leave anything risky or ambiguous as a finding, not a change.
+
+### 8. Deliver
+Tell the user the report path and give a tight chat summary: N views ×
+themes captured, top findings by severity, and (if `--fix`) what changed.
+Optionally `SendUserFile` the `walkthrough.html`.
+
+## Gotchas
+- Stale `:5173` server serves old bundles - kill it before capturing (see step 2).
+- Missing `material-symbols-icons.json` → blank app → every shot times out. Run
+  `generate-icons.js` first.
+- `await settle(page)` before shots or portals/transitions tear mid-capture.
+- Don't commit the generated `screenshots/` or the throwaway spec unless asked.
diff --git a/.claude/skills/ui-walkthrough/make_example.py b/.claude/skills/ui-walkthrough/make_example.py
new file mode 100644
index 0000000000..b65c2a010a
--- /dev/null
+++ b/.claude/skills/ui-walkthrough/make_example.py
@@ -0,0 +1,116 @@
+"""Build a self-contained EXAMPLE.html from report-template.html with mock
+light/dark screenshots, so the viewer + global theme slider can be demoed
+without a real capture run. Run: python make_example.py"""
+import base64
+import json
+import pathlib
+import re
+
+HERE = pathlib.Path(__file__).parent
+
+
+def svg(bg, fg, panel, accent, muted, label, kind):
+    """A simple fake 'screen' SVG: title bar, sidebar, content varies by kind."""
+    parts = [
+        f'<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="900" viewBox="0 0 1600 900">',
+        f'<rect width="1600" height="900" fill="{bg}"/>',
+        # top bar
+        f'<rect width="1600" height="64" fill="{panel}"/>',
+        f'<circle cx="40" cy="32" r="12" fill="{accent}"/>',
+        f'<rect x="64" y="24" width="160" height="16" rx="6" fill="{muted}"/>',
+        f'<rect x="1430" y="20" width="130" height="24" rx="12" fill="{accent}"/>',
+        # left sidebar
+        f'<rect x="0" y="64" width="220" height="836" fill="{panel}"/>',
+    ]
+    for i in range(6):
+        y = 100 + i * 56
+        parts.append(f'<rect x="24" y="{y}" width="172" height="32" rx="8" fill="{bg}"/>')
+    if kind == "empty":
+        parts += [
+            f'<rect x="700" y="360" width="200" height="120" rx="16" fill="none" stroke="{muted}" stroke-width="3" stroke-dasharray="10 8"/>',
+            f'<rect x="690" y="510" width="220" height="44" rx="10" fill="{accent}"/>',
+            f'<text x="800" y="600" fill="{muted}" font-family="sans-serif" font-size="26" text-anchor="middle">{label}</text>',
+        ]
+    elif kind == "form":
+        for i in range(4):
+            y = 140 + i * 90
+            parts.append(f'<rect x="280" y="{y}" width="160" height="16" rx="6" fill="{muted}"/>')
+            parts.append(f'<rect x="280" y="{y+26}" width="900" height="44" rx="8" fill="{panel}" stroke="{muted}" stroke-width="1"/>')
+        parts.append(f'<rect x="280" y="560" width="200" height="50" rx="10" fill="{accent}"/>')
+        parts.append(f'<text x="800" y="850" fill="{muted}" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>')
+    else:  # dialog
+        parts += [
+            f'<rect width="1600" height="900" fill="{fg}" opacity="0.45"/>',
+            f'<rect x="520" y="280" width="560" height="360" rx="18" fill="{panel}"/>',
+            f'<rect x="556" y="320" width="280" height="22" rx="8" fill="{fg}"/>',
+            f'<rect x="556" y="372" width="488" height="14" rx="6" fill="{muted}"/>',
+            f'<rect x="556" y="398" width="420" height="14" rx="6" fill="{muted}"/>',
+            f'<rect x="820" y="560" width="110" height="44" rx="9" fill="{bg}" stroke="{muted}"/>',
+            f'<rect x="946" y="560" width="98" height="44" rx="9" fill="{accent}"/>',
+            f'<text x="800" y="700" fill="#fff" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>',
+        ]
+    parts.append("</svg>")
+    return "".join(parts)
+
+
+def data_uri(s):
+    return "data:image/svg+xml;base64," + base64.b64encode(s.encode()).decode()
+
+
+LIGHT = dict(bg="#ffffff", fg="#111418", panel="#f1f3f6", accent="#2f6fed", muted="#c2c8d0")
+DARK = dict(bg="#16181c", fg="#000000", panel="#1f232a", accent="#5b8cff", muted="#3a414b")
+
+
+def pair(kind, label):
+    return (
+        data_uri(svg(LIGHT["bg"], LIGHT["fg"], LIGHT["panel"], LIGHT["accent"], LIGHT["muted"], label, kind)),
+        data_uri(svg(DARK["bg"], DARK["fg"], DARK["panel"], DARK["accent"], DARK["muted"], label, kind)),
+    )
+
+
+views = []
+for idx, (kind, title, label) in enumerate([
+    ("empty", "Empty state", "Drop a PDF to start"),
+    ("form", "Tool options panel", "Compress options"),
+    ("dialog", "Confirm dialog", "Replace original file?"),
+], start=1):
+    light, dark = pair(kind, label)
+    views.append({
+        "id": f"{idx:02d}_{kind}",
+        "title": title,
+        "light": light,
+        "dark": dark,
+        "viewport": "1600x900",
+        "notes": ["This is mock data to demo the viewer."],
+    })
+
+data = {
+    "feature": "EXAMPLE - Compress PDF (mock data)",
+    "branch": "demo",
+    "generated": "example",
+    "views": views,
+    "findings": {
+        "visual": [
+            {"severity": "high", "view": "03_dialog", "title": "Dialog buttons too close",
+             "detail": "Cancel/Confirm have only 8px gap; easy to misclick.",
+             "fix": "Increase gap to var(--mantine-spacing-md)."},
+            {"severity": "low", "view": "02_form", "title": "Field labels low contrast in dark mode",
+             "detail": "Muted token fails WCAG AA on the dark panel.",
+             "fix": "Use --mantine-color-dimmed instead of a hard-coded grey."},
+        ],
+        "ux": [
+            {"severity": "med", "view": "01_empty", "title": "Primary CTA below the dropzone",
+             "detail": "Users expect the action button adjacent to the dropzone.",
+             "fix": "Move the button directly under the dashed zone."},
+        ],
+    },
+}
+
+tpl = (HERE / "report-template.html").read_text(encoding="utf-8")
+out = re.sub(
+    r"/\*__DATA__\*/.*?/\*__END__\*/",
+    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
+    tpl, count=1, flags=re.S,
+)
+(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
+print("wrote", (HERE / "EXAMPLE.html"))
diff --git a/.claude/skills/ui-walkthrough/report-template.html b/.claude/skills/ui-walkthrough/report-template.html
new file mode 100644
index 0000000000..3e96216a3b
--- /dev/null
+++ b/.claude/skills/ui-walkthrough/report-template.html
@@ -0,0 +1,298 @@
+<!doctype html>
+<!--
+  UI Walkthrough report template (self-contained, works from file://).
+  The ui-walkthrough skill replaces the JSON in the window.__WALKTHROUGH__ data
+  block below with the captured manifest. Do not add external CDN deps - it must open offline.
+
+  Data shape:
+  {
+    "feature": "Compress PDF tool",
+    "branch": "claude/...",
+    "generated": "2026-06-21",
+    "views": [
+      { "id": "01_empty", "title": "Empty state",
+        "light": "screenshots/compress/01_empty_light.png",
+        "dark":  "screenshots/compress/01_empty_dark.png",
+        "viewport": "1600x900",
+        "notes": ["Heading is centered", "Primary CTA below the fold on mobile"] }
+    ],
+    "findings": {
+      "visual": [ { "severity":"high", "view":"01_empty", "title":"...", "detail":"...", "fix":"..." } ],
+      "ux":     [ { "severity":"med",  "view":"03_dialog", "title":"...", "detail":"...", "fix":"..." } ]
+    }
+  }
+-->
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>UI Walkthrough</title>
+<style>
+  :root {
+    --bg: #f6f7f9; --panel: #ffffff; --panel-2: #f0f2f5; --text: #1a1b1e;
+    --muted: #6b7280; --border: #e2e5ea; --accent: #2f6fed; --accent-weak: #e8f0fe;
+    --shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
+    --hi: #d92d20; --med: #d98e00; --low: #2f6fed; --stage: #0b0c0e;
+  }
+  html[data-theme="dark"] {
+    --bg: #0d0e10; --panel: #16181c; --panel-2: #1d2024; --text: #e6e8eb;
+    --muted: #9aa3ad; --border: #2a2e35; --accent: #5b8cff; --accent-weak: #1a2336;
+    --shadow: 0 1px 3px rgba(0,0,0,.5), 0 8px 24px rgba(0,0,0,.4); --stage: #000;
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; font: 14px/1.5 -apple-system, "Segoe UI", Roboto, system-ui, sans-serif;
+         background: var(--bg); color: var(--text); }
+  header { display: flex; align-items: center; gap: 16px; padding: 12px 20px;
+           background: var(--panel); border-bottom: 1px solid var(--border); position: sticky; top: 0; z-index: 5; }
+  header h1 { font-size: 15px; margin: 0; font-weight: 650; }
+  header .sub { color: var(--muted); font-size: 12px; }
+  .spacer { flex: 1; }
+  .counter { color: var(--muted); font-variant-numeric: tabular-nums; font-size: 13px; }
+  .tabs { display: flex; gap: 4px; }
+  .tab { border: 1px solid var(--border); background: var(--panel-2); color: var(--text);
+         padding: 6px 12px; border-radius: 8px; cursor: pointer; font-size: 13px; }
+  .tab.active { background: var(--accent); color: #fff; border-color: var(--accent); }
+
+  /* Light/Dark slider */
+  .theme-toggle { display: flex; align-items: center; gap: 9px; user-select: none; }
+  .theme-toggle .lbl { font-size: 12px; color: var(--muted); }
+  .theme-toggle .lbl.on { color: var(--text); font-weight: 600; }
+  .switch { position: relative; width: 52px; height: 28px; }
+  .switch input { opacity: 0; width: 0; height: 0; }
+  .slider { position: absolute; inset: 0; cursor: pointer; background: var(--panel-2);
+            border: 1px solid var(--border); border-radius: 999px; transition: .2s; }
+  .slider:before { content: ""; position: absolute; height: 20px; width: 20px; left: 3px; top: 3px;
+                   background: #fbbf24; border-radius: 50%; transition: .2s; box-shadow: 0 1px 2px rgba(0,0,0,.3); }
+  .switch input:checked + .slider { background: var(--accent); }
+  .switch input:checked + .slider:before { transform: translateX(24px); background: #c7d2fe; }
+
+  main { display: grid; grid-template-columns: 240px 1fr; height: calc(100vh - 53px); }
+  .rail { border-right: 1px solid var(--border); overflow-y: auto; background: var(--panel); padding: 8px; }
+  .rail .group-label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em;
+                       color: var(--muted); padding: 10px 8px 4px; }
+  .thumb { display: flex; gap: 9px; align-items: center; padding: 7px; border-radius: 8px;
+           cursor: pointer; border: 1px solid transparent; }
+  .thumb:hover { background: var(--panel-2); }
+  .thumb.active { background: var(--accent-weak); border-color: var(--accent); }
+  .thumb img { width: 64px; height: 40px; object-fit: cover; border-radius: 4px; border: 1px solid var(--border); background: var(--stage); }
+  .thumb .t { font-size: 12.5px; line-height: 1.3; }
+  .thumb .badge { font-size: 10px; color: var(--muted); }
+  .thumb .dot { width: 7px; height: 7px; border-radius: 50%; margin-left: auto; flex: none; }
+
+  .stagewrap { display: flex; flex-direction: column; min-width: 0; }
+  .stage { flex: 1; display: flex; align-items: center; justify-content: center; padding: 22px;
+           background: var(--stage); position: relative; min-height: 0; }
+  .stage img { max-width: 100%; max-height: 100%; object-fit: contain; border-radius: 8px;
+               box-shadow: 0 4px 30px rgba(0,0,0,.4); background: #fff; }
+  html[data-theme="dark"] .stage img { background: #16181c; }
+  .nav-btn { position: absolute; top: 50%; transform: translateY(-50%); width: 42px; height: 42px;
+             border-radius: 50%; border: 1px solid var(--border); background: var(--panel);
+             color: var(--text); cursor: pointer; font-size: 18px; opacity: .85; }
+  .nav-btn:hover { opacity: 1; } .nav-btn.prev { left: 16px; } .nav-btn.next { right: 16px; }
+  .nav-btn:disabled { opacity: .25; cursor: default; }
+  .missing { color: var(--muted); font-size: 13px; text-align: center; }
+
+  .detail { border-top: 1px solid var(--border); background: var(--panel); padding: 14px 20px;
+            max-height: 38vh; overflow-y: auto; }
+  .detail h2 { margin: 0 0 4px; font-size: 15px; }
+  .detail .meta { color: var(--muted); font-size: 12px; margin-bottom: 10px; }
+  .notes { list-style: none; padding: 0; margin: 0; display: grid; gap: 6px; }
+  .notes li { display: flex; gap: 8px; align-items: flex-start; }
+  .sev { font-size: 10px; font-weight: 700; text-transform: uppercase; padding: 2px 7px; border-radius: 999px;
+         color: #fff; flex: none; margin-top: 1px; }
+  .sev.high { background: var(--hi); } .sev.med { background: var(--med); } .sev.low { background: var(--low); }
+  .finding .fix { color: var(--muted); font-size: 12.5px; }
+  .finding .fix b { color: var(--text); font-weight: 600; }
+
+  /* Summary tab */
+  .summary { padding: 20px 28px; overflow-y: auto; }
+  .summary h2 { font-size: 16px; margin: 22px 0 8px; }
+  .summary .empty { color: var(--muted); }
+  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 10px;
+          padding: 12px 14px; margin-bottom: 8px; box-shadow: var(--shadow); }
+  .card .head { display: flex; gap: 8px; align-items: center; }
+  .card a { color: var(--accent); text-decoration: none; cursor: pointer; }
+  .hide { display: none !important; }
+  kbd { font: 11px ui-monospace, monospace; background: var(--panel-2); border: 1px solid var(--border);
+        border-radius: 4px; padding: 1px 5px; }
+</style>
+</head>
+<body>
+<header>
+  <div>
+    <h1 id="feature-title">UI Walkthrough</h1>
+    <div class="sub" id="feature-sub"></div>
+  </div>
+  <div class="spacer"></div>
+  <div class="tabs">
+    <button class="tab active" data-tab="viewer">Walkthrough</button>
+    <button class="tab" data-tab="summary">Findings</button>
+  </div>
+  <div class="counter" id="counter"></div>
+  <label class="theme-toggle" title="Toggle light / dark for every screenshot">
+    <span class="lbl" id="lbl-light">Light</span>
+    <span class="switch"><input type="checkbox" id="theme-switch" /><span class="slider"></span></span>
+    <span class="lbl" id="lbl-dark">Dark</span>
+  </label>
+</header>
+
+<main id="viewer-pane">
+  <aside class="rail" id="rail"></aside>
+  <section class="stagewrap">
+    <div class="stage">
+      <button class="nav-btn prev" id="prev" aria-label="Previous">&#8249;</button>
+      <img id="stage-img" alt="" />
+      <div class="missing hide" id="missing"></div>
+      <button class="nav-btn next" id="next" aria-label="Next">&#8250;</button>
+    </div>
+    <div class="detail">
+      <h2 id="view-title"></h2>
+      <div class="meta" id="view-meta"></div>
+      <ul class="notes" id="view-notes"></ul>
+    </div>
+  </section>
+</main>
+
+<section class="summary hide" id="summary-pane"></section>
+
+<script id="data">
+window.__WALKTHROUGH__ = /*__DATA__*/{"feature":"No data","branch":"","generated":"","views":[],"findings":{"visual":[],"ux":[]}}/*__END__*/;
+</script>
+<script>
+(function () {
+  var D = window.__WALKTHROUGH__ || { views: [], findings: { visual: [], ux: [] } };
+  var views = D.views || [];
+  var state = { i: 0, theme: localStorage.getItem("ui-wt-theme") || "light", tab: "viewer" };
+
+  var $ = function (id) { return document.getElementById(id); };
+  function sevClass(s) { return s === "high" ? "high" : s === "med" || s === "medium" ? "med" : "low"; }
+
+  function applyChrome() {
+    document.documentElement.setAttribute("data-theme", state.theme);
+    $("theme-switch").checked = state.theme === "dark";
+    $("lbl-light").classList.toggle("on", state.theme === "light");
+    $("lbl-dark").classList.toggle("on", state.theme === "dark");
+  }
+
+  function srcFor(v) { return state.theme === "dark" ? (v.dark || v.light) : (v.light || v.dark); }
+
+  function findingsForView(id) {
+    var all = (D.findings && D.findings.visual || []).concat(D.findings && D.findings.ux || []);
+    return all.filter(function (f) { return f.view === id; });
+  }
+
+  function renderRail() {
+    var rail = $("rail");
+    rail.innerHTML = "";
+    if (!views.length) { rail.innerHTML = '<div class="group-label">No views captured</div>'; return; }
+    views.forEach(function (v, idx) {
+      var fs = findingsForView(v.id);
+      var worst = fs.some(function (f){return sevClass(f.severity)==="high";}) ? "var(--hi)"
+                : fs.some(function (f){return sevClass(f.severity)==="med";}) ? "var(--med)"
+                : fs.length ? "var(--low)" : "transparent";
+      var el = document.createElement("div");
+      el.className = "thumb" + (idx === state.i ? " active" : "");
+      el.innerHTML = '<img src="' + srcFor(v) + '" alt="" />' +
+        '<div><div class="t">' + (v.title || v.id) + '</div>' +
+        '<div class="badge">' + (v.viewport || "") + '</div></div>' +
+        '<span class="dot" style="background:' + worst + '"></span>';
+      el.onclick = function () { state.i = idx; render(); };
+      rail.appendChild(el);
+    });
+  }
+
+  function render() {
+    applyChrome();
+    if (!views.length) {
+      $("missing").classList.remove("hide"); $("stage-img").classList.add("hide");
+      $("missing").textContent = "No screenshots in this report yet.";
+      $("counter").textContent = ""; return;
+    }
+    var v = views[state.i];
+    var src = srcFor(v);
+    var img = $("stage-img");
+    if (src) {
+      img.classList.remove("hide"); $("missing").classList.add("hide");
+      img.src = src; img.alt = v.title || v.id;
+    } else {
+      img.classList.add("hide"); $("missing").classList.remove("hide");
+      $("missing").textContent = "No " + state.theme + " screenshot for this view.";
+    }
+    $("counter").textContent = (state.i + 1) + " / " + views.length;
+    $("view-title").textContent = v.title || v.id;
+    $("view-meta").textContent = [v.viewport, state.theme + " mode"].filter(Boolean).join("  ·  ");
+    var notes = $("view-notes"); notes.innerHTML = "";
+    var fs = findingsForView(v.id);
+    (v.notes || []).forEach(function (n) {
+      var li = document.createElement("li"); li.textContent = "· " + n; notes.appendChild(li);
+    });
+    fs.forEach(function (f) {
+      var li = document.createElement("li"); li.className = "finding";
+      li.innerHTML = '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
+        '<span><b>' + (f.title || "") + '</b> — ' + (f.detail || "") +
+        (f.fix ? ' <span class="fix"><b>Fix:</b> ' + f.fix + '</span>' : '') + '</span>';
+      notes.appendChild(li);
+    });
+    $("prev").disabled = state.i === 0;
+    $("next").disabled = state.i === views.length - 1;
+    renderRail();
+  }
+
+  function renderSummary() {
+    var pane = $("summary-pane");
+    function block(title, arr) {
+      var h = '<h2>' + title + ' (' + arr.length + ')</h2>';
+      if (!arr.length) return h + '<div class="empty">None found.</div>';
+      return h + arr.map(function (f) {
+        return '<div class="card"><div class="head">' +
+          '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
+          '<b>' + (f.title || "") + '</b>' +
+          (f.view ? ' <a data-jump="' + f.view + '">' + f.view + '</a>' : '') + '</div>' +
+          '<div style="margin-top:6px">' + (f.detail || "") + '</div>' +
+          (f.fix ? '<div class="finding" style="margin-top:6px"><span class="fix"><b>Fix:</b> ' + f.fix + '</span></div>' : '') +
+          '</div>';
+      }).join("");
+    }
+    pane.innerHTML = block("Visual & consistency", (D.findings && D.findings.visual) || []) +
+                     block("UX & ease of use", (D.findings && D.findings.ux) || []);
+    pane.querySelectorAll("[data-jump]").forEach(function (a) {
+      a.onclick = function () {
+        var id = a.getAttribute("data-jump");
+        var idx = views.findIndex(function (v) { return v.id === id; });
+        if (idx >= 0) { state.i = idx; setTab("viewer"); }
+      };
+    });
+  }
+
+  function setTab(t) {
+    state.tab = t;
+    document.querySelectorAll(".tab").forEach(function (b) { b.classList.toggle("active", b.dataset.tab === t); });
+    $("viewer-pane").classList.toggle("hide", t !== "viewer");
+    $("summary-pane").classList.toggle("hide", t !== "summary");
+    if (t === "viewer") $("viewer-pane").style.display = "grid";
+    if (t === "summary") renderSummary();
+  }
+
+  // wiring
+  $("feature-title").textContent = D.feature || "UI Walkthrough";
+  $("feature-sub").textContent = [D.branch, D.generated].filter(Boolean).join("  ·  ");
+  $("theme-switch").onchange = function () {
+    state.theme = this.checked ? "dark" : "light";
+    localStorage.setItem("ui-wt-theme", state.theme);
+    render();
+  };
+  $("prev").onclick = function () { if (state.i > 0) { state.i--; render(); } };
+  $("next").onclick = function () { if (state.i < views.length - 1) { state.i++; render(); } };
+  document.addEventListener("keydown", function (e) {
+    if (state.tab !== "viewer") return;
+    if (e.key === "ArrowLeft") $("prev").click();
+    if (e.key === "ArrowRight") $("next").click();
+    if (e.key.toLowerCase() === "t") $("theme-switch").click();
+  });
+  document.querySelectorAll(".tab").forEach(function (b) { b.onclick = function () { setTab(b.dataset.tab); }; });
+
+  render();
+})();
+</script>
+</body>
+</html>

From 8df49ac053dbc464b00d2dbd64774f6a69628f59 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:07:54 +0100
Subject: [PATCH 24/35] feat(portal): build portal for SaaS and self-hosted via
 file-override layer (#6900)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Ground-work so the admin portal can build for the **SaaS flavor**
alongside self-hosted, using the editor's existing **build-time
file-override** mechanism — no runtime flavor flags. This PR
demonstrates SaaS end-to-end (single-login + Usage page loading via the
inherited Supabase session) without changing self-hosted behaviour.

This is intentionally scoped as foundations, not the whole feature.

## How

**Build hook**
- `tsconfig.saas.vite.json`: `@portal/*` now cascades
(`src/saas/portal/*` → `src/portal/*`); added `@portalCore/*` for the
explicit base path.
- New `src/portal-saas/` layer (sibling of `src/portal`) holds SaaS-only
overrides, so `@app/*` resolves only editor layers and `@portal/*` only
portal layers. Self-hosted builds never import it (tree-shaken).

**Seams live in the api-client + composition layers — never in page
components**
- `saasApiBase` — base URL source (self-hosted: `VITE_SAAS_API_URL`;
SaaS reuses the single `VITE_API_BASE_URL` backend).
- `portalSaasSession` — flavor-agnostic token from the shared Supabase
client.
- `PortalAuthBoundary` — self-hosted: Spring `AuthProvider` +
`AuthGate`; SaaS: Supabase `AuthProvider` + session-only gate (inherits
the SaaS session, so no second login).

**Link concept pulled out of the Usage page (one clean cut)**
- `Usage` is now a link-free wallet renderer with generic
`onWalletLoaded` / `onReauth` callbacks; it always loads the wallet and
has zero flavor awareness.
- `PortalBillingGate` is the single flavor seam: self-hosted gates on
link (prompt when unlinked; wires the callbacks onto link/tier +
re-auth), SaaS is a passthrough that renders `Usage` directly.
- Keeps the flavor switch out of the page entirely (no per-flavor code
in `Usage`).

## Testing
Green locally and in CI (CI runs the umbrella `task
frontend:check:all`):
- `task frontend:typecheck:all` — clean across all 7 build variants
- `task frontend:test` — vitest suites pass (portal + saas cover this
change; 146 tests)
- `task frontend:build:saas` and `task frontend:build:proprietary` —
both green
- `task frontend:lint` and `task frontend:format:check` — clean

## Also in this PR (added after the initial foundations)
- **Tier from wallet + full link-layer excision on SaaS.** `TierContext`
no longer reads `LinkContext` (via a `usePlanTier` seam: self-hosted
from link state, SaaS from `wallet.status`), and the SaaS
`PortalProviders` drops `LinkProvider` / `AccountLinkProvider` /
`LinkModalHost` entirely — the link machinery is *absent* from the SaaS
bundle, not mounted-but-inert.

## Deliberately out of scope (follow-ups)
- SaaS-only read-only "connected servers" settings view.
- Shared wallet source so the SaaS tier badge and the Usage page don't
both fetch `/payg/wallet` (harmless double-fetch today).
---
 frontend/.storybook/main.ts                   |   5 +
 frontend/.storybook/preview.tsx               |   8 +-
 frontend/editor/.env.proprietary              |   7 -
 .../src/portal-saas/PortalProviders.tsx       |  20 +++
 .../src/portal-saas/api/saasApiBase.test.ts   |  21 +++
 .../editor/src/portal-saas/api/saasApiBase.ts |  13 ++
 .../auth/PortalAuthBoundary.test.tsx          |  60 ++++++++
 .../portal-saas/auth/PortalAuthBoundary.tsx   |  61 ++++++++
 .../components/LinkAccountFooterItem.test.tsx |  10 ++
 .../components/LinkAccountFooterItem.tsx      |   7 +
 .../billing/PortalBillingGate.test.tsx        |  15 ++
 .../components/billing/PortalBillingGate.tsx  |  20 +++
 .../settings/accountLinkSettings.test.ts      |   8 ++
 .../settings/accountLinkSettings.tsx          |   9 ++
 .../portal-saas/contexts/usePlanTier.test.tsx |  35 +++++
 .../src/portal-saas/contexts/usePlanTier.ts   |  14 ++
 .../contexts/usePortalLinked.test.tsx         |  16 +++
 .../portal-saas/contexts/usePortalLinked.ts   |   9 ++
 frontend/editor/src/portal/PortalApp.tsx      | 133 ++----------------
 .../editor/src/portal/PortalProviders.tsx     |  63 +++++++++
 frontend/editor/src/portal/ViewRouter.tsx     |   4 +-
 frontend/editor/src/portal/api/http.ts        |  32 ++---
 frontend/editor/src/portal/api/saasApiBase.ts |  18 +++
 .../src/portal/auth/PortalAuthBoundary.tsx    |  19 +++
 .../src/portal/auth/portalSaasSession.test.ts |  43 ++++++
 .../src/portal/auth/portalSaasSession.ts      |  19 +++
 .../src/portal/auth/saasSupabase.test.ts      |  45 ++++++
 .../editor/src/portal/auth/saasSupabase.ts    |  17 ++-
 frontend/editor/src/portal/billing/stripe.ts  |   2 +-
 .../components/LinkAccountFooterItem.tsx      |  27 ++++
 .../src/portal/components/PortalChrome.tsx    |  84 +++++++++++
 .../src/portal/components/SettingsModal.tsx   |  23 +--
 .../editor/src/portal/components/Sidebar.tsx  |  24 +---
 .../account-link/LinkAccountCard.tsx          |   2 +-
 .../account-link/LinkAccountModal.tsx         |   4 +-
 .../billing/PortalBillingGate.test.tsx        |  39 +++++
 .../components/billing/PortalBillingGate.tsx  |  32 +++++
 .../procurement/ProcurementHome.tsx           |   4 +-
 .../settings/accountLinkSettings.tsx          |  26 ++++
 .../src/portal/contexts/TierContext.tsx       |  31 ++--
 .../src/portal/contexts/usePlanTier.test.tsx  |  28 ++++
 .../editor/src/portal/contexts/usePlanTier.ts |  24 ++++
 .../portal/contexts/usePortalLinked.test.tsx  |  28 ++++
 .../src/portal/contexts/usePortalLinked.ts    |  12 ++
 frontend/editor/src/portal/tsconfig.json      |   1 -
 .../editor/src/portal/views/Usage.test.tsx    |  67 +++++++++
 frontend/editor/src/portal/views/Usage.tsx    | 100 +++++++------
 frontend/editor/src/portal/vite-env.d.ts      |   8 +-
 frontend/editor/src/saas/auth/supabase.ts     |  18 +--
 frontend/editor/src/saas/tsconfig.json        |  12 +-
 frontend/editor/tsconfig.portal.vite.json     |   7 +-
 frontend/editor/tsconfig.saas.vite.json       |   3 +-
 frontend/editor/vitest.config.ts              |   8 +-
 frontend/eslint.config.mjs                    |   3 +-
 54 files changed, 1045 insertions(+), 303 deletions(-)
 create mode 100644 frontend/editor/src/portal-saas/PortalProviders.tsx
 create mode 100644 frontend/editor/src/portal-saas/api/saasApiBase.test.ts
 create mode 100644 frontend/editor/src/portal-saas/api/saasApiBase.ts
 create mode 100644 frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/LinkAccountFooterItem.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/LinkAccountFooterItem.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/billing/PortalBillingGate.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/billing/PortalBillingGate.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/settings/accountLinkSettings.test.ts
 create mode 100644 frontend/editor/src/portal-saas/components/settings/accountLinkSettings.tsx
 create mode 100644 frontend/editor/src/portal-saas/contexts/usePlanTier.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/contexts/usePlanTier.ts
 create mode 100644 frontend/editor/src/portal-saas/contexts/usePortalLinked.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/contexts/usePortalLinked.ts
 create mode 100644 frontend/editor/src/portal/PortalProviders.tsx
 create mode 100644 frontend/editor/src/portal/api/saasApiBase.ts
 create mode 100644 frontend/editor/src/portal/auth/PortalAuthBoundary.tsx
 create mode 100644 frontend/editor/src/portal/auth/portalSaasSession.test.ts
 create mode 100644 frontend/editor/src/portal/auth/portalSaasSession.ts
 create mode 100644 frontend/editor/src/portal/auth/saasSupabase.test.ts
 create mode 100644 frontend/editor/src/portal/components/LinkAccountFooterItem.tsx
 create mode 100644 frontend/editor/src/portal/components/PortalChrome.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PortalBillingGate.test.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PortalBillingGate.tsx
 create mode 100644 frontend/editor/src/portal/components/settings/accountLinkSettings.tsx
 create mode 100644 frontend/editor/src/portal/contexts/usePlanTier.test.tsx
 create mode 100644 frontend/editor/src/portal/contexts/usePlanTier.ts
 create mode 100644 frontend/editor/src/portal/contexts/usePortalLinked.test.tsx
 create mode 100644 frontend/editor/src/portal/contexts/usePortalLinked.ts
 create mode 100644 frontend/editor/src/portal/views/Usage.test.tsx

diff --git a/frontend/.storybook/main.ts b/frontend/.storybook/main.ts
index 4d4aadc8f8..8547e9092a 100644
--- a/frontend/.storybook/main.ts
+++ b/frontend/.storybook/main.ts
@@ -61,6 +61,11 @@ const config: StorybookConfig = {
     config.define = {
       ...(config.define ?? {}),
       "import.meta.env.VITE_SAAS_API_URL": JSON.stringify("http://saas.mock"),
+      // Keep the Supabase auth env empty so ensureSaasSupabase() is a no-op and
+      // never replaces the mock SaaS client stubbed in preview.tsx.
+      "import.meta.env.VITE_SUPABASE_URL": JSON.stringify(""),
+      "import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY":
+        JSON.stringify(""),
     };
     return config;
   },
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index bab413a0e8..76463001fe 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -29,10 +29,10 @@ initialize({ onUnhandledRequest: "bypass" }, handlers);
 
 // Storybook-only: stub a SaaS session so apiClient.saas reads (invoices, payment
 // method, wallet) clear the session check and reach the MSW handlers instead of
-// failing with "No SaaS session". VITE_SAAS_SUPABASE_URL/KEY are intentionally
-// unset, so ensureSaasSupabase() is a no-op and never replaces this client; only
-// VITE_SAAS_API_URL (a mock origin MSW matches) is configured — injected via
-// .storybook/main.ts's viteFinal define, not a frontend/.env file.
+// failing with "No SaaS session". VITE_SUPABASE_URL/KEY are defined empty (see
+// .storybook/main.ts), so ensureSaasSupabase() is a no-op and never replaces this
+// client; only VITE_SAAS_API_URL (a mock origin MSW matches) is configured —
+// injected via .storybook/main.ts's viteFinal define, not a frontend/.env file.
 const saasStub = configureSupabase({
   url: "http://saas.mock",
   key: "storybook-anon-key",
diff --git a/frontend/editor/.env.proprietary b/frontend/editor/.env.proprietary
index ed5498ba3a..0ee7e66bc9 100644
--- a/frontend/editor/.env.proprietary
+++ b/frontend/editor/.env.proprietary
@@ -18,13 +18,6 @@ VITE_EDITOR_URL=/
 # backend.
 VITE_PORTAL_MOCKS=
 
-# Hosted SaaS Supabase project for the self-hosted portal's IN-APP account
-# linking (both values are public). Set per deploy; absent -> the account-link
-# UI shows a "configure" state. For local e2e, point these at the SaaS Supabase
-# project the local backend links against.
-VITE_SAAS_SUPABASE_URL=
-VITE_SAAS_SUPABASE_ANON_KEY=
-
 # Hosted SaaS Java backend base URL (e.g. https://api.stirlingpdf.com). Used for
 # ATTENDED portal -> SaaS reads (wallet, billing, plans, checkout) with the
 # admin's Supabase JWT. Distinct from the local backend (reached same-origin via
diff --git a/frontend/editor/src/portal-saas/PortalProviders.tsx b/frontend/editor/src/portal-saas/PortalProviders.tsx
new file mode 100644
index 0000000000..161b942582
--- /dev/null
+++ b/frontend/editor/src/portal-saas/PortalProviders.tsx
@@ -0,0 +1,20 @@
+import { TierProvider } from "@portal/contexts/TierContext";
+import { UIProvider } from "@portal/contexts/UIContext";
+import { PortalChrome } from "@portal/components/PortalChrome";
+
+/**
+ * SaaS provider stack. There is no account-link layer: the signed-in account IS
+ * the SaaS account (auth is handled upstream by PortalAuthBoundary) and the tier
+ * comes from the wallet (see portal-saas/contexts/usePlanTier). Dropping
+ * LinkProvider / AccountLinkProvider / the login modal here keeps the link
+ * machinery out of the SaaS bundle entirely.
+ */
+export function PortalProviders() {
+  return (
+    <TierProvider initialTier="pro">
+      <UIProvider>
+        <PortalChrome />
+      </UIProvider>
+    </TierProvider>
+  );
+}
diff --git a/frontend/editor/src/portal-saas/api/saasApiBase.test.ts b/frontend/editor/src/portal-saas/api/saasApiBase.test.ts
new file mode 100644
index 0000000000..6330ea4755
--- /dev/null
+++ b/frontend/editor/src/portal-saas/api/saasApiBase.test.ts
@@ -0,0 +1,21 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { saasApiBase } from "@portal/api/saasApiBase";
+
+describe("saasApiBase — SaaS build (one backend, VITE_API_BASE_URL)", () => {
+  afterEach(() => vi.unstubAllEnvs());
+
+  it("reuses the editor's single backend base", () => {
+    vi.stubEnv("VITE_API_BASE_URL", "http://localhost:8080");
+    expect(saasApiBase()).toBe("http://localhost:8080");
+  });
+
+  it("trims a trailing slash", () => {
+    vi.stubEnv("VITE_API_BASE_URL", "https://app.stirling.com/");
+    expect(saasApiBase()).toBe("https://app.stirling.com");
+  });
+
+  it("maps same-origin '/' to '' — a valid (non-null) base, never 'unconfigured'", () => {
+    vi.stubEnv("VITE_API_BASE_URL", "/");
+    expect(saasApiBase()).toBe("");
+  });
+});
diff --git a/frontend/editor/src/portal-saas/api/saasApiBase.ts b/frontend/editor/src/portal-saas/api/saasApiBase.ts
new file mode 100644
index 0000000000..e669dbf898
--- /dev/null
+++ b/frontend/editor/src/portal-saas/api/saasApiBase.ts
@@ -0,0 +1,13 @@
+/**
+ * SaaS build: everything is the SaaS backend, so portal→SaaS reads target the
+ * SAME base URL the editor uses ({@code VITE_API_BASE_URL}) rather than a separate
+ * {@code VITE_SAAS_API_URL}. Default {@code "/"} → same-origin (the dev proxy /
+ * deployment forwards to the SaaS backend); the Supabase JWT is the one credential.
+ *
+ * <p>Never null — same-origin is always a valid base — so {@code apiClient.saas}
+ * never enters the self-hosted "SaaS not configured" state.
+ */
+export function saasApiBase(): string {
+  const raw = import.meta.env.VITE_API_BASE_URL ?? "/";
+  return raw.replace(/\/+$/, "");
+}
diff --git a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
new file mode 100644
index 0000000000..271fbbfa50
--- /dev/null
+++ b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
@@ -0,0 +1,60 @@
+import { type ReactNode } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { allowConsole } from "@app/tests/failOnConsole";
+
+// Controllable auth state for the mocked provider.
+const authState: { session: unknown; loading: boolean } = {
+  session: null,
+  loading: false,
+};
+
+vi.mock("@app/auth", () => ({
+  // Passthrough — we drive gating via the mocked useAuth below.
+  AuthProvider: ({ children }: { children: ReactNode }) => children,
+}));
+vi.mock("@app/auth/context", () => ({ useAuth: () => authState }));
+vi.mock("@app/ui", () => ({ Spinner: () => null }));
+vi.mock("@portal/auth/saasSupabase", () => ({ ensureSaasSupabase: vi.fn() }));
+
+import { PortalAuthBoundary } from "@portal/auth/PortalAuthBoundary";
+
+describe("PortalAuthBoundary — SaaS", () => {
+  beforeEach(() => {
+    authState.session = null;
+    authState.loading = false;
+  });
+
+  it("renders the portal when a Supabase session is present (no login)", () => {
+    authState.session = { user: { id: "u1" }, access_token: "tok" };
+    render(
+      <PortalAuthBoundary>
+        <div data-testid="portal">PORTAL</div>
+      </PortalAuthBoundary>,
+    );
+    expect(screen.getByTestId("portal")).toBeInTheDocument();
+  });
+
+  it("gates (does not render the portal) when there is no session", () => {
+    authState.session = null;
+    // The gate bounces to /login; jsdom doesn't implement navigation, so absorb
+    // that incidental warning rather than fail the console guard.
+    allowConsole.error(/not implemented|navigation/i);
+    render(
+      <PortalAuthBoundary>
+        <div data-testid="portal">PORTAL</div>
+      </PortalAuthBoundary>,
+    );
+    expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
+  });
+
+  it("gates while the session is still resolving", () => {
+    authState.loading = true;
+    render(
+      <PortalAuthBoundary>
+        <div data-testid="portal">PORTAL</div>
+      </PortalAuthBoundary>,
+    );
+    expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
new file mode 100644
index 0000000000..b97d57de4e
--- /dev/null
+++ b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
@@ -0,0 +1,61 @@
+import { useEffect, type ReactNode } from "react";
+import { AuthProvider } from "@app/auth";
+import { useAuth } from "@app/auth/context";
+import { Spinner } from "@app/ui";
+import { ensureSaasSupabase } from "@portal/auth/saasSupabase";
+
+function FullScreen({ children }: { children: ReactNode }) {
+  return (
+    <div
+      style={{
+        minHeight: "100dvh",
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+      }}
+    >
+      {children}
+    </div>
+  );
+}
+
+/**
+ * SaaS gate: viewing your own usage is not admin-gated, so require only a session
+ * (not portalAccess). No session → bounce to the editor's Supabase login, which
+ * returns here signed in. This is deliberately laxer than the self-hosted
+ * RequirePortalAccess admin gate.
+ */
+function SaasPortalGate({ children }: { children: ReactNode }) {
+  const { session, loading } = useAuth();
+  useEffect(() => {
+    if (!loading && !session) {
+      window.location.href = "/login";
+    }
+  }, [loading, session]);
+  if (loading || !session) {
+    return (
+      <FullScreen>
+        <Spinner size="lg" />
+      </FullScreen>
+    );
+  }
+  return <>{children}</>;
+}
+
+/**
+ * SaaS override of the portal auth boundary: authenticate against the SaaS Supabase
+ * project (inheriting the editor's session) instead of the self-hosted Spring login.
+ */
+export function PortalAuthBoundary({ children }: { children: ReactNode }) {
+  // Configure the shared Supabase client (SaaS project) synchronously here, before
+  // the AuthProvider below reads it — a useEffect would run too late for the first
+  // render, leaving the provider with a null client. Idempotent; the portal mounts
+  // outside the editor's AppProviders but against the SAME project, so a user already
+  // signed into the editor is picked up from the persisted session (no second login).
+  ensureSaasSupabase();
+  return (
+    <AuthProvider mode="supabase">
+      <SaasPortalGate>{children}</SaasPortalGate>
+    </AuthProvider>
+  );
+}
diff --git a/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.test.tsx b/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.test.tsx
new file mode 100644
index 0000000000..6f324b4cd4
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.test.tsx
@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
+
+describe("LinkAccountFooterItem (SaaS)", () => {
+  it("renders nothing — SaaS has no account to link", () => {
+    const { container } = render(<LinkAccountFooterItem />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.tsx b/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.tsx
new file mode 100644
index 0000000000..be05e58bd6
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/LinkAccountFooterItem.tsx
@@ -0,0 +1,7 @@
+/**
+ * SaaS has no account-link concept — the signed-in account IS the SaaS account,
+ * so there is nothing to link and no footer CTA to show.
+ */
+export function LinkAccountFooterItem() {
+  return null;
+}
diff --git a/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.test.tsx b/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.test.tsx
new file mode 100644
index 0000000000..fa88c342c2
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.test.tsx
@@ -0,0 +1,15 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+vi.mock("@portal/views/Usage", () => ({
+  Usage: () => <div data-testid="usage" />,
+}));
+
+import { PortalBillingGate } from "@portal/components/billing/PortalBillingGate";
+
+describe("PortalBillingGate — SaaS", () => {
+  it("renders the Usage page directly, with no link concept", () => {
+    render(<PortalBillingGate />);
+    expect(screen.getByTestId("usage")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.tsx b/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.tsx
new file mode 100644
index 0000000000..b02c485581
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/billing/PortalBillingGate.tsx
@@ -0,0 +1,20 @@
+import { Usage } from "@portal/views/Usage";
+
+/**
+ * SaaS billing gate: there is no link concept — the signed-in account IS the SaaS
+ * account (auth is handled upstream by PortalAuthBoundary), so render the Usage
+ * page directly. No link state, no prompt.
+ *
+ * onReauth sends the user back to the editor's Supabase login if the session
+ * lapses mid-view: PortalAuthBoundary only re-gates on mount / session change, so
+ * without this a "Session expired" notice would dead-end until a manual reload.
+ */
+export function PortalBillingGate() {
+  return (
+    <Usage
+      onReauth={() => {
+        window.location.href = "/login";
+      }}
+    />
+  );
+}
diff --git a/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.test.ts b/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.test.ts
new file mode 100644
index 0000000000..5cc64727a1
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.test.ts
@@ -0,0 +1,8 @@
+import { describe, expect, it } from "vitest";
+import { accountLinkSettings } from "@portal/components/settings/accountLinkSettings";
+
+describe("accountLinkSettings (SaaS)", () => {
+  it("is null — Settings has no account-link section on SaaS", () => {
+    expect(accountLinkSettings).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.tsx b/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.tsx
new file mode 100644
index 0000000000..6fc0af735b
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/settings/accountLinkSettings.tsx
@@ -0,0 +1,9 @@
+import type { AccountLinkSettingsSeam } from "@portal-proprietary/components/settings/accountLinkSettings";
+
+/**
+ * SaaS has no account-link concept — the signed-in account IS the SaaS account.
+ * Null drops the "Account link" nav item and its panel from Settings (the shared
+ * SettingsModal treats the seam as optional), so the link-only AccountLinkPanel
+ * is never imported into the SaaS bundle.
+ */
+export const accountLinkSettings: AccountLinkSettingsSeam | null = null;
diff --git a/frontend/editor/src/portal-saas/contexts/usePlanTier.test.tsx b/frontend/editor/src/portal-saas/contexts/usePlanTier.test.tsx
new file mode 100644
index 0000000000..d2a9666bff
--- /dev/null
+++ b/frontend/editor/src/portal-saas/contexts/usePlanTier.test.tsx
@@ -0,0 +1,35 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { render, waitFor } from "@testing-library/react";
+
+const fetchWallet = vi.fn();
+vi.mock("@portal/api/billing", () => ({
+  fetchWallet: () => fetchWallet(),
+}));
+
+// Resolves to the SaaS override (src/portal-saas/contexts) via the @portal cascade.
+import { usePlanTier } from "@portal/contexts/usePlanTier";
+
+function Probe() {
+  return <span data-testid="tier">{usePlanTier()}</span>;
+}
+
+describe("usePlanTier (SaaS) — tier from wallet", () => {
+  beforeEach(() => {
+    fetchWallet.mockReset();
+  });
+
+  it("subscribed wallet → pro", async () => {
+    fetchWallet.mockResolvedValue({ status: "subscribed" });
+    const { getByTestId } = render(<Probe />);
+    await waitFor(() => expect(getByTestId("tier").textContent).toBe("pro"));
+  });
+
+  it("free wallet → free (also the loading default)", async () => {
+    fetchWallet.mockResolvedValue({ status: "free" });
+    const { getByTestId } = render(<Probe />);
+    // Free before the fetch resolves and after — it never flips to pro.
+    expect(getByTestId("tier").textContent).toBe("free");
+    await waitFor(() => expect(fetchWallet).toHaveBeenCalledTimes(1));
+    expect(getByTestId("tier").textContent).toBe("free");
+  });
+});
diff --git a/frontend/editor/src/portal-saas/contexts/usePlanTier.ts b/frontend/editor/src/portal-saas/contexts/usePlanTier.ts
new file mode 100644
index 0000000000..6b877c3640
--- /dev/null
+++ b/frontend/editor/src/portal-saas/contexts/usePlanTier.ts
@@ -0,0 +1,14 @@
+import { useAsync } from "@portal/hooks/useAsync";
+import { fetchWallet } from "@portal/api/billing";
+import type { Tier } from "@portal/contexts/TierContext";
+
+/**
+ * The plan tier the portal runs on, SaaS flavor: the signed-in account IS the
+ * SaaS account, so the tier comes straight from the wallet — no link concept.
+ * `subscribed` → the metered Processor tier; anything else (including while the
+ * wallet is still loading) → free. Enterprise stays a mocks-only tier.
+ */
+export function usePlanTier(): Tier {
+  const { data: wallet } = useAsync(() => fetchWallet(), []);
+  return wallet?.status === "subscribed" ? "pro" : "free";
+}
diff --git a/frontend/editor/src/portal-saas/contexts/usePortalLinked.test.tsx b/frontend/editor/src/portal-saas/contexts/usePortalLinked.test.tsx
new file mode 100644
index 0000000000..1368b27a4b
--- /dev/null
+++ b/frontend/editor/src/portal-saas/contexts/usePortalLinked.test.tsx
@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+// Resolves to the SaaS override (src/portal-saas/contexts) via the @portal cascade.
+import { usePortalLinked } from "@portal/contexts/usePortalLinked";
+
+function Probe() {
+  return <span data-testid="linked">{String(usePortalLinked())}</span>;
+}
+
+describe("usePortalLinked (SaaS)", () => {
+  it("is always true — no account-link step, no LinkProvider needed", () => {
+    // Renders with no LinkProvider in the tree: the SaaS override must not read it.
+    const { getByTestId } = render(<Probe />);
+    expect(getByTestId("linked").textContent).toBe("true");
+  });
+});
diff --git a/frontend/editor/src/portal-saas/contexts/usePortalLinked.ts b/frontend/editor/src/portal-saas/contexts/usePortalLinked.ts
new file mode 100644
index 0000000000..4a5355f1d9
--- /dev/null
+++ b/frontend/editor/src/portal-saas/contexts/usePortalLinked.ts
@@ -0,0 +1,9 @@
+/**
+ * SaaS flavor: the signed-in account IS the SaaS account, so the portal is always
+ * authorized — there is no account-link step. Procurement/checkout treats this as
+ * "linked" and proceeds straight to the flow. No LinkContext dependency, so the
+ * link machinery stays out of the SaaS bundle.
+ */
+export function usePortalLinked(): boolean {
+  return true;
+}
diff --git a/frontend/editor/src/portal/PortalApp.tsx b/frontend/editor/src/portal/PortalApp.tsx
index 629a8ac57a..d14892363e 100644
--- a/frontend/editor/src/portal/PortalApp.tsx
+++ b/frontend/editor/src/portal/PortalApp.tsx
@@ -1,25 +1,8 @@
-import { useEffect, type ReactNode } from "react";
-import { useLocation } from "react-router-dom";
-import { AuthProvider } from "@app/auth";
-import { ErrorBoundary } from "@portal/components/ErrorBoundary";
+import { type ReactNode } from "react";
+import { PortalAuthBoundary } from "@portal/auth/PortalAuthBoundary";
 import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
-import { TierProvider } from "@portal/contexts/TierContext";
-import { LinkProvider, useLink } from "@portal/contexts/LinkContext";
-import type { SupabaseLoginSession } from "@app/auth/ui/useSupabaseLogin";
-import { UIProvider, useUI } from "@portal/contexts/UIContext";
 import { SuiProvider } from "@portal/theme/SuiProvider";
-import { AppShell } from "@portal/components/AppShell";
-import { AuthGate } from "@portal/components/AuthGate";
-import { AssistantButton } from "@portal/components/AssistantButton";
-import { AssistantPanel } from "@portal/components/AssistantPanel";
-import { SearchModal } from "@portal/components/SearchModal";
-import { SettingsModal } from "@portal/components/SettingsModal";
-import { LinkAccountModal } from "@portal/components/account-link/LinkAccountModal";
-import {
-  AccountLinkProvider,
-  useAccountLinkContext,
-} from "@portal/contexts/AccountLinkContext";
-import { ViewRouter } from "@portal/ViewRouter";
+import { PortalProviders } from "@portal/PortalProviders";
 // Reset + typography, scoped to .portal-scope below.
 import "@portal/theme/base.css";
 
@@ -33,93 +16,15 @@ function ThemedSuiProvider({ children }: { children: ReactNode }) {
   return <SuiProvider colorScheme={theme}>{children}</SuiProvider>;
 }
 
-/**
- * Global keyboard shortcuts. Lives below the UIProvider so it can dispatch
- * into the overlay state. Currently just ⌘K / Ctrl+K to toggle the search
- * palette.
- */
-function GlobalShortcuts() {
-  const { toggleSearch, closeSearch } = useUI();
-
-  useEffect(() => {
-    function onKey(e: KeyboardEvent) {
-      const isCmdK = (e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "k";
-      if (isCmdK) {
-        e.preventDefault();
-        toggleSearch();
-        return;
-      }
-      if (e.key === "Escape") {
-        closeSearch();
-      }
-    }
-    document.addEventListener("keydown", onKey);
-    return () => document.removeEventListener("keydown", onKey);
-  }, [toggleSearch, closeSearch]);
-
-  return null;
-}
-
-/** Bridges the Settings modal's open/close props to UIContext state. */
-function SettingsHost() {
-  const { settingsOpen, settingsInitialSection, closeSettings } = useUI();
-  return (
-    <SettingsModal
-      open={settingsOpen}
-      onClose={closeSettings}
-      initialSection={settingsInitialSection}
-    />
-  );
-}
-
-/**
- * The one and only account-link login modal. Mounted at the app root (never
- * nested in another overlay) and driven by UIContext, so any "Link account" CTA
- * — sidebar, billing prompt, feature gate, Settings panel — opens this exact
- * instance. Linking is finished by the shared {@link useAccountLinkContext}
- * orchestration.
- */
-function LinkModalHost() {
-  const { linkModalOpen, linkModalMode, closeLinkModal } = useUI();
-  const { markSaasSessionChanged } = useLink();
-  const link = useAccountLinkContext();
-  // "reauth" only refreshes the browser SaaS session for attended reads — the
-  // sign-in already applied it to the Supabase client, so we just signal a
-  // refetch. It must NOT call completeLink (that re-registers → duplicate row).
-  const onLinked =
-    linkModalMode === "reauth"
-      ? () => markSaasSessionChanged()
-      : (session: SupabaseLoginSession) => link.completeLink(session);
-  return (
-    <LinkAccountModal
-      open={linkModalOpen}
-      mode={linkModalMode}
-      onClose={closeLinkModal}
-      onLinked={onLinked}
-    />
-  );
-}
-
-/**
- * The routed view, wrapped in an error boundary so a single view crashing can't
- * white-screen the portal (the shell + nav stay alive). Keyed by route so
- * navigating to another section clears any error from the previous one.
- */
-function RoutedContent() {
-  const { pathname } = useLocation();
-  return (
-    <ErrorBoundary key={pathname}>
-      <ViewRouter />
-    </ErrorBoundary>
-  );
-}
-
 /**
  * The portal, mounted as a route-set under /portal/* inside the editor app (via
  * the admin-route seam). It supplies its own providers and its own i18next
  * instance (the `portal` namespace), but NOT a router — the editor's
  * <BrowserRouter> is the one and only router; the portal's routes are relative
  * to the /portal mount (see ViewRouter).
+ *
+ * The provider stack itself is a per-flavor seam (see {@link PortalProviders}):
+ * self-hosted mounts the account-link layer, SaaS does not.
  */
 export function PortalApp() {
   return (
@@ -127,29 +32,9 @@ export function PortalApp() {
       <ThemedSuiProvider>
         {/* Scopes base.css to the portal so it doesn't restyle the host editor. */}
         <div className="portal-scope">
-          <AuthProvider mode="spring">
-            <LinkProvider initialState="unlinked">
-              {/* TierProvider sits INSIDE LinkProvider so it can derive the tier
-                from the real link/subscription state when MSW mocks are off. */}
-              <TierProvider initialTier="pro">
-                <UIProvider>
-                  <GlobalShortcuts />
-                  <AuthGate>
-                    <AccountLinkProvider>
-                      <AppShell>
-                        <RoutedContent />
-                      </AppShell>
-                      <AssistantButton />
-                      <AssistantPanel />
-                      <SearchModal />
-                      <SettingsHost />
-                      <LinkModalHost />
-                    </AccountLinkProvider>
-                  </AuthGate>
-                </UIProvider>
-              </TierProvider>
-            </LinkProvider>
-          </AuthProvider>
+          <PortalAuthBoundary>
+            <PortalProviders />
+          </PortalAuthBoundary>
         </div>
       </ThemedSuiProvider>
     </ThemeProvider>
diff --git a/frontend/editor/src/portal/PortalProviders.tsx b/frontend/editor/src/portal/PortalProviders.tsx
new file mode 100644
index 0000000000..f03092fde8
--- /dev/null
+++ b/frontend/editor/src/portal/PortalProviders.tsx
@@ -0,0 +1,63 @@
+import { TierProvider } from "@portal/contexts/TierContext";
+import { LinkProvider, useLink } from "@portal/contexts/LinkContext";
+import { UIProvider, useUI } from "@portal/contexts/UIContext";
+import type { SupabaseLoginSession } from "@app/auth/ui/useSupabaseLogin";
+import { LinkAccountModal } from "@portal/components/account-link/LinkAccountModal";
+import {
+  AccountLinkProvider,
+  useAccountLinkContext,
+} from "@portal/contexts/AccountLinkContext";
+import { PortalChrome } from "@portal/components/PortalChrome";
+
+/**
+ * The one and only account-link login modal. Mounted at the app root (never
+ * nested in another overlay) and driven by UIContext, so any "Link account" CTA
+ * — sidebar, billing prompt, feature gate, Settings panel — opens this exact
+ * instance. Linking is finished by the shared {@link useAccountLinkContext}
+ * orchestration.
+ */
+function LinkModalHost() {
+  const { linkModalOpen, linkModalMode, closeLinkModal } = useUI();
+  const { markSaasSessionChanged } = useLink();
+  const link = useAccountLinkContext();
+  // "reauth" only refreshes the browser SaaS session for attended reads — the
+  // sign-in already applied it to the Supabase client, so we just signal a
+  // refetch. It must NOT call completeLink (that re-registers → duplicate row).
+  const onLinked =
+    linkModalMode === "reauth"
+      ? () => markSaasSessionChanged()
+      : (session: SupabaseLoginSession) => link.completeLink(session);
+  return (
+    <LinkAccountModal
+      open={linkModalOpen}
+      mode={linkModalMode}
+      onClose={closeLinkModal}
+      onLinked={onLinked}
+    />
+  );
+}
+
+/**
+ * Self-hosted provider stack. The account-link layer (LinkProvider +
+ * AccountLinkProvider + the login modal) wraps the shared chrome; the tier is
+ * derived from the link/subscription state (see usePlanTier). TierProvider sits
+ * inside LinkProvider because the self-hosted usePlanTier reads useLink.
+ *
+ * The SaaS build shadows this file to drop the account-link layer entirely — the
+ * signed-in account IS the SaaS account, so there is nothing to link and the
+ * tier comes from the wallet.
+ */
+export function PortalProviders() {
+  return (
+    <LinkProvider initialState="unlinked">
+      <TierProvider initialTier="pro">
+        <UIProvider>
+          <AccountLinkProvider>
+            <PortalChrome />
+            <LinkModalHost />
+          </AccountLinkProvider>
+        </UIProvider>
+      </TierProvider>
+    </LinkProvider>
+  );
+}
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 2b09a24507..62502e6c67 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -9,7 +9,7 @@ import { Policies } from "@portal/views/Policies";
 import { Components } from "@portal/views/Components";
 import { EditorAdmin } from "@portal/views/EditorAdmin";
 import { Infrastructure } from "@portal/views/Infrastructure";
-import { Usage } from "@portal/views/Usage";
+import { PortalBillingGate } from "@portal/components/billing/PortalBillingGate";
 import { DeveloperDocs } from "@portal/views/DeveloperDocs";
 import { Procurement } from "@portal/views/Procurement";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
@@ -39,7 +39,7 @@ export function ViewRouter() {
         path={rel(VIEW_PATHS.infrastructure)}
         element={<Infrastructure />}
       />
-      <Route path={rel(VIEW_PATHS.usage)} element={<Usage />} />
+      <Route path={rel(VIEW_PATHS.usage)} element={<PortalBillingGate />} />
       <Route path={rel(VIEW_PATHS.procurement)} element={<Procurement />} />
       <Route path={rel(VIEW_PATHS.docs)} element={<DeveloperDocs />} />
       {/* Account-link is now a Settings panel; redirect legacy bookmarks home. */}
diff --git a/frontend/editor/src/portal/api/http.ts b/frontend/editor/src/portal/api/http.ts
index 9f7b28da03..2dfa914890 100644
--- a/frontend/editor/src/portal/api/http.ts
+++ b/frontend/editor/src/portal/api/http.ts
@@ -40,14 +40,17 @@
  * admin and uses the Supabase JWT for SaaS reads. Don't add it here.
  */
 import { clearStoredToken, getStoredToken } from "@app/auth";
-import { getSupabaseClient } from "@app/auth/supabase/supabaseClient";
-import { ensureSaasSupabase } from "@portal/auth/saasSupabase";
+import { getPortalSaasToken } from "@portal/auth/portalSaasSession";
+import { saasApiBase } from "@portal/api/saasApiBase";
 
-/** Read the SaaS base URL at call time so tests can stub it via vi.stubEnv. */
+/**
+ * SaaS base URL via the flavor seam: self-hosted reads VITE_SAAS_API_URL (a
+ * separate cloud backend); the SaaS build reuses the editor's single
+ * VITE_API_BASE_URL (in SaaS everything is the SaaS backend). {@code null} means
+ * not configured — a self-hosted-only state; the SaaS seam never returns null.
+ */
 function saasBaseUrl(): string | null {
-  const raw = import.meta.env.VITE_SAAS_API_URL;
-  if (!raw) return null;
-  return raw.replace(/\/+$/, "");
+  return saasApiBase();
 }
 
 export interface HttpRequestOptions {
@@ -169,21 +172,14 @@ async function localJson<T>(
 // saas — hosted SaaS Java, admin's Supabase JWT
 // ────────────────────────────────────────────────────────────────────────────
 
-async function getSaasAccessToken(): Promise<string | null> {
-  ensureSaasSupabase();
-  const supabase = getSupabaseClient();
-  if (!supabase) return null;
-  const { data } = await supabase.auth.getSession();
-  return data.session?.access_token ?? null;
-}
-
 async function saasJson<T>(
   path: string,
   options: HttpRequestOptions = {},
 ): Promise<T> {
   const base = saasBaseUrl();
-  if (!base) throw new SaasUnconfiguredError();
-  const token = await getSaasAccessToken();
+  // null = unset (self-hosted, no VITE_SAAS_API_URL). "" is same-origin (SaaS) — valid.
+  if (base === null) throw new SaasUnconfiguredError();
+  const token = await getPortalSaasToken();
   if (!token) throw new SaasNotLinkedError();
   const res = await fetch(`${base}${path}`, {
     method: options.method ?? "GET",
@@ -213,7 +209,7 @@ export const apiClient = {
   /** Hosted SaaS Java. Admin's Supabase JWT auto-attached. */
   saas: {
     json: saasJson,
-    /** True when VITE_SAAS_API_URL is set. Doesn't check session liveness. */
-    isConfigured: (): boolean => Boolean(saasBaseUrl()),
+    /** True when a SaaS base URL is resolvable. Doesn't check session liveness. */
+    isConfigured: (): boolean => saasBaseUrl() !== null,
   },
 } as const;
diff --git a/frontend/editor/src/portal/api/saasApiBase.ts b/frontend/editor/src/portal/api/saasApiBase.ts
new file mode 100644
index 0000000000..3514ac3c79
--- /dev/null
+++ b/frontend/editor/src/portal/api/saasApiBase.ts
@@ -0,0 +1,18 @@
+/**
+ * Base URL for attended portal→SaaS reads ({@code apiClient.saas}) — the seam the
+ * SaaS build overrides.
+ *
+ * <p>Self-hosted (this base): the SaaS cloud is a <em>separate</em> backend from
+ * this instance's local one, configured via {@code VITE_SAAS_API_URL}. Returns
+ * {@code null} when unset so {@code apiClient.saas} can surface a clear
+ * "configure" state. A set value has any trailing slash trimmed.
+ *
+ * <p>The SaaS build shadows this to reuse the editor's single backend
+ * ({@code VITE_API_BASE_URL}) — in SaaS everything is the SaaS backend, so there
+ * is no separate SaaS URL.
+ */
+export function saasApiBase(): string | null {
+  const raw = import.meta.env.VITE_SAAS_API_URL;
+  if (!raw) return null;
+  return raw.replace(/\/+$/, "");
+}
diff --git a/frontend/editor/src/portal/auth/PortalAuthBoundary.tsx b/frontend/editor/src/portal/auth/PortalAuthBoundary.tsx
new file mode 100644
index 0000000000..df24718eda
--- /dev/null
+++ b/frontend/editor/src/portal/auth/PortalAuthBoundary.tsx
@@ -0,0 +1,19 @@
+import { type ReactNode } from "react";
+import { AuthProvider } from "@app/auth";
+import { AuthGate } from "@portal/components/AuthGate";
+
+/**
+ * Portal auth wiring — the seam the SaaS build overrides.
+ *
+ * <p>Self-hosted (this base): the portal is its own standalone app, so it owns a
+ * Spring {@link AuthProvider} and a Spring login gate ({@link AuthGate}). The SaaS
+ * build shadows this file to authenticate against the SaaS Supabase project (the
+ * same session the editor uses) with no Spring login and no account-link step.
+ */
+export function PortalAuthBoundary({ children }: { children: ReactNode }) {
+  return (
+    <AuthProvider mode="spring">
+      <AuthGate>{children}</AuthGate>
+    </AuthProvider>
+  );
+}
diff --git a/frontend/editor/src/portal/auth/portalSaasSession.test.ts b/frontend/editor/src/portal/auth/portalSaasSession.test.ts
new file mode 100644
index 0000000000..1b12358b38
--- /dev/null
+++ b/frontend/editor/src/portal/auth/portalSaasSession.test.ts
@@ -0,0 +1,43 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// Hoisted so the vi.mock factories can reference it before the import runs.
+const { state } = vi.hoisted(() => ({
+  state: { client: null as { auth: { getSession: () => unknown } } | null },
+}));
+
+vi.mock("@app/auth/supabase/supabaseClient", () => ({
+  getSupabaseClient: () => state.client,
+}));
+vi.mock("@portal/auth/saasSupabase", () => ({
+  ensureSaasSupabase: vi.fn(),
+}));
+
+import { getPortalSaasToken } from "@portal/auth/portalSaasSession";
+
+describe("getPortalSaasToken — self-hosted (account-link login)", () => {
+  beforeEach(() => {
+    state.client = null;
+  });
+
+  it("returns null when the SaaS client isn't configured (not signed in)", async () => {
+    expect(await getPortalSaasToken()).toBeNull();
+  });
+
+  it("returns the access token from the current session", async () => {
+    state.client = {
+      auth: {
+        getSession: async () => ({
+          data: { session: { access_token: "tok-123" } },
+        }),
+      },
+    };
+    expect(await getPortalSaasToken()).toBe("tok-123");
+  });
+
+  it("returns null when there is a client but no active session", async () => {
+    state.client = {
+      auth: { getSession: async () => ({ data: { session: null } }) },
+    };
+    expect(await getPortalSaasToken()).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/portal/auth/portalSaasSession.ts b/frontend/editor/src/portal/auth/portalSaasSession.ts
new file mode 100644
index 0000000000..eb75cc7650
--- /dev/null
+++ b/frontend/editor/src/portal/auth/portalSaasSession.ts
@@ -0,0 +1,19 @@
+import { getSupabaseClient } from "@app/auth/supabase/supabaseClient";
+import { ensureSaasSupabase } from "@portal/auth/saasSupabase";
+
+/**
+ * SaaS access token for attended portal→SaaS reads. Reads the shared Supabase
+ * client, which {@link ensureSaasSupabase} configures against the one Stirling
+ * Supabase project (VITE_SUPABASE_*) both flavors talk to: self-hosted mints a
+ * SaaS JWT in-app for account-linking (alongside its own Spring session); SaaS is
+ * already signed into that same project, so the editor session is inherited.
+ * Flavor-agnostic — no per-flavor override needed. Returns null until a session
+ * exists.
+ */
+export async function getPortalSaasToken(): Promise<string | null> {
+  ensureSaasSupabase();
+  const supabase = getSupabaseClient();
+  if (!supabase) return null;
+  const { data } = await supabase.auth.getSession();
+  return data.session?.access_token ?? null;
+}
diff --git a/frontend/editor/src/portal/auth/saasSupabase.test.ts b/frontend/editor/src/portal/auth/saasSupabase.test.ts
new file mode 100644
index 0000000000..b748cdd150
--- /dev/null
+++ b/frontend/editor/src/portal/auth/saasSupabase.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// Mock only the low-level client factory — NOT ensureSaasSupabase itself — so this
+// exercises the real configurator and proves it wires the shared client from the
+// one Stirling Supabase env (VITE_SUPABASE_*), shared by every flavor.
+const configureSupabase = vi.fn();
+const getSupabaseClient = vi.fn(() => ({ __client: true }));
+vi.mock("@app/auth/supabase/supabaseClient", () => ({
+  configureSupabase,
+  getSupabaseClient,
+}));
+
+describe("ensureSaasSupabase — configures the shared client from VITE_SUPABASE_*", () => {
+  afterEach(() => {
+    vi.resetModules();
+    vi.unstubAllEnvs();
+    configureSupabase.mockClear();
+    getSupabaseClient.mockClear();
+  });
+
+  it("configures from VITE_SUPABASE_* and returns the client", async () => {
+    vi.stubEnv("VITE_SUPABASE_URL", "https://proj.supabase.co");
+    vi.stubEnv("VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY", "anon-key");
+    // Dynamic import so the module reads the stubbed env at load.
+    const { ensureSaasSupabase, isSaasSupabaseConfigured } =
+      await import("@portal/auth/saasSupabase");
+    expect(isSaasSupabaseConfigured).toBe(true);
+    const client = ensureSaasSupabase();
+    expect(configureSupabase).toHaveBeenCalledWith({
+      url: "https://proj.supabase.co",
+      key: "anon-key",
+    });
+    expect(client).not.toBeNull();
+  });
+
+  it("stays unconfigured (client null) when the Supabase env is absent", async () => {
+    vi.stubEnv("VITE_SUPABASE_URL", "");
+    vi.stubEnv("VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY", "");
+    const { ensureSaasSupabase, isSaasSupabaseConfigured } =
+      await import("@portal/auth/saasSupabase");
+    expect(isSaasSupabaseConfigured).toBe(false);
+    expect(ensureSaasSupabase()).toBeNull();
+    expect(configureSupabase).not.toHaveBeenCalled();
+  });
+});
diff --git a/frontend/editor/src/portal/auth/saasSupabase.ts b/frontend/editor/src/portal/auth/saasSupabase.ts
index 813a2f7cad..ff3ad71b8b 100644
--- a/frontend/editor/src/portal/auth/saasSupabase.ts
+++ b/frontend/editor/src/portal/auth/saasSupabase.ts
@@ -4,18 +4,21 @@ import {
 } from "@app/auth/supabase/supabaseClient";
 
 /**
- * Configures the shared Supabase client against the hosted SaaS project so the
- * portal can mint a SaaS JWT IN-APP for account linking (no popup). This is a
+ * Configures the shared Supabase client against the Stirling Supabase project so
+ * the portal can mint a SaaS JWT IN-APP for account linking (no popup). This is a
  * separate, transient SaaS auth — the portal's own session stays Spring (the
  * local instance admin); calls to the local backend still carry the Spring
  * bearer, and the SaaS JWT is passed only in the link request body.
  *
- * Config: VITE_SAAS_SUPABASE_URL + VITE_SAAS_SUPABASE_ANON_KEY (both public).
- * Absent → {@link isSaasSupabaseConfigured} is false and the link UI degrades to
- * a "configure the SaaS Supabase URL" state.
+ * Config: VITE_SUPABASE_URL + VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY (both public)
+ * — the one Stirling Supabase project every flavor talks to (same vars the editor
+ * and proprietary billing client use; there is no separate SaaS project). SaaS
+ * needs no per-flavor override: the signed-in editor session is on this same
+ * project, so the client picks it up. Absent → {@link isSaasSupabaseConfigured}
+ * is false and the link UI degrades to a "configure Supabase" state.
  */
-const url = import.meta.env.VITE_SAAS_SUPABASE_URL;
-const key = import.meta.env.VITE_SAAS_SUPABASE_ANON_KEY;
+const url = import.meta.env.VITE_SUPABASE_URL;
+const key = import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY;
 
 export const isSaasSupabaseConfigured = Boolean(url && key);
 
diff --git a/frontend/editor/src/portal/billing/stripe.ts b/frontend/editor/src/portal/billing/stripe.ts
index 91e0290d72..930ed3fef3 100644
--- a/frontend/editor/src/portal/billing/stripe.ts
+++ b/frontend/editor/src/portal/billing/stripe.ts
@@ -71,7 +71,7 @@ async function invoke<T>(
   const supabase = getSupabaseClient();
   if (!supabase) {
     throw new StripeFunctionError(
-      "SaaS Supabase not configured — set VITE_SAAS_SUPABASE_URL.",
+      "SaaS Supabase not configured — set VITE_SUPABASE_URL.",
       "unconfigured",
     );
   }
diff --git a/frontend/editor/src/portal/components/LinkAccountFooterItem.tsx b/frontend/editor/src/portal/components/LinkAccountFooterItem.tsx
new file mode 100644
index 0000000000..fd3e9d96a0
--- /dev/null
+++ b/frontend/editor/src/portal/components/LinkAccountFooterItem.tsx
@@ -0,0 +1,27 @@
+import { useTranslation } from "react-i18next";
+import { NavItem } from "@app/ui";
+import { useUI } from "@portal/contexts/UIContext";
+import { useLink } from "@portal/contexts/LinkContext";
+import { LinkIcon } from "@portal/components/icons";
+
+/**
+ * Sidebar-footer link-account CTA. Only visible when the org is unlinked — once
+ * linked, the linked-instances row + plan badge already communicate the state,
+ * so a permanent footer button would be noise. Click → opens the login modal
+ * directly. The SaaS build shadows this file with a no-op: the signed-in account
+ * IS the SaaS account, so there is nothing to link.
+ */
+export function LinkAccountFooterItem() {
+  const { t } = useTranslation();
+  const { openLinkModal } = useUI();
+  const { linkState } = useLink();
+  if (linkState !== "unlinked") return null;
+  return (
+    <NavItem
+      id="account-link"
+      label={t("portal.shell.sidebar.linkAccount", "Link Stirling account")}
+      icon={<LinkIcon />}
+      onClick={() => openLinkModal()}
+    />
+  );
+}
diff --git a/frontend/editor/src/portal/components/PortalChrome.tsx b/frontend/editor/src/portal/components/PortalChrome.tsx
new file mode 100644
index 0000000000..9e2ed8d359
--- /dev/null
+++ b/frontend/editor/src/portal/components/PortalChrome.tsx
@@ -0,0 +1,84 @@
+import { useEffect } from "react";
+import { useLocation } from "react-router-dom";
+import { ErrorBoundary } from "@portal/components/ErrorBoundary";
+import { useUI } from "@portal/contexts/UIContext";
+import { AppShell } from "@portal/components/AppShell";
+import { AssistantButton } from "@portal/components/AssistantButton";
+import { AssistantPanel } from "@portal/components/AssistantPanel";
+import { SearchModal } from "@portal/components/SearchModal";
+import { SettingsModal } from "@portal/components/SettingsModal";
+import { ViewRouter } from "@portal/ViewRouter";
+
+/**
+ * Global keyboard shortcuts. Lives below the UIProvider so it can dispatch into
+ * the overlay state. Currently just ⌘K / Ctrl+K to toggle the search palette.
+ */
+function GlobalShortcuts() {
+  const { toggleSearch, closeSearch } = useUI();
+
+  useEffect(() => {
+    function onKey(e: KeyboardEvent) {
+      const isCmdK = (e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "k";
+      if (isCmdK) {
+        e.preventDefault();
+        toggleSearch();
+        return;
+      }
+      if (e.key === "Escape") {
+        closeSearch();
+      }
+    }
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [toggleSearch, closeSearch]);
+
+  return null;
+}
+
+/** Bridges the Settings modal's open/close props to UIContext state. */
+function SettingsHost() {
+  const { settingsOpen, settingsInitialSection, closeSettings } = useUI();
+  return (
+    <SettingsModal
+      open={settingsOpen}
+      onClose={closeSettings}
+      initialSection={settingsInitialSection}
+    />
+  );
+}
+
+/**
+ * The routed view, wrapped in an error boundary so a single view crashing can't
+ * white-screen the portal (the shell + nav stay alive). Keyed by route so
+ * navigating to another section clears any error from the previous one.
+ */
+function RoutedContent() {
+  const { pathname } = useLocation();
+  return (
+    <ErrorBoundary key={pathname}>
+      <ViewRouter />
+    </ErrorBoundary>
+  );
+}
+
+/**
+ * The flavor-agnostic portal chrome: the shell (sidebar + header + routed view)
+ * plus the global overlays that every flavor shares. Requires only the Tier and
+ * UI contexts above it — both flavors provide those. Flavor-specific overlays
+ * (e.g. the self-hosted account-link modal) are mounted by PortalProviders, not
+ * here.
+ */
+export function PortalChrome() {
+  return (
+    <>
+      <GlobalShortcuts />
+      <AppShell>
+        <RoutedContent />
+      </AppShell>
+      <AssistantButton />
+      <AssistantPanel />
+      <SearchModal />
+      <SettingsHost />
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/SettingsModal.tsx b/frontend/editor/src/portal/components/SettingsModal.tsx
index 3073d243f0..eb2380a9a9 100644
--- a/frontend/editor/src/portal/components/SettingsModal.tsx
+++ b/frontend/editor/src/portal/components/SettingsModal.tsx
@@ -31,9 +31,8 @@ import {
   PoliciesIcon,
   InfrastructureIcon,
   SparklesIcon,
-  LinkIcon,
 } from "@portal/components/icons";
-import { AccountLinkPanel } from "@portal/components/account-link/AccountLinkPanel";
+import { accountLinkSettings } from "@portal/components/settings/accountLinkSettings";
 import "@portal/components/SettingsModal.css";
 
 type SettingsSection =
@@ -150,11 +149,17 @@ export function SettingsModal({
       {
         title: t("portal.settings.groups.admin"),
         items: [
-          {
-            key: "account-link",
-            label: t("portal.settings.sections.account-link"),
-            icon: <LinkIcon size={16} />,
-          },
+          // Account-link is a self-hosted-only section; the SaaS build shadows
+          // the seam to null, dropping the item entirely.
+          ...(accountLinkSettings
+            ? [
+                {
+                  key: accountLinkSettings.navKey,
+                  label: t(accountLinkSettings.labelKey),
+                  icon: accountLinkSettings.icon,
+                },
+              ]
+            : []),
           {
             key: "authentication",
             label: t("portal.settings.sections.authentication"),
@@ -337,7 +342,9 @@ export function SettingsModal({
           />
         )}
 
-        {section === "account-link" && <AccountLinkPanel />}
+        {section === "account-link" && accountLinkSettings && (
+          <accountLinkSettings.Body />
+        )}
       </SettingsShell>
     </Modal>
   );
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 675e48561f..486611248b 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -4,7 +4,7 @@ import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { useTier } from "@portal/contexts/TierContext";
 import { useTheme } from "@portal/contexts/ThemeContext";
 import { useUI } from "@portal/contexts/UIContext";
-import { useLink } from "@portal/contexts/LinkContext";
+import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
 import { useAsync } from "@portal/hooks/useAsync";
 import { fetchHomeKpis, type KpiEntry } from "@portal/api/home";
 import { EDITOR_URL } from "@portal/auth/editorUrl";
@@ -20,7 +20,6 @@ import {
   ComponentsIcon,
   InfrastructureIcon,
   UsageIcon,
-  LinkIcon,
   DocsIcon,
   SettingsIcon,
   ChevronDownIcon,
@@ -49,27 +48,6 @@ const GROUP_PLATFORM: NavEntry[] = [
   { id: "docs", icon: <DocsIcon /> },
 ];
 
-/**
- * Sidebar-footer link-account CTA. Only visible when the org is unlinked — once
- * linked, the linked-instances row + plan badge already communicate the state,
- * so a permanent footer button would be noise. Click → opens the login modal
- * directly.
- */
-function LinkAccountFooterItem() {
-  const { t } = useTranslation();
-  const { openLinkModal } = useUI();
-  const { linkState } = useLink();
-  if (linkState !== "unlinked") return null;
-  return (
-    <NavItem
-      id="account-link"
-      label={t("portal.shell.sidebar.linkAccount", "Link Stirling account")}
-      icon={<LinkIcon />}
-      onClick={() => openLinkModal()}
-    />
-  );
-}
-
 function UsageFooter() {
   const { tier } = useTier();
   const { t } = useTranslation();
diff --git a/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx b/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
index fa79ed2c72..af43640905 100644
--- a/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkAccountCard.tsx
@@ -49,7 +49,7 @@ export function LinkAccountCard({ link }: Props) {
           )}
         >
           {t("portal.accountLink.card.loginNotConfigured.before", "Set")}{" "}
-          <code>VITE_SAAS_SUPABASE_URL</code>{" "}
+          <code>VITE_SUPABASE_URL</code>{" "}
           {t(
             "portal.accountLink.card.loginNotConfigured.after",
             "to enable account linking against the hosted Stirling account. In dev you can simulate sign-in from the link dialog.",
diff --git a/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx b/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
index 3f8da872c8..e46504d309 100644
--- a/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkAccountModal.tsx
@@ -96,9 +96,9 @@ export function LinkAccountModal({
             )}
           >
             {t("portal.accountLink.modal.loginNotConfigured.before", "Set")}{" "}
-            <code>VITE_SAAS_SUPABASE_URL</code>{" "}
+            <code>VITE_SUPABASE_URL</code>{" "}
             {t("portal.accountLink.modal.loginNotConfigured.and", "and")}{" "}
-            <code>VITE_SAAS_SUPABASE_ANON_KEY</code>{" "}
+            <code>VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY</code>{" "}
             {t(
               "portal.accountLink.modal.loginNotConfigured.after",
               "to enable in-app linking against the hosted Stirling account.",
diff --git a/frontend/editor/src/portal/components/billing/PortalBillingGate.test.tsx b/frontend/editor/src/portal/components/billing/PortalBillingGate.test.tsx
new file mode 100644
index 0000000000..f15d8ade51
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PortalBillingGate.test.tsx
@@ -0,0 +1,39 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+const linkState = { isLinked: false };
+vi.mock("@portal/contexts/LinkContext", () => ({
+  useLink: () => linkState,
+  useApplyLinkFacts: () => vi.fn(),
+}));
+vi.mock("@portal/contexts/UIContext", () => ({
+  useUI: () => ({ openLinkModal: vi.fn() }),
+}));
+vi.mock("@portal/components/billing/LinkAccountPrompt", () => ({
+  LinkAccountPrompt: () => <div data-testid="link-prompt" />,
+}));
+vi.mock("@portal/views/Usage", () => ({
+  Usage: () => <div data-testid="usage" />,
+}));
+
+import { PortalBillingGate } from "@portal/components/billing/PortalBillingGate";
+
+describe("PortalBillingGate — self-hosted", () => {
+  beforeEach(() => {
+    linkState.isLinked = false;
+  });
+
+  it("shows the link prompt when unlinked (billing gated on link)", () => {
+    linkState.isLinked = false;
+    render(<PortalBillingGate />);
+    expect(screen.getByTestId("link-prompt")).toBeInTheDocument();
+    expect(screen.queryByTestId("usage")).not.toBeInTheDocument();
+  });
+
+  it("renders the Usage page once linked", () => {
+    linkState.isLinked = true;
+    render(<PortalBillingGate />);
+    expect(screen.getByTestId("usage")).toBeInTheDocument();
+    expect(screen.queryByTestId("link-prompt")).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/billing/PortalBillingGate.tsx b/frontend/editor/src/portal/components/billing/PortalBillingGate.tsx
new file mode 100644
index 0000000000..e448cfb93a
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PortalBillingGate.tsx
@@ -0,0 +1,32 @@
+import { useCallback } from "react";
+import { useApplyLinkFacts, useLink } from "@portal/contexts/LinkContext";
+import { useUI } from "@portal/contexts/UIContext";
+import { LinkAccountPrompt } from "@portal/components/billing/LinkAccountPrompt";
+import { Usage } from "@portal/views/Usage";
+import type { Wallet } from "@portal/api/billing";
+
+/**
+ * Billing access gate — the seam the SaaS build overrides.
+ *
+ * <p>Self-hosted (this base): billing only makes sense once the instance has
+ * linked its SaaS account, so gate on link state — unlinked shows the link prompt;
+ * linked renders the (flavor-agnostic) Usage page and maps its callbacks onto the
+ * link/tier dimension: the wallet's subscription status refines the plan/tier
+ * badge, and a lapsed SaaS session re-opens the account-link re-auth. This keeps
+ * the "link" concept entirely out of the Usage page. The SaaS build shadows this
+ * with a passthrough — there is no linking there.
+ */
+export function PortalBillingGate() {
+  const { isLinked } = useLink();
+  const applyLinkFacts = useApplyLinkFacts();
+  const { openLinkModal } = useUI();
+
+  const onWalletLoaded = useCallback(
+    (w: Wallet) => applyLinkFacts(true, w.status === "subscribed"),
+    [applyLinkFacts],
+  );
+  const onReauth = useCallback(() => openLinkModal("reauth"), [openLinkModal]);
+
+  if (!isLinked) return <LinkAccountPrompt />;
+  return <Usage onWalletLoaded={onWalletLoaded} onReauth={onReauth} />;
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
index 3c0498b71b..641bd55599 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, Card, EmptyState, Skeleton } from "@app/ui";
-import { useLink } from "@portal/contexts/LinkContext";
+import { usePortalLinked } from "@portal/contexts/usePortalLinked";
 import { useUI } from "@portal/contexts/UIContext";
 import { useView } from "@portal/contexts/ViewContext";
 import { useAsync } from "@portal/hooks/useAsync";
@@ -46,7 +46,7 @@ import "@portal/views/Procurement.css";
  */
 export function ProcurementHome({ autoOpen = false }: { autoOpen?: boolean }) {
   const { t } = useTranslation();
-  const { isLinked } = useLink();
+  const isLinked = usePortalLinked();
   const { openLinkModal } = useUI();
   const { setActiveView } = useView();
 
diff --git a/frontend/editor/src/portal/components/settings/accountLinkSettings.tsx b/frontend/editor/src/portal/components/settings/accountLinkSettings.tsx
new file mode 100644
index 0000000000..8e769672d7
--- /dev/null
+++ b/frontend/editor/src/portal/components/settings/accountLinkSettings.tsx
@@ -0,0 +1,26 @@
+import type { ComponentType, ReactNode } from "react";
+import { LinkIcon } from "@portal/components/icons";
+import { AccountLinkPanel } from "@portal/components/account-link/AccountLinkPanel";
+
+export interface AccountLinkSettingsSeam {
+  /** Section key in the Settings nav + body switch. */
+  navKey: string;
+  /** i18n key for the nav label; resolved with `t()` at the call site. */
+  labelKey: string;
+  icon: ReactNode;
+  /** The section body — the account-link panel. */
+  Body: ComponentType;
+}
+
+/**
+ * The admin "Account link" section of Settings (self-hosted only). The SaaS
+ * build shadows this file with `null`: the signed-in account IS the SaaS
+ * account, so there is no instance to link — the nav item and its panel both
+ * drop out, and nothing imports the link-only AccountLinkPanel.
+ */
+export const accountLinkSettings: AccountLinkSettingsSeam | null = {
+  navKey: "account-link",
+  labelKey: "portal.settings.sections.account-link",
+  icon: <LinkIcon size={16} />,
+  Body: AccountLinkPanel,
+};
diff --git a/frontend/editor/src/portal/contexts/TierContext.tsx b/frontend/editor/src/portal/contexts/TierContext.tsx
index 5f83159758..1b4742447b 100644
--- a/frontend/editor/src/portal/contexts/TierContext.tsx
+++ b/frontend/editor/src/portal/contexts/TierContext.tsx
@@ -7,7 +7,7 @@ import {
   type ReactNode,
 } from "react";
 import { readMocksPreference } from "@portal/mocks/preference";
-import { useLink, type LinkState } from "@portal/contexts/LinkContext";
+import { usePlanTier } from "@portal/contexts/usePlanTier";
 
 export type Tier = "free" | "pro" | "enterprise";
 
@@ -34,17 +34,6 @@ interface TierContextValue {
 
 const TierContext = createContext<TierContextValue | null>(null);
 
-/** Maps the real link/subscription state onto the tier the rest of the portal reads. */
-function tierFromLinkState(linkState: LinkState): Tier {
-  switch (linkState) {
-    case "linked-subscribed":
-      return "pro";
-    case "linked-free":
-    case "unlinked":
-      return "free";
-  }
-}
-
 export function TierProvider({
   children,
   initialTier = "pro",
@@ -55,28 +44,30 @@ export function TierProvider({
   // Mocks toggling reloads the page (see MocksToggle), so a single read at mount
   // is correct — the preference can't change without us remounting.
   const mocksOn = useMemo(() => readMocksPreference(), []);
-  const { linkState } = useLink();
+  // Real derived tier. Its source is a per-flavor seam: self-hosted derives it
+  // from the link/subscription state, SaaS from the wallet (see usePlanTier).
+  const derivedTier = usePlanTier();
 
   const [mockTier, setMockTier] = useState<Tier>(initialTier);
 
-  // When mocks are off, mirror the real link state into the tier so any
-  // component still keyed on `tier` (sidebar plan badge, gated panels) stays
-  // consistent with the wallet. When mocks are on, the dropdown wins.
+  // When mocks are off, mirror the derived tier so any component keyed on `tier`
+  // (sidebar plan badge, gated panels) stays consistent. When mocks are on, the
+  // dropdown wins.
   useEffect(() => {
     if (!mocksOn) {
-      setMockTier(tierFromLinkState(linkState));
+      setMockTier(derivedTier);
     }
-  }, [mocksOn, linkState]);
+  }, [mocksOn, derivedTier]);
 
   const value = useMemo<TierContextValue>(
     () => ({
-      tier: mocksOn ? mockTier : tierFromLinkState(linkState),
+      tier: mocksOn ? mockTier : derivedTier,
       // Setter is a no-op when mocks are off — UI controls can disable themselves
       // via `isDerived`, but even if one slips through, it has no effect.
       setTier: mocksOn ? setMockTier : () => {},
       isDerived: !mocksOn,
     }),
-    [mocksOn, mockTier, linkState],
+    [mocksOn, mockTier, derivedTier],
   );
 
   return <TierContext.Provider value={value}>{children}</TierContext.Provider>;
diff --git a/frontend/editor/src/portal/contexts/usePlanTier.test.tsx b/frontend/editor/src/portal/contexts/usePlanTier.test.tsx
new file mode 100644
index 0000000000..b89022ff92
--- /dev/null
+++ b/frontend/editor/src/portal/contexts/usePlanTier.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
+import { usePlanTier } from "@portal/contexts/usePlanTier";
+
+function Probe() {
+  return <span data-testid="tier">{usePlanTier()}</span>;
+}
+
+function renderTierFor(initialState: LinkState) {
+  return render(
+    <LinkProvider initialState={initialState}>
+      <Probe />
+    </LinkProvider>,
+  ).getByTestId("tier").textContent;
+}
+
+describe("usePlanTier (self-hosted) — tier from link state", () => {
+  it("unlinked → free", () => {
+    expect(renderTierFor("unlinked")).toBe("free");
+  });
+  it("linked-free → free", () => {
+    expect(renderTierFor("linked-free")).toBe("free");
+  });
+  it("linked-subscribed → pro", () => {
+    expect(renderTierFor("linked-subscribed")).toBe("pro");
+  });
+});
diff --git a/frontend/editor/src/portal/contexts/usePlanTier.ts b/frontend/editor/src/portal/contexts/usePlanTier.ts
new file mode 100644
index 0000000000..47598f12c3
--- /dev/null
+++ b/frontend/editor/src/portal/contexts/usePlanTier.ts
@@ -0,0 +1,24 @@
+import { useLink, type LinkState } from "@portal/contexts/LinkContext";
+import type { Tier } from "@portal/contexts/TierContext";
+
+/** Maps the self-hosted link/subscription state onto the portal tier. */
+function tierFromLinkState(linkState: LinkState): Tier {
+  switch (linkState) {
+    case "linked-subscribed":
+      return "pro";
+    case "linked-free":
+    case "unlinked":
+      return "free";
+  }
+}
+
+/**
+ * The plan tier the portal runs on, self-hosted flavor: derived from whether the
+ * org has linked its SaaS account and carries a live subscription. The SaaS
+ * build shadows this file to derive the tier from the wallet instead — there is
+ * no link concept there (see portal-saas/contexts/usePlanTier).
+ */
+export function usePlanTier(): Tier {
+  const { linkState } = useLink();
+  return tierFromLinkState(linkState);
+}
diff --git a/frontend/editor/src/portal/contexts/usePortalLinked.test.tsx b/frontend/editor/src/portal/contexts/usePortalLinked.test.tsx
new file mode 100644
index 0000000000..37f7f799b3
--- /dev/null
+++ b/frontend/editor/src/portal/contexts/usePortalLinked.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
+import { usePortalLinked } from "@portal/contexts/usePortalLinked";
+
+function Probe() {
+  return <span data-testid="linked">{String(usePortalLinked())}</span>;
+}
+
+function renderLinkedFor(initialState: LinkState) {
+  return render(
+    <LinkProvider initialState={initialState}>
+      <Probe />
+    </LinkProvider>,
+  ).getByTestId("linked").textContent;
+}
+
+describe("usePortalLinked (self-hosted) — gated on the account link", () => {
+  it("unlinked → false", () => {
+    expect(renderLinkedFor("unlinked")).toBe("false");
+  });
+  it("linked-free → true", () => {
+    expect(renderLinkedFor("linked-free")).toBe("true");
+  });
+  it("linked-subscribed → true", () => {
+    expect(renderLinkedFor("linked-subscribed")).toBe("true");
+  });
+});
diff --git a/frontend/editor/src/portal/contexts/usePortalLinked.ts b/frontend/editor/src/portal/contexts/usePortalLinked.ts
new file mode 100644
index 0000000000..b7501ad128
--- /dev/null
+++ b/frontend/editor/src/portal/contexts/usePortalLinked.ts
@@ -0,0 +1,12 @@
+import { useLink } from "@portal/contexts/LinkContext";
+
+/**
+ * Whether the portal is authorized against a SaaS billing account — the gate the
+ * procurement/checkout flow uses. Self-hosted flavor: true once the instance has
+ * linked its SaaS account. The SaaS build shadows this file to return true
+ * unconditionally: the signed-in account IS the SaaS account, so there is no link
+ * step and nothing to gate on.
+ */
+export function usePortalLinked(): boolean {
+  return useLink().isLinked;
+}
diff --git a/frontend/editor/src/portal/tsconfig.json b/frontend/editor/src/portal/tsconfig.json
index 2eaab73a90..64fef64f42 100644
--- a/frontend/editor/src/portal/tsconfig.json
+++ b/frontend/editor/src/portal/tsconfig.json
@@ -3,7 +3,6 @@
   "compilerOptions": {
     "paths": {
       "@app/*": [
-        "../../src/portal/*",
         "../../src/cloud/*",
         "../../src/proprietary/*",
         "../../src/core/*"
diff --git a/frontend/editor/src/portal/views/Usage.test.tsx b/frontend/editor/src/portal/views/Usage.test.tsx
new file mode 100644
index 0000000000..1df8b0525e
--- /dev/null
+++ b/frontend/editor/src/portal/views/Usage.test.tsx
@@ -0,0 +1,67 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import type { ReactElement } from "react";
+
+// Usage renders Mantine-backed @app/ui components (e.g. the "Manage Payment"
+// Button in the subscribed header), which need a MantineProvider in the tree.
+const renderUsage = (ui: ReactElement) =>
+  render(<MantineProvider>{ui}</MantineProvider>);
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string, def?: string) => def ?? key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchWallet = vi.fn();
+const refreshWalletCache = vi.fn();
+vi.mock("@portal/api/billing", () => ({
+  fetchWallet: () => fetchWallet(),
+  refreshWalletCache: () => refreshWalletCache(),
+}));
+vi.mock("@portal/api/link", () => ({
+  fetchLocalUsage: () => Promise.resolve(null),
+  triggerLocalSync: () => Promise.resolve(),
+}));
+vi.mock("@portal/hooks/useStripePortal", () => ({
+  useStripePortal: () => ({ opening: false, open: vi.fn(), error: null }),
+}));
+// Stub the plan views so the test doesn't depend on the full wallet shape.
+vi.mock("@portal/components/billing/FreePlanView", () => ({
+  FreePlanView: () => null,
+}));
+vi.mock("@portal/components/billing/SubscribedPlanView", () => ({
+  SubscribedPlanView: () => null,
+}));
+
+import { Usage } from "@portal/views/Usage";
+
+describe("Usage — link-free wallet renderer", () => {
+  beforeEach(() => {
+    fetchWallet.mockReset();
+    refreshWalletCache.mockReset();
+  });
+
+  it("loads the wallet on mount and reports it via onWalletLoaded (no link gate)", async () => {
+    fetchWallet.mockResolvedValue({ status: "free" });
+    const onWalletLoaded = vi.fn();
+
+    renderUsage(<Usage onWalletLoaded={onWalletLoaded} />);
+
+    // Renders immediately (no link prompt / login) and loads unconditionally.
+    expect(screen.getByText("Usage & billing")).toBeInTheDocument();
+    await waitFor(() =>
+      expect(onWalletLoaded).toHaveBeenCalledWith({ status: "free" }),
+    );
+  });
+
+  it("works with no callbacks (SaaS passes none)", async () => {
+    fetchWallet.mockResolvedValue({ status: "subscribed" });
+
+    renderUsage(<Usage />);
+
+    await waitFor(() => expect(fetchWallet).toHaveBeenCalledTimes(1));
+  });
+});
diff --git a/frontend/editor/src/portal/views/Usage.tsx b/frontend/editor/src/portal/views/Usage.tsx
index 4a4493aa2c..776b210951 100644
--- a/frontend/editor/src/portal/views/Usage.tsx
+++ b/frontend/editor/src/portal/views/Usage.tsx
@@ -1,8 +1,6 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, Skeleton } from "@app/ui";
-import { useLink } from "@portal/contexts/LinkContext";
-import { useUI } from "@portal/contexts/UIContext";
 import {
   fetchWallet,
   refreshWalletCache,
@@ -14,7 +12,6 @@ import {
   type LocalUsage,
 } from "@portal/api/link";
 import { useStripePortal } from "@portal/hooks/useStripePortal";
-import { LinkAccountPrompt } from "@portal/components/billing/LinkAccountPrompt";
 import { FreePlanView } from "@portal/components/billing/FreePlanView";
 import { SubscribedPlanView } from "@portal/components/billing/SubscribedPlanView";
 import {
@@ -25,33 +22,44 @@ import {
 import "@portal/views/Usage.css";
 import "@portal/components/billing/billing.css";
 
+export interface UsageProps {
+  /**
+   * Called with the wallet whenever it loads (initial fetch + post-checkout
+   * flip). A flavor-agnostic hook the composition uses for cross-cutting state —
+   * self-hosted maps it onto the link/tier dimension; SaaS ignores it.
+   */
+  onWalletLoaded?: (wallet: Wallet) => void;
+  /**
+   * Invoked when the SaaS session has lapsed and the user chooses to re-sign-in.
+   * When omitted, the "session expired" notice shows without a sign-in action.
+   * Self-hosted wires this to its re-auth flow; SaaS leaves it unset (its session
+   * is owned by the app, so this path never triggers).
+   */
+  onReauth?: () => void;
+}
+
 /**
- * Billing & usage page. State-driven by the link/subscription dimension —
- * NOT by the legacy {@code tier} prop:
+ * Billing & usage page — a flavor-agnostic wallet renderer. Whether it should be
+ * shown at all (self-hosted only renders it once the instance is linked) is
+ * decided upstream by the billing gate; this component always loads the wallet
+ * and dispatches on {@code wallet.status}:
  *
- *   unlinked          → LinkAccountPrompt
- *   linked-free       → FreePlanView (free meter + PAYG explainer)
- *   linked-subscribed → SubscribedPlanView (period meter, cap, members,
- *                       invoices, Stripe portal)
+ *   free       → FreePlanView (free meter + PAYG explainer)
+ *   subscribed → SubscribedPlanView (period meter, cap, members, invoices)
  *
  * Wallet comes from {@code GET /api/v1/payg/wallet} (apiClient.saas). After a
- * subscription flip via Stripe checkout / cancel via the portal, the
- * onWalletChange refresh re-reads and the view re-dispatches on the new
- * status.
+ * checkout / cancel, the refresh re-reads and the view re-dispatches on status.
  */
-export function Usage() {
+export function Usage({ onWalletLoaded, onReauth }: UsageProps = {}) {
   const { t } = useTranslation();
-  const { isLinked, setLinkState, saasSessionNonce } = useLink();
-  const { openLinkModal } = useUI();
   const [wallet, setWallet] = useState<Wallet | null>(null);
   // Locally-accrued usage SaaS hasn't billed yet; added to the synced figure so
   // "current usage" reflects work since the last daily sync. Best-effort.
   const [localUsage, setLocalUsage] = useState<LocalUsage | null>(null);
-  const [loading, setLoading] = useState<boolean>(isLinked);
+  const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
-  // The instance is linked but the browser's SaaS session has lapsed — needs a
-  // re-sign-in, NOT a re-link.
-  const [needsReauth, setNeedsReauth] = useState(false);
+  // The SaaS session has lapsed and needs a re-sign-in (self-hosted only).
+  const [sessionExpired, setSessionExpired] = useState(false);
   const [refreshKey, setRefreshKey] = useState(0);
   // Stripe customer portal — the subscribed header's "Manage Payment" action.
   const portal = useStripePortal(wallet);
@@ -65,20 +73,10 @@ export function Usage() {
   }, []);
 
   useEffect(() => {
-    // Only fetch the wallet when the instance is linked. Unlinked → render the
-    // link prompt; no SaaS call needed.
-    if (!isLinked) {
-      setWallet(null);
-      setLocalUsage(null);
-      setLoading(false);
-      setError(null);
-      setNeedsReauth(false);
-      return;
-    }
     let cancelled = false;
     setLoading(true);
     setError(null);
-    setNeedsReauth(false);
+    setSessionExpired(false);
     // Independent of the wallet load — a local-usage failure must not break the
     // page; it just means no unsynced delta is shown.
     fetchLocalUsage()
@@ -92,18 +90,13 @@ export function Usage() {
       .then((w) => {
         if (cancelled) return;
         setWallet(w);
-        // Derive the linked-free / linked-subscribed dimension from the live
-        // wallet. Only refines a `linked-*` state; never flips unlinked → linked.
-        setLinkState(
-          w.status === "subscribed" ? "linked-subscribed" : "linked-free",
-        );
+        onWalletLoaded?.(w);
       })
       .catch((e) => {
         if (cancelled) return;
         if (e instanceof SaasNotLinkedError) {
-          // Reached only when the instance IS linked (we don't fetch otherwise),
-          // so this means the attended SaaS session expired — prompt re-sign-in.
-          setNeedsReauth(true);
+          // The attended SaaS session expired — offer a re-sign-in.
+          setSessionExpired(true);
         } else if (e instanceof SaasUnconfiguredError) {
           setError(e.message);
         } else if (e instanceof HttpError) {
@@ -127,7 +120,7 @@ export function Usage() {
     return () => {
       cancelled = true;
     };
-  }, [isLinked, refreshKey, saasSessionNonce, setLinkState]);
+  }, [refreshKey, onWalletLoaded, t]);
 
   const refresh = useCallback(() => setRefreshKey((k) => k + 1), []);
 
@@ -146,9 +139,10 @@ export function Usage() {
         if (!mounted.current) return false;
         if (w.status === "subscribed") {
           setWallet(w);
-          setLinkState("linked-subscribed");
+          onWalletLoaded?.(w);
           // Nudge the local instance to refresh its gate now so billable work
-          // unblocks immediately rather than on its next poll. Fire-and-forget.
+          // unblocks immediately rather than on its next poll. Fire-and-forget;
+          // a no-op on SaaS (no local instance to sync).
           triggerLocalSync().catch(() => {});
           return true;
         }
@@ -162,7 +156,7 @@ export function Usage() {
     // shows its "almost there" notice rather than the page silently self-healing.
     setRefreshKey((k) => k + 1);
     return false;
-  }, [setLinkState]);
+  }, [onWalletLoaded]);
 
   return (
     <div className="portal-usage portal-billing">
@@ -193,23 +187,23 @@ export function Usage() {
       </header>
 
       <div className="portal-usage__body">
-        {!isLinked && <LinkAccountPrompt />}
-
-        {isLinked && loading && (
+        {loading && (
           <div className="portal-billing__skeleton" aria-hidden>
             <Skeleton height="10rem" />
             <Skeleton height="14rem" />
           </div>
         )}
 
-        {isLinked && needsReauth && (
+        {sessionExpired && (
           <Banner
             tone="warning"
             title={t("portal.usage.sessionExpired.title", "Session expired")}
             action={
-              <Button size="sm" onClick={() => openLinkModal("reauth")}>
-                {t("portal.usage.sessionExpired.action", "Sign in again")}
-              </Button>
+              onReauth ? (
+                <Button size="sm" onClick={onReauth}>
+                  {t("portal.usage.sessionExpired.action", "Sign in again")}
+                </Button>
+              ) : undefined
             }
           >
             {t(
@@ -219,7 +213,7 @@ export function Usage() {
           </Banner>
         )}
 
-        {isLinked && error && (
+        {error && (
           <Banner
             tone="danger"
             title={t("portal.usage.error.loadWallet", "Couldn't load wallet")}
@@ -228,7 +222,7 @@ export function Usage() {
           </Banner>
         )}
 
-        {isLinked && portal.error && (
+        {portal.error && (
           <Banner
             tone="danger"
             title={t(
@@ -240,7 +234,7 @@ export function Usage() {
           </Banner>
         )}
 
-        {isLinked && wallet && wallet.status === "free" && (
+        {wallet && wallet.status === "free" && (
           <FreePlanView
             wallet={wallet}
             unsynced={localUsage}
@@ -248,7 +242,7 @@ export function Usage() {
           />
         )}
 
-        {isLinked && wallet && wallet.status === "subscribed" && (
+        {wallet && wallet.status === "subscribed" && (
           <SubscribedPlanView
             wallet={wallet}
             unsynced={localUsage}
diff --git a/frontend/editor/src/portal/vite-env.d.ts b/frontend/editor/src/portal/vite-env.d.ts
index 07664b3f5f..91acc858f2 100644
--- a/frontend/editor/src/portal/vite-env.d.ts
+++ b/frontend/editor/src/portal/vite-env.d.ts
@@ -1,10 +1,10 @@
 /// <reference types="vite/client" />
 
 interface ImportMetaEnv {
-  /** Hosted SaaS Supabase project URL — in-app account-link login. Empty → link UI shows a configure state. */
-  readonly VITE_SAAS_SUPABASE_URL: string;
-  /** Hosted SaaS Supabase anon/publishable key (public). */
-  readonly VITE_SAAS_SUPABASE_ANON_KEY: string;
+  /** Stirling Supabase project URL — in-app account-link login (same project every flavor uses). Empty → link UI shows a configure state. */
+  readonly VITE_SUPABASE_URL: string;
+  /** Stirling Supabase publishable/anon key (public). */
+  readonly VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: string;
   /** Hosted SaaS Java backend base URL — attended portal→SaaS reads (wallet, invoices, …) via apiClient.saas with the admin's JWT. */
   readonly VITE_SAAS_API_URL: string;
   /** Stripe publishable key (pk_live_… / pk_test_…) used by embedded Checkout. */
diff --git a/frontend/editor/src/saas/auth/supabase.ts b/frontend/editor/src/saas/auth/supabase.ts
index ad32cfa58d..1ea68e077e 100644
--- a/frontend/editor/src/saas/auth/supabase.ts
+++ b/frontend/editor/src/saas/auth/supabase.ts
@@ -1,22 +1,10 @@
 import { createClient } from "@supabase/supabase-js";
 
-// Debug helper to log Supabase configuration
-const debugConfig = () => {
-  const url = import.meta.env.VITE_SUPABASE_URL;
-  const key = import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY;
-
-  console.log("[Supabase Debug] Configuration:", {
-    url: url ? "✓ URL configured" : "✗ URL missing",
-    key: key ? "✓ Key configured" : "✗ Key missing",
-    urlValue: url || "undefined",
-    keyValue: key ? `${key.substring(0, 20)}...` : "undefined",
-  });
-
-  return { url, key };
+const config = {
+  url: import.meta.env.VITE_SUPABASE_URL,
+  key: import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY,
 };
 
-const config = debugConfig();
-
 if (!config.url) {
   throw new Error("Missing VITE_SUPABASE_URL environment variable");
 }
diff --git a/frontend/editor/src/saas/tsconfig.json b/frontend/editor/src/saas/tsconfig.json
index 08beefbb77..a887c3c5c5 100644
--- a/frontend/editor/src/saas/tsconfig.json
+++ b/frontend/editor/src/saas/tsconfig.json
@@ -8,11 +8,19 @@
         "../../src/proprietary/*",
         "../../src/core/*"
       ],
-      "@portal/*": ["../../src/portal/*"],
+      "@portal/*": ["../../src/portal-saas/*", "../../src/portal/*"],
+      "@portal-proprietary/*": ["../../src/portal/*"],
       "@cloud/*": ["../../src/cloud/*"],
       "@proprietary/*": ["../../src/proprietary/*"],
       "@core/*": ["../../src/core/*"]
     }
   },
-  "include": ["../global.d.ts", "../*.js", "../*.ts", "../*.tsx", "."]
+  "include": [
+    "../global.d.ts",
+    "../*.js",
+    "../*.ts",
+    "../*.tsx",
+    ".",
+    "../portal-saas"
+  ]
 }
diff --git a/frontend/editor/tsconfig.portal.vite.json b/frontend/editor/tsconfig.portal.vite.json
index 93337d1dcc..924d616019 100644
--- a/frontend/editor/tsconfig.portal.vite.json
+++ b/frontend/editor/tsconfig.portal.vite.json
@@ -3,12 +3,7 @@
   "comment": "Path resolution for the portal's vitest project (referenced by vitest.config.ts). Broad include ('src', via the base) so vite-tsconfig-paths rewrites @app/* in every editor/src file the portal tests pull in (e.g. core/ui), not just the portal layer. The portal's own typecheck uses src/portal/tsconfig.json.",
   "compilerOptions": {
     "paths": {
-      "@app/*": [
-        "./src/portal/*",
-        "./src/cloud/*",
-        "./src/proprietary/*",
-        "./src/core/*"
-      ],
+      "@app/*": ["./src/cloud/*", "./src/proprietary/*", "./src/core/*"],
       "@portal/*": ["./src/portal/*"],
       "@cloud/*": ["./src/cloud/*"],
       "@proprietary/*": ["./src/proprietary/*"],
diff --git a/frontend/editor/tsconfig.saas.vite.json b/frontend/editor/tsconfig.saas.vite.json
index c7d2c03eb2..f31279fac3 100644
--- a/frontend/editor/tsconfig.saas.vite.json
+++ b/frontend/editor/tsconfig.saas.vite.json
@@ -8,7 +8,8 @@
         "./src/proprietary/*",
         "./src/core/*"
       ],
-      "@portal/*": ["./src/portal/*"],
+      "@portal/*": ["./src/portal-saas/*", "./src/portal/*"],
+      "@portal-proprietary/*": ["./src/portal/*"],
       "@cloud/*": ["./src/cloud/*"],
       "@proprietary/*": ["./src/proprietary/*"],
       "@core/*": ["./src/core/*"]
diff --git a/frontend/editor/vitest.config.ts b/frontend/editor/vitest.config.ts
index e4dfd76277..5d7a00bccf 100644
--- a/frontend/editor/vitest.config.ts
+++ b/frontend/editor/vitest.config.ts
@@ -104,7 +104,13 @@ export default defineConfig({
       {
         test: {
           name: "saas",
-          include: ["src/saas/**/*.test.{ts,tsx}"],
+          // src/saas = editor-saas layer; src/portal-saas = the portal's saas
+          // overrides (sibling to src/portal). Both build under the saas flavor,
+          // so both resolve @portal via the saas cascade (tsconfig.saas.vite.json).
+          include: [
+            "src/saas/**/*.test.{ts,tsx}",
+            "src/portal-saas/**/*.test.{ts,tsx}",
+          ],
           environment: "jsdom",
           globals: true,
           setupFiles: ["./src/saas/setupTests.ts"],
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 02f1c68132..707c411d14 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -6,7 +6,8 @@ import { defineConfig } from "eslint/config";
 import tseslint from "typescript-eslint";
 
 const srcGlobs = [
-  // The portal layer lives under editor/src/portal, so editor/src/** covers it.
+  // The portal layers live under editor/src/portal (base) and
+  // editor/src/portal-saas (saas override), so editor/src/** covers them.
   "editor/src/**/*.{js,mjs,jsx,ts,tsx}",
 ];
 const nodeGlobs = [

From c8f238ae601f71cd3bea194aed93d3818e225e3e Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:17:00 +0100
Subject: [PATCH 25/35] Portal/editor switcher (#6907)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the portal's top-left app switcher to the editor sidebar, so you
can jump between the two apps from either side.

- Both sidebars render the same shared `AppSwitch` component (sui
dropdown).
- Switching is client-side (no page reload); portal→editor no longer
breaks when `VITE_EDITOR_URL` is unset.
- Editor side is admin-gated (`portalAccess`) and only exists in flavors
that ship the portal — core/desktop stub it out, same seam pattern as
the portal routes.
- Fixes en route: dropdown menu stacking in the editor sidebar, sui
dropdown item button reset, stale `dist-portal` ESLint ignore.
---
 .../src/core/components/shared/AppSwitch.css  | 27 ++++++
 .../src/core/components/shared/AppSwitch.tsx  | 82 +++++++++++++++++++
 .../core/components/shared/AppSwitcher.tsx    |  8 ++
 .../core/components/shared/FileSidebar.css    | 12 +++
 .../core/components/shared/FileSidebar.tsx    | 12 +++
 .../editor/src/core/routes/portalBasename.ts  |  7 ++
 frontend/editor/src/core/ui/Dropdown.css      |  6 ++
 .../desktop/components/shared/AppSwitcher.tsx |  9 ++
 frontend/editor/src/portal/auth/editorUrl.ts  | 15 +++-
 .../editor/src/portal/components/Sidebar.css  | 27 +-----
 .../editor/src/portal/components/Sidebar.tsx  | 61 +++++---------
 .../src/portal/contexts/ViewContext.tsx       |  6 +-
 .../components/shared/AppSwitcher.tsx         | 28 +++++++
 frontend/eslint.config.mjs                    |  1 +
 14 files changed, 228 insertions(+), 73 deletions(-)
 create mode 100644 frontend/editor/src/core/components/shared/AppSwitch.css
 create mode 100644 frontend/editor/src/core/components/shared/AppSwitch.tsx
 create mode 100644 frontend/editor/src/core/components/shared/AppSwitcher.tsx
 create mode 100644 frontend/editor/src/core/routes/portalBasename.ts
 create mode 100644 frontend/editor/src/desktop/components/shared/AppSwitcher.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx

diff --git a/frontend/editor/src/core/components/shared/AppSwitch.css b/frontend/editor/src/core/components/shared/AppSwitch.css
new file mode 100644
index 0000000000..c40080b1e9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppSwitch.css
@@ -0,0 +1,27 @@
+/* Trigger: bare square icon button that blends into either sidebar's header. */
+.app-switch-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.25rem;
+  height: 1.25rem;
+  border: none;
+  background: none;
+  cursor: pointer;
+  border-radius: var(--radius-sm);
+  color: var(--color-text-4);
+  transition:
+    background var(--motion-fast),
+    color var(--motion-fast);
+}
+
+.app-switch-btn:hover {
+  background: var(--color-bg-hover);
+  color: var(--color-text-2);
+}
+
+.app-switch-icon {
+  width: 1rem;
+  height: 1.0625rem;
+  display: block;
+}
diff --git a/frontend/editor/src/core/components/shared/AppSwitch.tsx b/frontend/editor/src/core/components/shared/AppSwitch.tsx
new file mode 100644
index 0000000000..b713e75e7c
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppSwitch.tsx
@@ -0,0 +1,82 @@
+import { useTranslation } from "react-i18next";
+import { Button, Dropdown } from "@app/ui";
+import markLight from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextLight.svg";
+import markDark from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextDark.svg";
+import "@app/components/shared/AppSwitch.css";
+
+export type AppSwitchTarget = "editor" | "processor";
+
+function ChevronDownIcon() {
+  return (
+    <svg
+      xmlns="http://www.w3.org/2000/svg"
+      width={14}
+      height={14}
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth={1.75}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      <polyline points="6 9 12 15 18 9" />
+    </svg>
+  );
+}
+
+interface AppSwitchProps {
+  /** The app this switcher is rendered in (shown as active in the menu). */
+  current: AppSwitchTarget;
+  /** Resolved color scheme; picks the brand mark for the menu items. */
+  theme: "light" | "dark";
+  /** Invoked with the selected app; only called for apps other than `current`. */
+  onSwitch: (app: AppSwitchTarget) => void;
+  className?: string;
+}
+
+/**
+ * The editor ⇄ processor app switcher (chevron button → app menu). The editor
+ * and portal sidebars render this same element so the two apps present one
+ * identical switcher; each host supplies its own theme source and navigation.
+ */
+export function AppSwitch({
+  current,
+  theme,
+  onSwitch,
+  className,
+}: AppSwitchProps) {
+  const { t } = useTranslation();
+  const mark = theme === "dark" ? markDark : markLight;
+  const apps: Array<{ id: AppSwitchTarget; label: string }> = [
+    {
+      id: "processor",
+      label: t("portal.shell.sidebar.appProcessor", "Processor"),
+    },
+    { id: "editor", label: t("portal.shell.sidebar.appEditor", "Editor") },
+  ];
+  return (
+    <Dropdown.Root align="end" className={className}>
+      <Dropdown.Trigger>
+        <Button
+          variant="tertiary"
+          className="app-switch-btn"
+          aria-label={t("portal.shell.sidebar.switchApp", "Switch app")}
+        >
+          <ChevronDownIcon />
+        </Button>
+      </Dropdown.Trigger>
+      <Dropdown.Menu width="11rem">
+        {apps.map((app) => (
+          <Dropdown.Item
+            key={app.id}
+            active={current === app.id}
+            onSelect={app.id === current ? undefined : () => onSwitch(app.id)}
+            leading={<img className="app-switch-icon" src={mark} alt="" />}
+          >
+            {app.label}
+          </Dropdown.Item>
+        ))}
+      </Dropdown.Menu>
+    </Dropdown.Root>
+  );
+}
diff --git a/frontend/editor/src/core/components/shared/AppSwitcher.tsx b/frontend/editor/src/core/components/shared/AppSwitcher.tsx
new file mode 100644
index 0000000000..298a46e1ac
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppSwitcher.tsx
@@ -0,0 +1,8 @@
+/**
+ * Core stub for the sidebar app switcher. Builds that bundle the admin portal
+ * (proprietary/saas) shadow this with a real switcher; core has no portal, so
+ * there is nothing to switch to.
+ */
+export function AppSwitcher() {
+  return null;
+}
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.css b/frontend/editor/src/core/components/shared/FileSidebar.css
index d06982179e..0b495d723b 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.css
+++ b/frontend/editor/src/core/components/shared/FileSidebar.css
@@ -102,6 +102,18 @@
   flex-shrink: 0;
 }
 
+/* App switcher (portal builds only) sits at the far end of the header row.
+   The content-fade animation makes this span a stacking context, which would
+   trap the menu's z-index below later sidebar rows — elevate the span so the
+   open menu paints above them. */
+.file-sidebar-app-switch {
+  margin-inline-start: auto;
+  display: flex;
+  align-items: center;
+  position: relative;
+  z-index: var(--z-dropdown);
+}
+
 /* ---- Search row ---- */
 .file-sidebar-search-row {
   display: flex;
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.tsx b/frontend/editor/src/core/components/shared/FileSidebar.tsx
index db3820350e..f6fb7f0ce9 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebar.tsx
@@ -29,6 +29,7 @@ import {
 import { accountService } from "@app/services/accountService";
 import { GoogleDriveIcon } from "@app/components/shared/CloudStorageIcons";
 import { Wordmark } from "@app/components/shared/Wordmark";
+import { AppSwitcher } from "@app/components/shared/AppSwitcher";
 import type { StirlingFileStub } from "@app/types/fileContext";
 import MenuIcon from "@mui/icons-material/Menu";
 import SearchIcon from "@mui/icons-material/Search";
@@ -679,6 +680,17 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                   className="file-sidebar-brand-text sidebar-content-fade"
                 />
               )}
+              {!collapsed && (
+                // The header row itself toggles collapse; stop the switcher's
+                // clicks and key presses from reaching it.
+                <span
+                  className="file-sidebar-app-switch sidebar-content-fade"
+                  onClick={(e) => e.stopPropagation()}
+                  onKeyDown={(e) => e.stopPropagation()}
+                >
+                  <AppSwitcher />
+                </span>
+              )}
             </div>
           </Tooltip>
 
diff --git a/frontend/editor/src/core/routes/portalBasename.ts b/frontend/editor/src/core/routes/portalBasename.ts
new file mode 100644
index 0000000000..70f05f6a27
--- /dev/null
+++ b/frontend/editor/src/core/routes/portalBasename.ts
@@ -0,0 +1,7 @@
+/**
+ * Base path where the admin portal route-set mounts inside the editor app
+ * (see adminRouteExtensions). Lives in core so any layer can reference the
+ * mount point without importing portal code — build flavors that ship no
+ * portal (core, desktop, prototypes) must never resolve @portal.
+ */
+export const PORTAL_BASENAME = "/portal";
diff --git a/frontend/editor/src/core/ui/Dropdown.css b/frontend/editor/src/core/ui/Dropdown.css
index c96aec1672..736371e6ae 100644
--- a/frontend/editor/src/core/ui/Dropdown.css
+++ b/frontend/editor/src/core/ui/Dropdown.css
@@ -36,6 +36,12 @@
   font-size: 0.8125rem;
   color: var(--color-text-2);
   border-radius: var(--radius-sm);
+  /* Explicit button reset: hosts without a global button reset (e.g. the
+     editor) would otherwise show the UA's buttonface background and border. */
+  background: none;
+  border: none;
+  font-family: inherit;
+  cursor: pointer;
   transition:
     background var(--motion-fast),
     color var(--motion-fast);
diff --git a/frontend/editor/src/desktop/components/shared/AppSwitcher.tsx b/frontend/editor/src/desktop/components/shared/AppSwitcher.tsx
new file mode 100644
index 0000000000..9d7c2c095e
--- /dev/null
+++ b/frontend/editor/src/desktop/components/shared/AppSwitcher.tsx
@@ -0,0 +1,9 @@
+/**
+ * Desktop inherits proprietary's layers but does not ship the portal (see
+ * desktop/routes/adminRouteExtensions), so shadow the switcher back to empty —
+ * otherwise the desktop bundle would reference @portal via the proprietary
+ * switcher's imports.
+ */
+export function AppSwitcher() {
+  return null;
+}
diff --git a/frontend/editor/src/portal/auth/editorUrl.ts b/frontend/editor/src/portal/auth/editorUrl.ts
index 43eb466cb7..8f60292331 100644
--- a/frontend/editor/src/portal/auth/editorUrl.ts
+++ b/frontend/editor/src/portal/auth/editorUrl.ts
@@ -3,8 +3,15 @@
  * bouncing non-admins out).
  *
  * Sourced from VITE_EDITOR_URL so it's configurable per deploy rather than
- * hardcoded. The committed default is "/" (production serves the editor at the
- * root on the same origin as the portal). For dev cross-app navigation to a
- * separately-running editor, set VITE_EDITOR_URL in editor/.env.local.
+ * hardcoded, falling back to "/" (the editor serves the portal at /portal on
+ * the same origin, so the root is the editor). For dev cross-app navigation to
+ * a separately-running editor, set VITE_EDITOR_URL in editor/.env.local.
  */
-export const EDITOR_URL = import.meta.env.VITE_EDITOR_URL;
+export const EDITOR_URL = import.meta.env.VITE_EDITOR_URL || "/";
+
+/**
+ * When the editor is at the root of this origin, the portal and editor are
+ * route-sets of one SPA — switching apps can be a client-side navigation
+ * instead of a full page load.
+ */
+export const EDITOR_IS_SAME_APP = EDITOR_URL === "/";
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index c12b6debb0..fcc8c7e6a8 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -40,35 +40,12 @@
   white-space: nowrap;
 }
 
-/* App switcher (down-arrow → Portal / Editor) */
+/* App switcher (down-arrow → Portal / Editor); button and menu styling live
+   with the shared AppSwitch element. */
 .portal-sidebar__app-switch {
   margin-left: auto;
   display: flex;
 }
-.portal-sidebar__app-switch-btn {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.25rem;
-  height: 1.25rem;
-  border: none;
-  background: none;
-  cursor: pointer;
-  border-radius: var(--radius-sm);
-  color: var(--color-text-4);
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-.portal-sidebar__app-switch-btn:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-2);
-}
-.portal-sidebar__app-icon {
-  width: 1rem;
-  height: 1.0625rem;
-  display: block;
-}
 
 /* Nav body */
 .portal-sidebar__nav {
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 486611248b..fed5d7f68e 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -1,5 +1,7 @@
-import { Button, Dropdown, NavItem } from "@app/ui";
+import { NavItem } from "@app/ui";
+import { AppSwitch } from "@app/components/shared/AppSwitch";
 import { useTranslation } from "react-i18next";
+import { useNavigate } from "react-router-dom";
 import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { useTier } from "@portal/contexts/TierContext";
 import { useTheme } from "@portal/contexts/ThemeContext";
@@ -7,7 +9,7 @@ import { useUI } from "@portal/contexts/UIContext";
 import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
 import { useAsync } from "@portal/hooks/useAsync";
 import { fetchHomeKpis, type KpiEntry } from "@portal/api/home";
-import { EDITOR_URL } from "@portal/auth/editorUrl";
+import { EDITOR_URL, EDITOR_IS_SAME_APP } from "@portal/auth/editorUrl";
 import markLight from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextLight.svg";
 import markDark from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextDark.svg";
 import {
@@ -22,7 +24,6 @@ import {
   UsageIcon,
   DocsIcon,
   SettingsIcon,
-  ChevronDownIcon,
 } from "@portal/components/icons";
 import "@portal/components/Sidebar.css";
 
@@ -114,6 +115,15 @@ export function Sidebar() {
   const { theme } = useTheme();
   const { openSettings } = useUI();
   const { t } = useTranslation();
+  const navigate = useNavigate();
+
+  // Editor and portal are one SPA when the editor serves this origin's root, so
+  // the switch stays client-side; an absolute EDITOR_URL (dev cross-app setup)
+  // needs a full page load.
+  const goToEditor = () => {
+    if (EDITOR_IS_SAME_APP) navigate("/");
+    else window.location.href = EDITOR_URL;
+  };
 
   // Procurement is no longer a nav tab — it lives on Home as the deal-status hero and expands into
   // a takeover modal (matching the marketing prototype).
@@ -148,45 +158,12 @@ export function Sidebar() {
           </span>
         </span>
 
-        <Dropdown.Root align="end" className="portal-sidebar__app-switch">
-          <Dropdown.Trigger>
-            <Button
-              variant="tertiary"
-              className="portal-sidebar__app-switch-btn"
-              aria-label={t("portal.shell.sidebar.switchApp")}
-            >
-              <ChevronDownIcon size={14} />
-            </Button>
-          </Dropdown.Trigger>
-          <Dropdown.Menu width="11rem">
-            <Dropdown.Item
-              active
-              leading={
-                <img
-                  className="portal-sidebar__app-icon"
-                  src={theme === "dark" ? markDark : markLight}
-                  alt=""
-                />
-              }
-            >
-              {t("portal.shell.sidebar.appProcessor")}
-            </Dropdown.Item>
-            <Dropdown.Item
-              onSelect={() => {
-                window.location.href = EDITOR_URL;
-              }}
-              leading={
-                <img
-                  className="portal-sidebar__app-icon"
-                  src={theme === "dark" ? markDark : markLight}
-                  alt=""
-                />
-              }
-            >
-              {t("portal.shell.sidebar.appEditor")}
-            </Dropdown.Item>
-          </Dropdown.Menu>
-        </Dropdown.Root>
+        <AppSwitch
+          className="portal-sidebar__app-switch"
+          current="processor"
+          theme={theme}
+          onSwitch={goToEditor}
+        />
       </div>
 
       <nav className="portal-sidebar__nav">
diff --git a/frontend/editor/src/portal/contexts/ViewContext.tsx b/frontend/editor/src/portal/contexts/ViewContext.tsx
index 0502011511..0a9706ef7a 100644
--- a/frontend/editor/src/portal/contexts/ViewContext.tsx
+++ b/frontend/editor/src/portal/contexts/ViewContext.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useMemo } from "react";
 import { useLocation, useNavigate } from "react-router-dom";
+import { PORTAL_BASENAME } from "@app/routes/portalBasename";
 
 export type ViewId =
   | "home"
@@ -55,9 +56,10 @@ export const VIEW_PATHS: Record<ViewId, string> = {
  * The portal is mounted as a route-set under this base path inside the editor
  * app (see the admin-route seam). VIEW_PATHS stay expressed as logical portal
  * paths; this facade adds/strips the base so components keep navigating by
- * ViewId without knowing where the portal is mounted.
+ * ViewId without knowing where the portal is mounted. The constant lives in
+ * core so portal-free build flavors can reference the mount point too.
  */
-export const PORTAL_BASENAME = "/portal";
+export { PORTAL_BASENAME };
 
 /** Logical view path -> full app path (e.g. "/users" -> "/portal/users"). */
 export function toPortalPath(viewPath: string): string {
diff --git a/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx b/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx
new file mode 100644
index 0000000000..8e500a0c1a
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx
@@ -0,0 +1,28 @@
+import { useNavigate } from "react-router-dom";
+import { useMantineColorScheme } from "@mantine/core";
+import { useAuth } from "@app/auth/context";
+import { AppSwitch } from "@app/components/shared/AppSwitch";
+import { PORTAL_BASENAME } from "@app/routes/portalBasename";
+
+/**
+ * Sidebar app switcher between the editor and the admin portal. Both are
+ * route-sets of one SPA (the portal mounts at PORTAL_BASENAME), so switching
+ * is a client-side navigation. Hidden for users without portal access — they
+ * have nowhere to switch to. Renders the same AppSwitch element as the
+ * portal's sidebar.
+ */
+export function AppSwitcher() {
+  const { portalAccess } = useAuth();
+  const navigate = useNavigate();
+  const { colorScheme } = useMantineColorScheme();
+
+  if (!portalAccess) return null;
+
+  return (
+    <AppSwitch
+      current="editor"
+      theme={colorScheme === "dark" ? "dark" : "light"}
+      onSwitch={() => navigate(PORTAL_BASENAME)}
+    />
+  );
+}
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 707c411d14..99fa3bf55f 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -72,6 +72,7 @@ export default defineConfig(
     // Everything that contains 3rd party code that we don't want to lint
     ignores: [
       "dist",
+      "dist-portal",
       "node_modules",
       "playwright-report",
       "storybook-static",

From 8150d16b6f89a20b1ead03aa4b4dde4b3ce8a4dc Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 8 Jul 2026 13:47:11 +0100
Subject: [PATCH 26/35] Support bidirectional mapping for Change Metadata
 (#6906)

# Description of Changes
The Change Metadata tool was missed from the bidirectional mappings
added in #6867. This PR adds it to the list of supported tools.
---
 .../useChangeMetadataOperation.test.ts        |  86 ++++++++-
 .../useChangeMetadataOperation.ts             | 172 +++++++++++++-----
 .../tools/shared/migratedToolMappers.test.ts  |  32 +++-
 3 files changed, 234 insertions(+), 56 deletions(-)

diff --git a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.test.ts b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.test.ts
index 6444f5f05d..0a3bf0e78a 100644
--- a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.test.ts
@@ -1,5 +1,12 @@
-import { buildChangeMetadataFormData } from "@app/hooks/tools/changeMetadata/useChangeMetadataOperation";
-import { ChangeMetadataParameters } from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+import {
+  buildChangeMetadataFormData,
+  changeMetadataToApiParams,
+  changeMetadataFromApiParams,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataOperation";
+import {
+  ChangeMetadataParameters,
+  defaultParameters,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
 import { TrappedStatus } from "@app/types/metadata";
 import { describe, expect, test } from "vitest";
 
@@ -142,3 +149,78 @@ describe("buildChangeMetadataFormData", () => {
     expect(formData.get("allRequestParams[customValue1]")).toBe("Engineering");
   });
 });
+
+describe("changeMetadata mappers", () => {
+  const fullApi: Parameters<typeof changeMetadataFromApiParams>[0] = {
+    title: "Title",
+    author: "Author",
+    subject: "Subject",
+    keywords: "a, b",
+    creator: "Creator",
+    producer: "Producer",
+    creationDate: "2024/01/15 10:30:00",
+    modificationDate: "2024/02/20 14:05:09",
+    trapped: "True",
+    deleteAll: false,
+    allRequestParams: {
+      customKey1: "Department",
+      customValue1: "Engineering",
+      customKey2: "Project",
+      customValue2: "Falcon",
+    },
+  };
+
+  test("round-trips a full request through fromApiParams and back", () => {
+    const roundTripped = changeMetadataToApiParams({
+      ...defaultParameters,
+      ...changeMetadataFromApiParams(fullApi),
+    });
+
+    expect(roundTripped).toEqual(fullApi);
+  });
+
+  test("reconstructs dates in local time and clears absent ones", () => {
+    const params = changeMetadataFromApiParams(fullApi);
+    expect(params.creationDate).toEqual(new Date(2024, 0, 15, 10, 30, 0));
+    expect(params.modificationDate).toEqual(new Date(2024, 1, 20, 14, 5, 9));
+
+    const cleared = changeMetadataFromApiParams({
+      creationDate: "",
+      modificationDate: undefined,
+    });
+    expect(cleared.creationDate).toBeNull();
+    expect(cleared.modificationDate).toBeNull();
+  });
+
+  test.each([TrappedStatus.TRUE, TrappedStatus.FALSE, TrappedStatus.UNKNOWN])(
+    "round-trips trapped=%s",
+    (trapped) => {
+      const api = changeMetadataToApiParams({ ...defaultParameters, trapped });
+      expect(api.trapped).toBe(trapped);
+      expect(changeMetadataFromApiParams(api).trapped).toBe(trapped);
+    },
+  );
+
+  test("falls back to the default for an unrecognised trapped value", () => {
+    const params = changeMetadataFromApiParams({
+      trapped: "Bogus",
+    } as unknown as Parameters<typeof changeMetadataFromApiParams>[0]);
+    expect(params.trapped).toBe(defaultParameters.trapped);
+  });
+
+  test("reconstructs custom metadata, tolerating non-contiguous indices", () => {
+    const params = changeMetadataFromApiParams({
+      allRequestParams: {
+        customKey1: "Department",
+        customValue1: "Engineering",
+        customKey3: "Project",
+        customValue3: "Falcon",
+      },
+    });
+
+    expect(params.customMetadata).toEqual([
+      { key: "Department", value: "Engineering", id: "custom1" },
+      { key: "Project", value: "Falcon", id: "custom3" },
+    ]);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
index 6b0cd8b5d5..97a8285194 100644
--- a/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/changeMetadata/useChangeMetadataOperation.ts
@@ -3,13 +3,22 @@ import {
   useToolOperation,
   defineSingleFileTool,
 } from "@app/hooks/tools/shared/useToolOperation";
+import {
+  objectToFormData,
+  type ToolApiParams,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
 import { createStandardErrorHandler } from "@app/utils/toolErrorHandler";
+import { TrappedStatus, CustomMetadataEntry } from "@app/types/metadata";
 import {
   ChangeMetadataParameters,
   defaultParameters,
 } from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
 
-// Helper function to format Date object to string
+const ENDPOINT = "/api/v1/misc/update-metadata" satisfies ToolEndpoint;
+type ChangeMetadataApiParams = ToolApiParams[typeof ENDPOINT];
+
+// Backend date format (yyyy/MM/dd HH:mm:ss), in local time to mirror the parser.
 const formatDateForBackend = (date: Date | null): string => {
   if (!date) return "";
   const year = date.getFullYear();
@@ -21,64 +30,135 @@ const formatDateForBackend = (date: Date | null): string => {
   return `${year}/${month}/${day} ${hours}:${minutes}:${seconds}`;
 };
 
+// Inverse of formatDateForBackend; returns null for empty or unparseable input.
+const parseDateFromBackend = (value: string | undefined): Date | null => {
+  if (!value) return null;
+  const match = /^(\d{4})\/(\d{2})\/(\d{2}) (\d{2}):(\d{2}):(\d{2})$/.exec(
+    value,
+  );
+  if (!match) return null;
+  const [, year, month, day, hours, minutes, seconds] = match;
+  return new Date(
+    Number(year),
+    Number(month) - 1,
+    Number(day),
+    Number(hours),
+    Number(minutes),
+    Number(seconds),
+  );
+};
+
+// Custom metadata is carried in the request's allRequestParams map as paired
+// customKey<N>/customValue<N> entries; the backend rejoins them by the shared
+// index N (see MetadataController). Only entries with a non-blank key and value
+// are sent, and they are re-numbered from 1 so the indices stay contiguous.
+const buildCustomMetadataMap = (
+  customMetadata: CustomMetadataEntry[],
+): Record<string, string> | undefined => {
+  const validEntries = customMetadata.filter(
+    (entry) => entry.key.trim() && entry.value.trim(),
+  );
+  if (validEntries.length === 0) return undefined;
+
+  const map: Record<string, string> = {};
+  validEntries.forEach((entry, index) => {
+    const n = index + 1;
+    map[`customKey${n}`] = entry.key.trim();
+    map[`customValue${n}`] = entry.value.trim();
+  });
+  return map;
+};
+
+// Rebuild the UI's custom metadata list from the allRequestParams map by pairing
+// customKey<N>/customValue<N> on their shared index N. Mirrors the backend
+// (MetadataController), which pairs by index across all entries and does not
+// assume the indices are contiguous, so a non-contiguous stored map round-trips.
+const parseCustomMetadataMap = (
+  allRequestParams: ChangeMetadataApiParams["allRequestParams"],
+): CustomMetadataEntry[] => {
+  if (!allRequestParams) return [];
+  return Object.keys(allRequestParams)
+    .map((key) => /^customKey(\d+)$/.exec(key)?.[1])
+    .filter((n): n is string => n !== undefined)
+    .map(Number)
+    .sort((a, b) => a - b)
+    .map((n) => ({
+      key: allRequestParams[`customKey${n}`] ?? "",
+      value: allRequestParams[`customValue${n}`] ?? "",
+      id: `custom${n}`,
+    }));
+};
+
+// Map the backend's trapped string onto the UI enum, validating against the
+// actual enum values so an unrecognised value falls back to the default instead
+// of being force-cast.
+const parseTrapped = (value: string | undefined): TrappedStatus =>
+  Object.values(TrappedStatus).find((status) => status === value) ??
+  defaultParameters.trapped;
+
+// Convert the tool's UI parameters into the update-metadata request body. The
+// return type is the generated backend model, so a spec change that renames or
+// drops a field breaks the build here.
+export const changeMetadataToApiParams = (
+  parameters: ChangeMetadataParameters,
+): ChangeMetadataApiParams => ({
+  title: parameters.title,
+  author: parameters.author,
+  subject: parameters.subject,
+  keywords: parameters.keywords,
+  creator: parameters.creator,
+  producer: parameters.producer,
+  creationDate: formatDateForBackend(parameters.creationDate),
+  modificationDate: formatDateForBackend(parameters.modificationDate),
+  trapped: parameters.trapped,
+  deleteAll: parameters.deleteAll,
+  allRequestParams: buildCustomMetadataMap(parameters.customMetadata),
+});
+
+// Reconstruct the tool's UI parameters from an update-metadata request body, so
+// a stored or AI-authored step can be re-rendered in the settings UI.
+export const changeMetadataFromApiParams = (
+  apiParams: ChangeMetadataApiParams,
+): Partial<ChangeMetadataParameters> => ({
+  title: apiParams.title ?? defaultParameters.title,
+  author: apiParams.author ?? defaultParameters.author,
+  subject: apiParams.subject ?? defaultParameters.subject,
+  keywords: apiParams.keywords ?? defaultParameters.keywords,
+  creator: apiParams.creator ?? defaultParameters.creator,
+  producer: apiParams.producer ?? defaultParameters.producer,
+  creationDate: parseDateFromBackend(apiParams.creationDate),
+  modificationDate: parseDateFromBackend(apiParams.modificationDate),
+  trapped: parseTrapped(apiParams.trapped),
+  deleteAll: apiParams.deleteAll ?? defaultParameters.deleteAll,
+  customMetadata: parseCustomMetadataMap(apiParams.allRequestParams),
+});
+
 // Static function that can be used by both the hook and automation executor
 export const buildChangeMetadataFormData = (
   parameters: ChangeMetadataParameters,
   file: File,
 ): FormData => {
-  const formData = new FormData();
-  formData.append("fileInput", file);
-
-  // Standard metadata fields
-  formData.append("title", parameters.title || "");
-  formData.append("author", parameters.author || "");
-  formData.append("subject", parameters.subject || "");
-  formData.append("keywords", parameters.keywords || "");
-  formData.append("creator", parameters.creator || "");
-  formData.append("producer", parameters.producer || "");
-
-  // Date fields - convert Date objects to strings
-  formData.append(
-    "creationDate",
-    formatDateForBackend(parameters.creationDate),
-  );
-  formData.append(
-    "modificationDate",
-    formatDateForBackend(parameters.modificationDate),
-  );
-
-  // Trapped status
-  formData.append("trapped", parameters.trapped || "");
-
-  // Delete all metadata flag
-  formData.append("deleteAll", parameters.deleteAll.toString());
-
-  // Custom metadata - backend expects them as values to 'allRequestParams[customKeyX/customValueX]'
-  let keyNumber = 0;
-  if (parameters.customMetadata && Array.isArray(parameters.customMetadata)) {
-    parameters.customMetadata.forEach((entry) => {
-      if (entry.key.trim() && entry.value.trim()) {
-        keyNumber += 1;
-        formData.append(
-          `allRequestParams[customKey${keyNumber}]`,
-          entry.key.trim(),
-        );
-        formData.append(
-          `allRequestParams[customValue${keyNumber}]`,
-          entry.value.trim(),
-        );
-      }
-    });
+  // allRequestParams is a Spring-bound map: objectToFormData only serializes
+  // primitives, so the scalar fields go through it and the map is flattened into
+  // allRequestParams[<key>] form fields separately.
+  const { allRequestParams, ...scalarParams } =
+    changeMetadataToApiParams(parameters);
+  const formData = objectToFormData(scalarParams, { fileInput: file });
+  for (const [key, value] of Object.entries(allRequestParams ?? {})) {
+    if (value !== undefined) {
+      formData.append(`allRequestParams[${key}]`, value);
+    }
   }
-
   return formData;
 };
 
 // Static configuration object
 export const changeMetadataOperationConfig = defineSingleFileTool({
   buildFormData: buildChangeMetadataFormData,
+  toApiParams: changeMetadataToApiParams,
+  fromApiParams: changeMetadataFromApiParams,
   operationType: "changeMetadata",
-  endpoint: "/api/v1/misc/update-metadata",
+  endpoint: ENDPOINT,
   defaultParameters,
 });
 
diff --git a/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
index be81fd1884..d562384921 100644
--- a/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/migratedToolMappers.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, test } from "vitest";
-import { type RegistryToolOperationConfig } from "@app/hooks/tools/shared/toolOperationTypes";
+import {
+  ToolType,
+  type RegistryToolOperationConfig,
+} from "@app/hooks/tools/shared/toolOperationTypes";
 import { objectToFormData } from "@app/hooks/tools/shared/toolApiMapping";
 
 // Pilot tools.
@@ -17,6 +20,7 @@ import { adjustPageScaleOperationConfig } from "@app/hooks/tools/adjustPageScale
 import { autoRenameOperationConfig } from "@app/hooks/tools/autoRename/useAutoRenameOperation";
 import { bookletImpositionOperationConfig } from "@app/hooks/tools/bookletImposition/useBookletImpositionOperation";
 import { certSignOperationConfig } from "@app/hooks/tools/certSign/useCertSignOperation";
+import { changeMetadataOperationConfig } from "@app/hooks/tools/changeMetadata/useChangeMetadataOperation";
 import { changePermissionsOperationConfig } from "@app/hooks/tools/changePermissions/useChangePermissionsOperation";
 import { cropOperationConfig } from "@app/hooks/tools/crop/useCropOperation";
 import { editTableOfContentsOperationConfig } from "@app/hooks/tools/editTableOfContents/useEditTableOfContentsOperation";
@@ -57,6 +61,7 @@ const MIGRATED_CONFIGS = [
   autoRenameOperationConfig,
   bookletImpositionOperationConfig,
   certSignOperationConfig,
+  changeMetadataOperationConfig,
   changePermissionsOperationConfig,
   cropOperationConfig,
   editTableOfContentsOperationConfig,
@@ -102,15 +107,26 @@ describe("migrated tool mappers (sweep)", () => {
       expect(config.toApiParams).toBeDefined();
       expect(config.fromApiParams).toBeDefined();
 
-      // toApiParams(defaults) must produce a body objectToFormData can serialize
-      // (i.e. only primitives / arrays of primitives). A mapper that leaked a
-      // structured value would throw here.
+      // Serialize the defaults through the tool's own buildFormData - the real
+      // path the executor uses - so a tool whose toApiParams carries a structured
+      // field that buildFormData flattens itself (e.g. changeMetadata's
+      // allRequestParams map) is exercised too, not just tools whose mapper
+      // output is directly objectToFormData-able. Custom tools have no
+      // buildFormData, so fall back to serializing the mapper output directly.
       const params =
         config.defaultParameters ?? FALLBACK_PARAMS[config.operationType] ?? {};
-      const apiParams = config.toApiParams!(params);
-      expect(() =>
-        objectToFormData(apiParams, { fileInput: file }),
-      ).not.toThrow();
+      if (config.toolType === ToolType.multiFile) {
+        const build = config.buildFormData;
+        expect(() => build(params, [file])).not.toThrow();
+      } else if (config.toolType === ToolType.singleFile) {
+        const build = config.buildFormData;
+        expect(() => build(params, file)).not.toThrow();
+      } else {
+        const toApiParams = config.toApiParams!;
+        expect(() =>
+          objectToFormData(toApiParams(params), { fileInput: file }),
+        ).not.toThrow();
+      }
     },
   );
 });

From 0692058602b0df3597ef93239bd518eaee29b113 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:55:22 +0100
Subject: [PATCH 27/35] Embed admin portal as its own app in the jar behind
 buildWithPortal (#6911)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Lets the admin portal ("Stirling Processor") ship **inside the JAR**,
gated by a build flag. On `main` the portal already exists as a lazy
`/portal/*` route in the editor but isn't included in production builds
and isn't reachable in a login-enabled server. This PR makes it a
**flag-gated, directly-navigable** part of the editor bundle, and wires
it into the PR preview deployment so it can be tried live.

It keeps the exact architecture `main` uses (portal = a lazy chunk of
the editor, not a separate app), so it inherits all the editor's global
providers/styles and there's no second build to maintain.

## How

**Frontend - gate the existing lazy route**
([`adminRouteExtensions.tsx`](frontend/editor/src/proprietary/routes/adminRouteExtensions.tsx))
```ts
const includePortal = import.meta.env.VITE_INCLUDE_PORTAL === "true" || import.meta.env.DEV;
const PortalApp = includePortal ? lazy(() => import("@portal/PortalApp")) : null;
```
Vite bakes the env to a literal, so when off the dynamic import is
**tree-shaken out entirely** (no `PortalApp` chunk emitted). Always on
in dev. `VITE_INCLUDE_PORTAL` is typed in `vite-env.d.ts` and declared
(default `false`) in `editor/.env`.

**Gradle** ([`build.gradle`](app/core/build.gradle)) -
`-PbuildWithPortal=true` forces `buildWithFrontend=true` and sets
`VITE_INCLUDE_PORTAL=true` on the editor build. Process-env takes
priority over `.env`, so the flag wins for JAR builds while plain `vite
build` / Cloudflare Pages default to off.

**Backend - make the shell reachable**
([`RequestUriUtils`](app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java))
- permits `/portal` + `/portal/*` as public SPA routes. The editor keeps
its JWT in localStorage (not a cookie), so a direct nav/refresh to
`/portal` isn't authenticated at the server and would otherwise redirect
to `/login` and never load. Serving the shell pre-auth (like the editor
root already is) lets it load; **access control is unchanged** - the
portal has its own auth gate + `RequirePortalAccess`, and its data APIs
stay protected.

**Docker** - the embedded Dockerfiles take `ARG BUILD_PORTAL=false` →
`-PbuildWithPortal=${BUILD_PORTAL}`. Default off, so official
`push-docker` images do **not** bundle the portal.

**CI - scoped to the PR preview deploy only**
([`PR-Auto-Deploy-V2.yml`](.github/workflows/PR-Auto-Deploy-V2.yml)) -
the one job that builds the JAR and comments owns all portal wiring:
passes `BUILD_PORTAL=true`, enables the portal's backend features
(`POLICIES_ENABLED`, `STIRLING_BILLING_ACCOUNT_LINK_ENABLED`), and adds
an "Admin portal included" line (linking `/portal` via the direct IP) to
the deployment comment. `push-docker`, `build.yml`, `test-build-docker`,
and the shared paths-filter are untouched.

## Validation (real, in the JAR)

Built and booted the JAR with `-PbuildWithPortal=true` and login
enabled:
- `/portal` and `/portal/users` load via direct nav and render **fully
themed** (dark surfaces, gradients, filled buttons).
- Editor-only build (`-PbuildWithFrontend=true`, no portal flag) →
editor ships, **0 portal chunks** (tree-shaken).
- `-PbuildWithPortal=true` → `PortalApp` chunk present.

Green: `frontend:check:all` (typecheck all variants, lint, format,
build, tests incl. the `VITE_*` env guard), backend compile,
`RequestUriUtilsTest`, spotless.

## Notes

- **Official images never bundle the portal** (Dockerfile default off);
only the PR preview does. Flip `BUILD_PORTAL` / `-PbuildWithPortal` to
include it elsewhere.
- The `/portal` shell being public is the one deviation from `main`, and
it's required for the route to be reachable at all in a login-enabled
server; data access is still fully gated.
---
 .github/workflows/PR-Auto-Deploy-V2.yml       | 24 ++++++++++---
 .../software/common/util/RequestUriUtils.java |  9 +++++
 .../common/util/RequestUriUtilsTest.java      |  8 +++++
 app/core/build.gradle                         | 12 ++++++-
 docker/embedded/Dockerfile                    |  4 +++
 docker/embedded/Dockerfile.fat                |  3 ++
 docker/embedded/Dockerfile.ultra-lite         |  3 ++
 frontend/editor/.env                          |  4 +++
 .../routes/adminRouteExtensions.tsx           | 34 +++++++++++++------
 frontend/editor/vite-env.d.ts                 |  2 ++
 10 files changed, 87 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/PR-Auto-Deploy-V2.yml b/.github/workflows/PR-Auto-Deploy-V2.yml
index b6ab8d34c8..31135cfb4b 100644
--- a/.github/workflows/PR-Auto-Deploy-V2.yml
+++ b/.github/workflows/PR-Auto-Deploy-V2.yml
@@ -116,6 +116,9 @@ jobs:
     env:
       USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+      # Single source of truth for whether this preview embeds the admin portal:
+      # drives the image build-arg and the deployment comment.
+      BUILD_PORTAL: "true"
 
     steps:
       - name: Harden Runner
@@ -246,7 +249,9 @@ jobs:
           file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: VERSION_TAG=v2-alpha
+          build-args: |
+            VERSION_TAG=v2-alpha
+            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
           platforms: linux/amd64
 
       - name: Build and push V2 image (Docker fork fallback)
@@ -259,7 +264,9 @@ jobs:
           cache-from: type=gha,scope=stirling-pdf-latest
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: VERSION_TAG=v2-alpha
+          build-args: |
+            VERSION_TAG=v2-alpha
+            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
           platforms: linux/amd64
 
       - name: Set up SSH
@@ -290,6 +297,8 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
+                POLICIES_ENABLED: "true"
+                STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                 SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
@@ -359,12 +368,19 @@ jobs:
             }
 
             const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
-            const httpsUrl = `https://${v2Port}.ssl.stirlingpdf.cloud`;
+
+            // Only mention the portal when this image actually embeds it.
+            // Use the direct IP URL - the SSL hostname isn't supported yet.
+            const withPortal = "${{ env.BUILD_PORTAL }}" === "true";
+            const portalNote = withPortal
+              ? `🧩 **Admin portal** included - try it at [${deploymentUrl}/portal](${deploymentUrl}/portal).\n\n`
+              : ``;
 
             const commentBody = `## 🚀 V2 Auto-Deployment Complete!\n\n` +
                               `Your V2 PR with embedded architecture has been deployed!\n\n` +
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
-                              `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
+                              `🔐 **Secure HTTPS URL**: unsupported currently\n\n` +
+                              portalNote +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
                               `🔄 **Auto-deployed** for approved V2 contributors.`;
 
diff --git a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
index 74c713b6db..faf71c2f97 100644
--- a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
+++ b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
@@ -57,6 +57,15 @@ public class RequestUriUtils {
             return true;
         }
 
+        // Admin portal SPA shell. Served publicly like the editor root so a direct
+        // nav / refresh to /portal loads the app (the JWT lives in localStorage, not
+        // a cookie, so the server can't authenticate the navigation itself). The
+        // portal gates access via its own auth gate + RequirePortalAccess, and its
+        // data APIs stay protected, so serving the shell pre-auth is safe.
+        if (normalizedUri.equals("/portal") || normalizedUri.startsWith("/portal/")) {
+            return true;
+        }
+
         // Treat common static file extensions as static resources
         return normalizedUri.endsWith(".svg")
                 || normalizedUri.endsWith(".png")
diff --git a/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java b/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
index 4f0f3e372a..a13aeac82b 100644
--- a/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
+++ b/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
@@ -73,6 +73,14 @@ class RequestUriUtilsTest {
         assertTrue(RequestUriUtils.isStaticResource("/mobile-scanner"));
     }
 
+    @Test
+    void testIsStaticResource_portalShell() {
+        // The admin portal SPA shell is served pre-auth so it's directly navigable.
+        assertTrue(RequestUriUtils.isStaticResource("/portal"));
+        assertTrue(RequestUriUtils.isStaticResource("/portal/users"));
+        assertTrue(RequestUriUtils.isStaticResource("/app", "/app/portal"));
+    }
+
     // --- isFrontendRoute tests ---
 
     @Test
diff --git a/app/core/build.gradle b/app/core/build.gradle
index d77fbdd438..6a55d89304 100644
--- a/app/core/build.gradle
+++ b/app/core/build.gradle
@@ -175,6 +175,14 @@ springBoot {
 // Frontend build tasks - only enabled with -PbuildWithFrontend=true
 def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
 def buildPrototypes = project.hasProperty('prototypesMode') && project.property('prototypesMode') == 'true'
+// The admin portal ships as a lazy route inside the editor bundle (see
+// proprietary/routes/adminRouteExtensions). -PbuildWithPortal=true includes that
+// chunk via VITE_INCLUDE_PORTAL on the editor build; the deploy GHA sets it when
+// the portal or AI layers change. Building the portal implies building the editor.
+def buildWithPortal = project.hasProperty('buildWithPortal') && project.property('buildWithPortal') == 'true'
+if (buildWithPortal) {
+    buildWithFrontend = true
+}
 // Workspace root holds package.json and node_modules (shared across editor /
 // future portal). Editor-specific paths (src, public, dist, tauri) live one
 // level deeper under frontend/editor/.
@@ -297,9 +305,11 @@ tasks.register('npmBuild', Exec) {
     // Override VITE_API_BASE_URL to use relative paths for production builds
     // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
     environment 'VITE_API_BASE_URL', '/'
+    // Include the admin portal's lazy route/chunk in the editor build when requested.
+    environment 'VITE_INCLUDE_PORTAL', (buildWithPortal ? 'true' : 'false')
 
     doFirst {
-        println "Building editor frontend application for production (mode=${frontendMode}, VITE_API_BASE_URL=/)"
+        println "Building editor frontend application for production (mode=${frontendMode}, VITE_API_BASE_URL=/, portal=${buildWithPortal})"
     }
 }
 
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index 7ea8201f59..760b728f34 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -42,6 +42,9 @@ COPY . .
 ARG PROTOTYPES_BUILD=false
 ARG STIRLING_FLAVOR=proprietary
 ENV STIRLING_FLAVOR=${STIRLING_FLAVOR}
+# Embed the admin portal app at /portal. Set true by the deploy workflow when the
+# portal or AI layers change; defaults false so normal builds skip the extra app.
+ARG BUILD_PORTAL=false
 
 # Bundle only the JPDFium native for this image's target arch.
 ARG TARGETARCH
@@ -49,6 +52,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
     STIRLING_FLAVOR=${STIRLING_FLAVOR} \
     gradle clean build \
       -PbuildWithFrontend=true \
+      -PbuildWithPortal=${BUILD_PORTAL} \
       -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -PprototypesMode=${PROTOTYPES_BUILD} \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index 71f2a12414..32219b6bd3 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -40,12 +40,15 @@ RUN gradle dependencies --no-daemon || true
 
 COPY . .
 
+# Embed the admin portal app at /portal when the deploy workflow flags it.
+ARG BUILD_PORTAL=false
 # Bundle only the JPDFium native for this image's target arch.
 ARG TARGETARCH
 RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
     DISABLE_ADDITIONAL_FEATURES=false \
     gradle clean build \
       -PbuildWithFrontend=true \
+      -PbuildWithPortal=${BUILD_PORTAL} \
       -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index 01048e864d..bdaa788785 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -40,12 +40,15 @@ RUN ./gradlew dependencies --no-daemon || true
 COPY . .
 
 # Build ultra-lite JAR with embedded frontend (minimal features).
+# Embed the admin portal app at /portal when the deploy workflow flags it.
+ARG BUILD_PORTAL=false
 # Bundle only the JPDFium native for this image's target arch.
 ARG TARGETARCH
 RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
     DISABLE_ADDITIONAL_FEATURES=true \
     ./gradlew clean build \
       -PbuildWithFrontend=true \
+      -PbuildWithPortal=${BUILD_PORTAL} \
       -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
diff --git a/frontend/editor/.env b/frontend/editor/.env
index f8f3c2e308..961da5d840 100644
--- a/frontend/editor/.env
+++ b/frontend/editor/.env
@@ -7,6 +7,10 @@
 # API base URL — use / for same-origin (default for web builds)
 VITE_API_BASE_URL=/
 
+# Include the admin portal's lazy route/chunk in the build (set true by
+# -PbuildWithPortal in the JAR). Off by default; always on in dev.
+VITE_INCLUDE_PORTAL=false
+
 # Google Drive integration
 VITE_GOOGLE_DRIVE_CLIENT_ID=
 VITE_GOOGLE_DRIVE_API_KEY=
diff --git a/frontend/editor/src/proprietary/routes/adminRouteExtensions.tsx b/frontend/editor/src/proprietary/routes/adminRouteExtensions.tsx
index c0216e377f..89676d2d29 100644
--- a/frontend/editor/src/proprietary/routes/adminRouteExtensions.tsx
+++ b/frontend/editor/src/proprietary/routes/adminRouteExtensions.tsx
@@ -2,22 +2,34 @@ import { lazy } from "react";
 import type { ReactElement } from "react";
 import { Route } from "react-router-dom";
 
-// Lazy so the portal is its own chunk, never in the editor's initial bundle;
-// only fetched when an admin navigates to /portal. Mocks start first so the
-// worker is ready before the portal's first fetch.
-const PortalApp = lazy(async () => {
-  const { startPortalMocksIfEnabled } =
-    await import("@portal/mocks/startIfEnabled");
-  await startPortalMocksIfEnabled();
-  const m = await import("@portal/PortalApp");
-  return { default: m.PortalApp };
-});
+// The portal ships as a lazy chunk of the editor. It's included in dev (so it's
+// always available to work on) and in production builds made with
+// VITE_INCLUDE_PORTAL=true (set by -PbuildWithPortal in the JAR, and by the deploy
+// GHA when the portal or AI layers change). Vite replaces the env with a literal at
+// build time, so when it's off the dynamic import below is tree-shaken out and the
+// portal chunk isn't emitted. PortalApp stays module-level so it isn't recreated on
+// each render. Mocks start first so the worker is ready before the portal's first
+// fetch.
+const includePortal =
+  import.meta.env.VITE_INCLUDE_PORTAL === "true" || import.meta.env.DEV;
+
+const PortalApp = includePortal
+  ? lazy(async () => {
+      const { startPortalMocksIfEnabled } =
+        await import("@portal/mocks/startIfEnabled");
+      await startPortalMocksIfEnabled();
+      const m = await import("@portal/PortalApp");
+      return { default: m.PortalApp };
+    })
+  : null;
 
 /**
  * The portal mounts as an admin-only route-set at /portal/*. Access is gated
  * inside PortalApp (its own AuthProvider + AuthGate, plus server enforcement),
- * so this just wires the lazy route into the editor's router.
+ * so this just wires the lazy route into the editor's router when the portal is
+ * included in this build.
  */
 export function getAdminRouteExtensions(): ReactElement[] {
+  if (!PortalApp) return [];
   return [<Route key="portal" path="/portal/*" element={<PortalApp />} />];
 }
diff --git a/frontend/editor/vite-env.d.ts b/frontend/editor/vite-env.d.ts
index d26c3bceb9..f690cf1b3e 100644
--- a/frontend/editor/vite-env.d.ts
+++ b/frontend/editor/vite-env.d.ts
@@ -3,6 +3,8 @@
 interface ImportMetaEnv {
   // Used by all builds (.env)
   readonly VITE_API_BASE_URL: string;
+  /** "true" includes the admin portal's lazy route/chunk in the editor build. */
+  readonly VITE_INCLUDE_PORTAL: string;
   readonly VITE_GOOGLE_DRIVE_CLIENT_ID: string;
   readonly VITE_GOOGLE_DRIVE_API_KEY: string;
   readonly VITE_GOOGLE_DRIVE_APP_ID: string;

From a8bda9240c73b65cb421bd7fe74e65c67e8e6602 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 14:44:30 +0100
Subject: [PATCH 28/35] feat(portal): replace free-tier carousel with static
 welcome hero (#6901)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What this PR does

Redesigns the portal home to match the marketing demo, across all tiers.

- Swapped the old rotating welcome carousel for a static **welcome
hero** on the free tier
- Subscribed (Processor) + enterprise get a **deployed-editor hero** —
shows the live instance (host, version, active users) with an *Open in
browser* button, pulled from the real editor-deployment API (same data
the Editor admin page uses)
- Added a time-of-day **greeting** on the paid tiers
- Rebuilt the **"Finish setting up" checklist** so it's real: the counts
and tick-offs come from the actual policies + sources (a step is done
when there's at least one), not hardcoded numbers
- *Download the PDF Editor* → `https://stirling.com/download`; the other
steps deep-link to Policies / Sources
- **Procurement is now a bolt-on to any tier** — if a deal's in flight
the deal-status hero drops into the hero's footer, otherwise you get the
setup checklist
- All new copy is translated (en-US) and it reuses the shared UI kit,
icons and design tokens

## Tidy-ups / fixes found along the way
- The subscribed hero was shadowing the real `/v1/editor/deployment`
endpoint (broke the Editor admin page) — now reuses it
- Renamed the hero's CSS namespace to `.portal-welcome` so it stops
clashing with the procurement hero's `.portal-hero`
- Refactored the merged procurement component into a shared
`useProcurement` hook + banner + flow, so the deal hero can live inside
the tier hero — `/procurement` route unchanged

## Screenshots

<img width="1258" height="1338" alt="pr-free"
src="https://github.com/user-attachments/assets/9bb7db44-5f8e-4388-857a-7f113c2d7d82"
/>

<img width="1258" height="862" alt="pr-enterprise"
src="https://github.com/user-attachments/assets/f1f36faa-1467-404e-9036-dab12e3d0b54"
/>

<img width="1258" height="944" alt="pr-subscribed"
src="https://github.com/user-attachments/assets/775f1228-f182-47b5-82ff-7ac6d5932bd9"
/>

---

## Checklist

### General
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### UI Changes
- [x] Screenshots demonstrating the UI changes are attached

### Testing
- [x] Portal typecheck, ESLint and Prettier pass on the changed files
- [x] Verified all states in Storybook and ran the app locally via `task
dev:portal`
---
 .../public/locales/en-US/translation.toml     |  87 ++--
 frontend/editor/src/portal/MOCKS.md           |   1 -
 frontend/editor/src/portal/api/home.ts        |   7 -
 .../portal/components/EditorStatusCard.css    | 118 +++++
 .../components/EditorStatusCard.stories.tsx   |  50 ++
 .../portal/components/EditorStatusCard.tsx    | 194 ++++++++
 .../src/portal/components/HomeGreeting.tsx    |  30 ++
 .../editor/src/portal/components/HomeHero.tsx |  42 ++
 .../src/portal/components/SetupChecklist.css  | 188 +++++++
 .../components/SetupChecklist.stories.tsx     |  58 +++
 .../src/portal/components/SetupChecklist.tsx  | 218 +++++++++
 .../src/portal/components/WelcomeBanner.css   | 461 ++++++++++++++++++
 .../components/WelcomeBanner.stories.tsx      |  29 ++
 .../src/portal/components/WelcomeBanner.tsx   | 183 +++++++
 .../src/portal/components/WelcomeCarousel.css | 234 ---------
 .../components/WelcomeCarousel.stories.tsx    |  20 -
 .../src/portal/components/WelcomeCarousel.tsx | 232 ---------
 .../editor/src/portal/components/icons.tsx    |  31 ++
 .../procurement/ProcurementBanner.tsx         |  79 +++
 .../procurement/ProcurementFlow.tsx           | 181 +++++++
 .../procurement/ProcurementHome.tsx           | 298 +----------
 .../components/procurement/useProcurement.ts  | 179 +++++++
 .../editor/src/portal/mocks/editorDeploy.ts   |   3 +
 .../editor/src/portal/mocks/handlers/home.ts  |   6 -
 frontend/editor/src/portal/mocks/home.ts      |  42 +-
 frontend/editor/src/portal/views/Home.css     | 101 +---
 .../editor/src/portal/views/Home.stories.tsx  |  26 +
 frontend/editor/src/portal/views/Home.tsx     | 133 +----
 frontend/eslint.config.mjs                    |  14 +
 29 files changed, 2176 insertions(+), 1069 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/EditorStatusCard.css
 create mode 100644 frontend/editor/src/portal/components/EditorStatusCard.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/EditorStatusCard.tsx
 create mode 100644 frontend/editor/src/portal/components/HomeGreeting.tsx
 create mode 100644 frontend/editor/src/portal/components/HomeHero.tsx
 create mode 100644 frontend/editor/src/portal/components/SetupChecklist.css
 create mode 100644 frontend/editor/src/portal/components/SetupChecklist.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/SetupChecklist.tsx
 create mode 100644 frontend/editor/src/portal/components/WelcomeBanner.css
 create mode 100644 frontend/editor/src/portal/components/WelcomeBanner.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/WelcomeBanner.tsx
 delete mode 100644 frontend/editor/src/portal/components/WelcomeCarousel.css
 delete mode 100644 frontend/editor/src/portal/components/WelcomeCarousel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/WelcomeCarousel.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/useProcurement.ts

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 31ee42a8a2..55397ccb9e 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6739,6 +6739,23 @@ ready = "Ready to deploy"
 description = "Once documents are processed, your 30-day usage appears here."
 title = "No usage yet"
 
+[portal.home.editor]
+activeUsers = "{{n}} active"
+invite = "Invite teammates"
+name = "Stirling PDF Editor"
+open = "Open in browser"
+updated = "updated {{time}}"
+
+[portal.home.editor.target]
+cloud = "Managed Cloud"
+docker = "Self-hosted · Docker"
+kubernetes = "Self-hosted · Kubernetes"
+
+[portal.home.greeting]
+afternoon = "Good afternoon"
+evening = "Good evening"
+morning = "Good morning"
+
 [portal.home.kpis.enterprise]
 docs30d = "Docs / 30d"
 evalPassRate = "Eval pass rate"
@@ -6759,15 +6776,31 @@ evalPassRate = "Eval pass rate"
 pipelines = "Pipelines"
 
 [portal.home.onboarding]
-progress = "{{done}} / {{total}} done"
-runAgain = "Run again"
-start = "Start"
-subtitle = "Four steps to a production-shaped Stirling project."
-title = "Get to value"
+dismiss = "Dismiss setup"
+notStarted = "Not started"
+progress = "{{done}} of {{total}} done"
+title = "Finish setting up"
 
-[portal.home.onboarding.empty]
-description = "Onboarding tasks will appear here once your workspace is set up."
-title = "No onboarding steps yet"
+[portal.home.onboarding.enterprise]
+body = "Org-wide SSO + SCIM + RBAC, committed volume pricing, and air-gapped deployment."
+cta = "Start Trial"
+ctaQuote = "Get Quote"
+lead = "For 250+ employees."
+tag = "Enterprise"
+
+[portal.home.onboarding.steps.editor]
+blurb = "Deploy the desktop app, free forever."
+title = "Download the PDF Editor"
+
+[portal.home.onboarding.steps.policies]
+blurb = "{{active}} active · {{recommended}} recommended"
+chip = "{{active}} active"
+title = "Turn on policies"
+
+[portal.home.onboarding.steps.sources]
+blurb = "{{connected}} connected · every PDF governed where it lands"
+chip = "{{connected}} connected"
+title = "Connect your sources"
 
 [portal.home.productGrid]
 ariaLabel = "Process PDFs at scale"
@@ -8015,36 +8048,14 @@ status = "Status"
 suspend = "Suspend"
 
 [portal.welcome]
-ariaLabel = "Stirling product highlights"
-pagination = "Carousel pagination"
-slideLabel = "Slide {{number}}: {{title}}"
-
-[portal.welcome.ornament.editor]
-critical = "Critical"
-ocrClean = "OCR-clean"
-schemaMatch = "schema match 0.97"
-signed = "signed"
-
-[portal.welcome.slides.agents]
-eyebrow = "AI Agents"
-primary = "Try PDF Processor"
-secondary = "View MCP docs"
-sub = "Wire your agent via MCP, REST or tool definitions. Deterministic operations and guardrails — test with scenarios and evals before you ship."
-title = "PDF Processor for AI Agents"
-
-[portal.welcome.slides.editor]
-eyebrow = "PDF Editor"
-primary = "Install PDF Editor"
-secondary = "Connect an instance"
-sub = "Annotate, sign, redact, and review locally or in the cloud. Brought to the platform as the credibility anchor of the Stirling control plane."
-title = "The #1 PDF Editor on GitHub"
-
-[portal.welcome.slides.platform]
-eyebrow = "Platform"
-primary = "Try a PDF operation"
-secondary = "Get an API key"
-sub = "Ingest from agents, APIs and connectors. Run composable pipelines with evals and golden sets. Land in a vault with zero-standing-access controls."
-title = "PDF Infrastructure for Developers"
+ariaLabel = "Welcome to Stirling PDF"
+badge = "Open-source"
+installEditor = "Install the Editor"
+inviteTeammates = "Invite teammates"
+perks = "Free forever · Self-hostable"
+subtitle = "The world's most secure PDF Editor is free for teams of all sizes. Includes 60+ PDF operations and SSO."
+title = "Welcome to"
+titleAccent = "Stirling PDF"
 
 [printFile]
 title = "Print File"
diff --git a/frontend/editor/src/portal/MOCKS.md b/frontend/editor/src/portal/MOCKS.md
index 17d6c68d55..0cd41ee9a8 100644
--- a/frontend/editor/src/portal/MOCKS.md
+++ b/frontend/editor/src/portal/MOCKS.md
@@ -52,7 +52,6 @@ non-2xx). Views consume via `useAsync()` + `useSectionFlags()` (`hooks/useAsync.
 | Home | `GET /v1/analytics/usage` | — | `fetchUsageSeries` | `UsageSeriesResponse` |
 | Home | `GET /v1/activity` | — | `fetchRecentActivity` | `ActivityEvent[]` |
 | Home | `GET /v1/regions/health` | — | `fetchRegionHealth` | `RegionHealth[]` |
-| Home | `GET /v1/onboarding` | — | `fetchOnboarding` | `OnboardingStep[]` |
 | Users | `GET /v1/users` | `tier` | `fetchUsers` | `UsersResponse` |
 | Documents | `GET /v1/documents` | `tier` | `fetchDocuments` | `DocumentsResponse` |
 | Pipelines | `GET /v1/pipelines` · `POST /v1/pipelines/:id/promote-to-policy` | `tier` | `fetchPipelines` · `promoteToPolicy` | `PipelinesResponse` |
diff --git a/frontend/editor/src/portal/api/home.ts b/frontend/editor/src/portal/api/home.ts
index e7ddfea910..467fd6a66a 100644
--- a/frontend/editor/src/portal/api/home.ts
+++ b/frontend/editor/src/portal/api/home.ts
@@ -2,7 +2,6 @@ import { apiClient } from "@portal/api/http";
 import type {
   ActivityEvent,
   KpiEntry,
-  OnboardingStep,
   RegionHealth,
   UsageSeriesResponse,
 } from "@portal/mocks/home";
@@ -12,7 +11,6 @@ export type {
   ActivityEvent,
   ActivityKind,
   KpiEntry,
-  OnboardingStep,
   PipelineStage,
   PipelineTemplate,
   RegionHealth,
@@ -44,8 +42,3 @@ export async function fetchHomeKpis(tier: Tier): Promise<KpiEntry[]> {
 export async function fetchRegionHealth(): Promise<RegionHealth[]> {
   return apiClient.local.json<RegionHealth[]>("/v1/regions/health");
 }
-
-/** GET /v1/onboarding (Free) */
-export async function fetchOnboarding(): Promise<OnboardingStep[]> {
-  return apiClient.local.json<OnboardingStep[]>("/v1/onboarding");
-}
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.css b/frontend/editor/src/portal/components/EditorStatusCard.css
new file mode 100644
index 0000000000..313d283d6a
--- /dev/null
+++ b/frontend/editor/src/portal/components/EditorStatusCard.css
@@ -0,0 +1,118 @@
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Subscribed-tier deployed-Editor hero                                     */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+.portal-editor-hero {
+  border-radius: var(--radius-xl);
+  border: 1px solid var(--color-border-input);
+  background: var(--color-surface);
+  box-shadow: var(--shadow-sm);
+  overflow: hidden;
+}
+
+.portal-editor-hero__row {
+  display: flex;
+  align-items: center;
+  gap: 1.25rem;
+  padding: 1.25rem 1.5rem;
+}
+
+.portal-editor-hero__logo {
+  width: 3.5rem;
+  height: 3.5rem;
+  border-radius: 0.875rem;
+  overflow: hidden;
+  flex-shrink: 0;
+  box-shadow:
+    0 2px 8px rgba(0, 0, 0, 0.1),
+    0 0 0 1px rgba(0, 0, 0, 0.06);
+}
+.portal-editor-hero__mark {
+  width: 100%;
+  height: 100%;
+  display: block;
+}
+
+.portal-editor-hero__info {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.portal-editor-hero__title-row {
+  display: flex;
+  align-items: center;
+  gap: 0.5625rem;
+  flex-wrap: wrap;
+}
+
+.portal-editor-hero__name {
+  font-size: 1.125rem;
+  font-weight: 700;
+  color: var(--color-text-1);
+  margin-right: 0.125rem;
+}
+
+.portal-editor-hero__chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3125rem;
+  padding: 0.3125rem 0.75rem;
+  border-radius: var(--radius-pill);
+  border: 1px solid var(--color-border-input);
+  background: var(--color-bg-code);
+  color: var(--color-text-2);
+  font-size: 0.71875rem;
+  font-weight: 600;
+  cursor: pointer;
+  box-shadow: 0 1px 2px rgba(15, 23, 42, 0.06);
+  transition:
+    background var(--motion-fast),
+    box-shadow var(--motion-fast),
+    transform var(--motion-fast);
+}
+.portal-editor-hero__chip:hover {
+  background: var(--color-surface);
+  box-shadow: 0 2px 5px rgba(15, 23, 42, 0.1);
+  transform: translateY(-1px);
+}
+.portal-editor-hero__chip svg {
+  color: var(--color-text-4);
+}
+
+.portal-editor-hero__meta {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  font-size: 0.75rem;
+  color: var(--color-text-5);
+}
+.portal-editor-hero__host {
+  color: var(--color-text-2);
+  font-family: var(--font-mono);
+  font-weight: 500;
+}
+.portal-editor-hero__meta-sep {
+  color: var(--color-border-input);
+}
+
+.portal-editor-hero__action {
+  flex-shrink: 0;
+}
+
+@media (max-width: 48rem) {
+  .portal-editor-hero__row {
+    flex-wrap: wrap;
+  }
+  .portal-editor-hero__action {
+    width: 100%;
+  }
+}
+
+/* Attached footer strip (setup checklist). */
+.portal-editor-hero__footer {
+  border-top: 1px solid var(--color-border-light);
+}
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.stories.tsx b/frontend/editor/src/portal/components/EditorStatusCard.stories.tsx
new file mode 100644
index 0000000000..84126547eb
--- /dev/null
+++ b/frontend/editor/src/portal/components/EditorStatusCard.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { EditorStatusCard } from "@portal/components/EditorStatusCard";
+import { SetupChecklist } from "@portal/components/SetupChecklist";
+
+const meta: Meta<typeof EditorStatusCard> = {
+  title: "Portal/Home/EditorStatusCard",
+  component: EditorStatusCard,
+  parameters: { layout: "padded" },
+  globals: { tier: "pro" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "72rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof EditorStatusCard>;
+
+/** The deployed-Editor status card on its own. */
+export const Default: Story = {};
+
+/** As it renders on the subscribed home: the setup checklist attached as the footer. */
+export const WithSetupChecklist: Story = {
+  args: {
+    footer: <SetupChecklist />,
+  },
+};
+
+/**
+ * Backend without the editor-deployment endpoint (404): the status row is
+ * skipped and the card falls back to just the footer (setup checklist). It
+ * lights up automatically once /v1/editor/deployment is served.
+ */
+export const DeploymentUnavailable: Story = {
+  args: {
+    footer: <SetupChecklist />,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/v1/editor/deployment", () =>
+          HttpResponse.json({ message: "not found" }, { status: 404 }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.tsx b/frontend/editor/src/portal/components/EditorStatusCard.tsx
new file mode 100644
index 0000000000..9c97041260
--- /dev/null
+++ b/frontend/editor/src/portal/components/EditorStatusCard.tsx
@@ -0,0 +1,194 @@
+import type { ReactNode } from "react";
+import { Fragment, useMemo } from "react";
+import { useTranslation } from "react-i18next";
+import { Button, Skeleton } from "@app/ui";
+import { useTier } from "@portal/contexts/TierContext";
+import { useView } from "@portal/contexts/ViewContext";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  fetchEditorDeployment,
+  type EditorDeploymentResponse,
+  type EditorInstance,
+} from "@portal/api/editorDeploy";
+import {
+  ExternalLinkIcon,
+  UsersIcon,
+  UserPlusIcon,
+} from "@portal/components/icons";
+import "@portal/components/EditorStatusCard.css";
+
+/** The Stirling brand mark, drawn at the hero size. Decorative. */
+function StirlingMark() {
+  return (
+    <svg
+      className="portal-editor-hero__mark"
+      viewBox="0 0 256 256"
+      fill="none"
+      aria-hidden
+    >
+      <rect width="256" height="256" rx="58" fill="#8E3131" />
+      <path
+        d="M39.2638 127.834L155.374 32L155.375 121.499L39.2638 217.333L39.2638 127.834Z"
+        fill="white"
+      />
+      <path
+        d="M159 124.5L159 88.5L216.728 38.4472L216.728 128.052L100.479 224L100.479 172L159 124.5Z"
+        fill="white"
+        fillOpacity="0.6"
+      />
+    </svg>
+  );
+}
+
+/** The instance to headline: the busiest healthy one, else the first. */
+function primaryInstance(instances: EditorInstance[]): EditorInstance | null {
+  if (instances.length === 0) return null;
+  const healthy = instances.filter((i) => i.status === "healthy");
+  const pool = healthy.length > 0 ? healthy : instances;
+  return pool.reduce((best, i) =>
+    i.activeUsers > best.activeUsers ? i : best,
+  );
+}
+
+interface EditorStatusCardProps {
+  /**
+   * Rendered as an attached footer strip inside the card (e.g. the "Finish
+   * setting up" checklist), matching the free-tier hero's footer seam.
+   */
+  footer?: ReactNode;
+  /**
+   * Hide the active-users / invite chips. Used on enterprise, where the
+   * attached procurement deal hero already owns the invite action.
+   */
+  hideChips?: boolean;
+}
+
+/**
+ * Subscribed/enterprise home hero: a status card for the org's deployed PDF
+ * Editor. Reads the same `/v1/editor/deployment` data as the Editor admin view
+ * (host, version, live users, deployment shape) and headlines the busiest
+ * instance, with a single "Open in browser" action to the workspace URL.
+ */
+export function EditorStatusCard({ footer, hideChips }: EditorStatusCardProps) {
+  const { t } = useTranslation();
+  const { tier } = useTier();
+  const { setActiveView } = useView();
+  const { data, loading } = useAsync<EditorDeploymentResponse>(
+    () => fetchEditorDeployment(tier),
+    [tier],
+  );
+
+  const view = useMemo(() => {
+    if (!data) return null;
+    const primary = primaryInstance(data.instances);
+    if (!primary) return null;
+    const activeUsers = data.instances.reduce((s, i) => s + i.activeUsers, 0);
+    const targetLabel = t(`portal.home.editor.target.${primary.target}`);
+    return {
+      host: primary.host,
+      activeUsers,
+      workspaceUrl: data.summary.workspaceUrl,
+      meta: [
+        // Skip the deployment label when it just repeats the host (e.g. the
+        // managed-cloud instance is literally named "Managed Cloud").
+        primary.host === targetLabel ? null : targetLabel,
+        primary.region,
+        `v${primary.version}`,
+        t("portal.home.editor.updated", { time: primary.lastSeen }),
+      ].filter(Boolean) as string[],
+    };
+  }, [data, t]);
+
+  const ready = !loading && !!view;
+  // The editor-deployment endpoint isn't implemented on every backend yet.
+  // When it's unavailable (finished loading with no data — e.g. a 404), skip
+  // the status row entirely and fall back to just the footer (the setup
+  // checklist, which reads supported endpoints). It lights up automatically
+  // once the backend serves /v1/editor/deployment.
+  const unavailable = !loading && !view;
+
+  if (unavailable) {
+    return footer ? (
+      <section className="portal-editor-hero portal-editor-hero--footer-only">
+        {footer}
+      </section>
+    ) : null;
+  }
+
+  return (
+    <section
+      className="portal-editor-hero"
+      aria-label={t("portal.home.editor.name")}
+    >
+      <div className="portal-editor-hero__row">
+        <div className="portal-editor-hero__logo">
+          <StirlingMark />
+        </div>
+
+        <div className="portal-editor-hero__info">
+          {!ready || !view ? (
+            <>
+              <Skeleton width="12rem" height="1.25rem" />
+              <Skeleton width="22rem" height="0.75rem" />
+            </>
+          ) : (
+            <>
+              <div className="portal-editor-hero__title-row">
+                <span className="portal-editor-hero__name">
+                  {t("portal.home.editor.name")}
+                </span>
+                {!hideChips && (
+                  <>
+                    <button
+                      type="button"
+                      className="portal-editor-hero__chip"
+                      onClick={() => setActiveView("users")}
+                    >
+                      <UsersIcon size={13} />
+                      {t("portal.home.editor.activeUsers", {
+                        n: view.activeUsers,
+                      })}
+                    </button>
+                    <button
+                      type="button"
+                      className="portal-editor-hero__chip"
+                      onClick={() => setActiveView("users")}
+                    >
+                      <UserPlusIcon size={13} />
+                      {t("portal.home.editor.invite")}
+                    </button>
+                  </>
+                )}
+              </div>
+              <div className="portal-editor-hero__meta">
+                <span className="portal-editor-hero__host">{view.host}</span>
+                {view.meta.map((item, i) => (
+                  <Fragment key={i}>
+                    <span className="portal-editor-hero__meta-sep">·</span>
+                    <span>{item}</span>
+                  </Fragment>
+                ))}
+              </div>
+            </>
+          )}
+        </div>
+
+        <div className="portal-editor-hero__action">
+          <Button
+            variant="primary"
+            leftSection={<ExternalLinkIcon size={13} />}
+            disabled={!ready || !view}
+            onClick={() => {
+              if (view)
+                window.open(view.workspaceUrl, "_blank", "noopener,noreferrer");
+            }}
+          >
+            {t("portal.home.editor.open")}
+          </Button>
+        </div>
+      </div>
+
+      {footer && <div className="portal-editor-hero__footer">{footer}</div>}
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/HomeGreeting.tsx b/frontend/editor/src/portal/components/HomeGreeting.tsx
new file mode 100644
index 0000000000..0469015e82
--- /dev/null
+++ b/frontend/editor/src/portal/components/HomeGreeting.tsx
@@ -0,0 +1,30 @@
+import { useTranslation } from "react-i18next";
+
+/**
+ * Time-of-day greeting + today's date, shown above the paid-tier home hero.
+ * Free tier opens with the welcome banner instead, so this is paid-only.
+ */
+export function HomeGreeting() {
+  const { t } = useTranslation();
+  const now = new Date();
+  const hour = now.getHours();
+  const greeting =
+    hour < 12
+      ? t("portal.home.greeting.morning")
+      : hour < 18
+        ? t("portal.home.greeting.afternoon")
+        : t("portal.home.greeting.evening");
+  const date = now.toLocaleDateString(undefined, {
+    weekday: "long",
+    month: "long",
+    day: "numeric",
+    year: "numeric",
+  });
+
+  return (
+    <header className="portal-home__greeting">
+      <h1 className="portal-home__greeting-title">{greeting}</h1>
+      <p className="portal-home__greeting-date">{date}</p>
+    </header>
+  );
+}
diff --git a/frontend/editor/src/portal/components/HomeHero.tsx b/frontend/editor/src/portal/components/HomeHero.tsx
new file mode 100644
index 0000000000..643703f447
--- /dev/null
+++ b/frontend/editor/src/portal/components/HomeHero.tsx
@@ -0,0 +1,42 @@
+import type { Tier } from "@portal/contexts/TierContext";
+import { WelcomeBanner } from "@portal/components/WelcomeBanner";
+import { EditorStatusCard } from "@portal/components/EditorStatusCard";
+import { SetupChecklist } from "@portal/components/SetupChecklist";
+import { ControlledDealStatusHero } from "@portal/components/procurement/ProcurementBanner";
+import { ProcurementFlow } from "@portal/components/procurement/ProcurementFlow";
+import { useProcurement } from "@portal/components/procurement/useProcurement";
+
+/**
+ * The Home hero, composed per tier with a procurement-aware footer:
+ *
+ *  - free       → marketing welcome banner
+ *  - subscribed → deployed-Editor status card
+ *  - enterprise → deployed-Editor status card (chips hidden; the deal hero owns invite)
+ *
+ * The footer is the deal-status hero while a procurement deal is underway
+ * (procurement is a bolt-on to any tier), otherwise the setup checklist. The
+ * procurement takeover flow modals render alongside so the hero's actions can
+ * open them.
+ */
+export function HomeHero({ tier }: { tier: Tier }) {
+  const procurement = useProcurement();
+  const dealActive =
+    procurement.isLinked && procurement.started && !!procurement.data;
+
+  const footer = dealActive ? (
+    <ControlledDealStatusHero controller={procurement} />
+  ) : (
+    <SetupChecklist />
+  );
+
+  return (
+    <>
+      {tier === "free" ? (
+        <WelcomeBanner footer={footer} />
+      ) : (
+        <EditorStatusCard footer={footer} hideChips={tier === "enterprise"} />
+      )}
+      <ProcurementFlow controller={procurement} />
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/SetupChecklist.css b/frontend/editor/src/portal/components/SetupChecklist.css
new file mode 100644
index 0000000000..b49744774e
--- /dev/null
+++ b/frontend/editor/src/portal/components/SetupChecklist.css
@@ -0,0 +1,188 @@
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  "Finish setting up" checklist (welcome-hero footer)                      */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+.portal-setup {
+  display: flex;
+  flex-direction: column;
+}
+
+.portal-setup__head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0.6875rem 1.25rem 0.1875rem;
+}
+
+.portal-setup__eyebrow {
+  font-size: 0.625rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--color-text-5);
+}
+
+/* Progress counter doubles as the dismiss affordance. */
+.portal-setup__dismiss {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 0.1875rem 0.4375rem;
+  border: none;
+  border-radius: var(--radius-md);
+  background: transparent;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--color-text-5);
+  cursor: pointer;
+  transition:
+    color var(--motion-fast),
+    background var(--motion-fast);
+}
+.portal-setup__dismiss:hover {
+  color: var(--color-text-2);
+  background: var(--color-bg-hover);
+}
+
+.portal-setup__list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.portal-setup__row {
+  display: grid;
+  grid-template-columns: auto 1fr auto;
+  align-items: center;
+  gap: 0.875rem;
+  width: 100%;
+  padding: 0.875rem 1.25rem;
+  border: none;
+  border-top: 1px solid var(--color-border-light);
+  background: transparent;
+  text-align: left;
+  transition: background var(--motion-fast);
+}
+.portal-setup__item:first-child .portal-setup__row {
+  border-top: none;
+}
+.portal-setup__row.is-interactive {
+  cursor: pointer;
+}
+.portal-setup__row.is-interactive:hover {
+  background: var(--color-bg-hover);
+}
+.portal-setup__row:disabled {
+  cursor: default;
+}
+
+.portal-setup__dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 50%;
+  flex-shrink: 0;
+  background: var(--color-border-input);
+}
+.portal-setup__dot.is-done {
+  background: var(--color-green);
+}
+
+.portal-setup__text {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+.portal-setup__text strong {
+  font-size: 0.84375rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+}
+.portal-setup__text span {
+  margin-top: 0.0625rem;
+  font-size: 0.75rem;
+  line-height: 1.4;
+  color: var(--color-text-4);
+}
+
+.portal-setup__chip {
+  flex-shrink: 0;
+  padding: 0.125rem 0.5625rem;
+  border-radius: var(--radius-pill);
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--color-text-5);
+  background: var(--color-bg-hover);
+}
+.portal-setup__chip.is-done {
+  color: var(--color-green-dark);
+  background: var(--color-green-light);
+}
+
+/* Loading skeleton */
+.portal-setup__row.is-loading {
+  border-top: 1px solid var(--color-border-light);
+}
+.portal-setup__skel {
+  height: 0.75rem;
+  width: 60%;
+  border-radius: var(--radius-sm);
+  background: var(--color-bg-muted);
+  animation: portalSetupPulse 1.2s ease-in-out infinite;
+}
+@keyframes portalSetupPulse {
+  0%,
+  100% {
+    opacity: 0.5;
+  }
+  50% {
+    opacity: 1;
+  }
+}
+
+/* ── Enterprise upsell rung ── */
+.portal-setup__enterprise {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+  padding: 0.875rem 1.25rem;
+  border-top: 1px solid var(--color-border-light);
+  background: linear-gradient(
+    90deg,
+    color-mix(in srgb, var(--color-blue) 5%, transparent) 0%,
+    transparent 55%
+  );
+}
+
+.portal-setup__enterprise-copy {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  min-width: 0;
+  flex: 1;
+}
+
+.portal-setup__enterprise-tag {
+  flex-shrink: 0;
+  padding: 0.1875rem 0.5625rem;
+  border-radius: var(--radius-md);
+  font-size: 0.59375rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--color-blue-dark);
+  background: var(--color-blue-light);
+}
+
+.portal-setup__enterprise-text {
+  margin: 0;
+  font-size: 0.8125rem;
+  line-height: 1.45;
+  color: var(--color-text-3);
+  min-width: 0;
+}
+.portal-setup__enterprise-text strong {
+  color: var(--color-text-1);
+  font-weight: 700;
+}
diff --git a/frontend/editor/src/portal/components/SetupChecklist.stories.tsx b/frontend/editor/src/portal/components/SetupChecklist.stories.tsx
new file mode 100644
index 0000000000..ba8014921d
--- /dev/null
+++ b/frontend/editor/src/portal/components/SetupChecklist.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse, delay } from "msw";
+import { SetupChecklist } from "@portal/components/SetupChecklist";
+
+const meta: Meta<typeof SetupChecklist> = {
+  title: "Portal/Home/SetupChecklist",
+  component: SetupChecklist,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div
+        style={{
+          maxWidth: "60rem",
+          border: "1px solid var(--color-border)",
+          borderRadius: "var(--radius-xl)",
+          overflow: "hidden",
+          background: "var(--color-surface)",
+        }}
+      >
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof SetupChecklist>;
+
+/** Completion + counts derived from the live policies / sources MSW fixtures. */
+export const Default: Story = {};
+
+/** Slow policy/source fetch: shows the loading skeleton rows. */
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/policies", async () => {
+          await delay(100000);
+          return HttpResponse.json([]);
+        }),
+      ],
+    },
+  },
+};
+
+/** A fresh workspace — no active policies or connected sources: every step reads "Not started". */
+export const NotStarted: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/policies", () => HttpResponse.json([])),
+        http.get("/api/v1/policies/runs", () => HttpResponse.json([])),
+        http.get("/api/v1/sources", () =>
+          HttpResponse.json({ kpis: [], sources: [] }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/SetupChecklist.tsx b/frontend/editor/src/portal/components/SetupChecklist.tsx
new file mode 100644
index 0000000000..bc41c30dd6
--- /dev/null
+++ b/frontend/editor/src/portal/components/SetupChecklist.tsx
@@ -0,0 +1,218 @@
+import { useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import { useTier } from "@portal/contexts/TierContext";
+import { useView, type ViewId } from "@portal/contexts/ViewContext";
+import { useAsync } from "@portal/hooks/useAsync";
+import { fetchPolicies, type PoliciesResponse } from "@portal/api/policies";
+import { fetchSources, type SourcesResponse } from "@portal/api/sources";
+import { CloseIcon } from "@portal/components/icons";
+import "@portal/components/SetupChecklist.css";
+
+/** Where the Stirling PDF Editor desktop app is downloaded. */
+const EDITOR_DOWNLOAD_URL = "https://stirling.com/download";
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Enterprise upsell rung                                                   */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+/**
+ * Enterprise on-ramp rung. The CTA differs by tier: free orgs start a guided
+ * trial, subscribed (paying) orgs jump straight to a quote — both land in the
+ * procurement flow.
+ */
+function EnterpriseRung({ paying }: { paying: boolean }) {
+  const { t } = useTranslation();
+  const { setActiveView } = useView();
+  return (
+    <div className="portal-setup__enterprise">
+      <div className="portal-setup__enterprise-copy">
+        <span className="portal-setup__enterprise-tag">
+          {t("portal.home.onboarding.enterprise.tag")}
+        </span>
+        <p className="portal-setup__enterprise-text">
+          <strong>{t("portal.home.onboarding.enterprise.lead")}</strong>{" "}
+          {t("portal.home.onboarding.enterprise.body")}
+        </p>
+      </div>
+      <Button
+        variant="secondary"
+        size="sm"
+        onClick={() => setActiveView("procurement")}
+        rightSection={<span aria-hidden>→</span>}
+      >
+        {t(
+          paying
+            ? "portal.home.onboarding.enterprise.ctaQuote"
+            : "portal.home.onboarding.enterprise.cta",
+        )}
+      </Button>
+    </div>
+  );
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  "Finish setting up" checklist                                            */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+type StepAction =
+  | { kind: "external"; href: string }
+  | { kind: "navigate"; view: ViewId };
+
+interface Step {
+  id: string;
+  title: string;
+  blurb: string;
+  done: boolean;
+  /** Status chip shown once the step is done. */
+  chip: string;
+  action: StepAction;
+}
+
+/**
+ * Getting-started checklist, rendered as the attached footer of the home hero
+ * (welcome banner on free, deployed-Editor card on subscribed). Steps are a
+ * fixed do-this-then-that sequence with translatable copy; the completion
+ * state and counts are derived live from the org's real policies and sources
+ * (the same data the Policies / Sources pages show). The header doubles as a
+ * dismiss control; the Enterprise rung persists regardless.
+ */
+export function SetupChecklist() {
+  const { t } = useTranslation();
+  const { tier } = useTier();
+  const { setActiveView } = useView();
+  const [dismissed, setDismissed] = useState(false);
+
+  const state = useAsync<[PoliciesResponse, SourcesResponse]>(
+    () => Promise.all([fetchPolicies(), fetchSources()]),
+    [],
+  );
+  const { data, loading } = state;
+
+  const steps = useMemo<Step[]>(() => {
+    const [policies, sources] = data ?? [];
+    const active = policies?.summary.active ?? 0;
+    const recommended = Math.max(
+      0,
+      (policies?.summary.categories ?? 0) - active,
+    );
+    // A source counts as connected once it's set up and not disabled.
+    const connected =
+      sources?.sources.filter((s) => s.status !== "disabled").length ?? 0;
+
+    return [
+      {
+        id: "editor",
+        title: t("portal.home.onboarding.steps.editor.title"),
+        blurb: t("portal.home.onboarding.steps.editor.blurb"),
+        // "Deploy the desktop app" has no server signal — always an open task.
+        done: false,
+        chip: "",
+        action: { kind: "external", href: EDITOR_DOWNLOAD_URL },
+      },
+      {
+        id: "policies",
+        title: t("portal.home.onboarding.steps.policies.title"),
+        blurb: t("portal.home.onboarding.steps.policies.blurb", {
+          active,
+          recommended,
+        }),
+        done: active > 0,
+        chip: t("portal.home.onboarding.steps.policies.chip", { active }),
+        action: { kind: "navigate", view: "policies" },
+      },
+      {
+        id: "sources",
+        title: t("portal.home.onboarding.steps.sources.title"),
+        blurb: t("portal.home.onboarding.steps.sources.blurb", { connected }),
+        done: connected > 0,
+        chip: t("portal.home.onboarding.steps.sources.chip", { connected }),
+        action: { kind: "navigate", view: "sources" },
+      },
+    ];
+  }, [data, t]);
+
+  const doneCount = steps.filter((s) => s.done).length;
+
+  function activate(step: Step) {
+    if (step.done) return;
+    if (step.action.kind === "external") {
+      window.open(step.action.href, "_blank", "noopener,noreferrer");
+    } else {
+      setActiveView(step.action.view);
+    }
+  }
+
+  return (
+    <div className="portal-setup">
+      {loading && (
+        <div className="portal-setup__list" aria-hidden>
+          {Array.from({ length: 3 }).map((_, i) => (
+            <div key={i} className="portal-setup__row is-loading">
+              <span className="portal-setup__dot" />
+              <div className="portal-setup__text">
+                <div className="portal-setup__skel" />
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+
+      {!loading && !dismissed && (
+        <>
+          <div className="portal-setup__head">
+            <span className="portal-setup__eyebrow">
+              {t("portal.home.onboarding.title")}
+            </span>
+            <button
+              type="button"
+              className="portal-setup__dismiss"
+              onClick={() => setDismissed(true)}
+              title={t("portal.home.onboarding.dismiss")}
+            >
+              {t("portal.home.onboarding.progress", {
+                done: doneCount,
+                total: steps.length,
+              })}
+              <CloseIcon size={13} />
+            </button>
+          </div>
+
+          <ol className="portal-setup__list">
+            {steps.map((s) => (
+              <li key={s.id} className="portal-setup__item">
+                <button
+                  type="button"
+                  className={
+                    "portal-setup__row" +
+                    (s.done ? " is-done" : " is-interactive")
+                  }
+                  onClick={() => activate(s)}
+                  disabled={s.done}
+                >
+                  <span
+                    className={"portal-setup__dot" + (s.done ? " is-done" : "")}
+                    aria-hidden
+                  />
+                  <span className="portal-setup__text">
+                    <strong>{s.title}</strong>
+                    <span>{s.blurb}</span>
+                  </span>
+                  <span
+                    className={
+                      "portal-setup__chip" + (s.done ? " is-done" : "")
+                    }
+                  >
+                    {s.done ? s.chip : t("portal.home.onboarding.notStarted")}
+                  </span>
+                </button>
+              </li>
+            ))}
+          </ol>
+        </>
+      )}
+
+      <EnterpriseRung paying={tier !== "free"} />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.css b/frontend/editor/src/portal/components/WelcomeBanner.css
new file mode 100644
index 0000000000..87d284495f
--- /dev/null
+++ b/frontend/editor/src/portal/components/WelcomeBanner.css
@@ -0,0 +1,461 @@
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Free-tier welcome hero                                                   */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+.portal-welcome {
+  border-radius: var(--radius-xl);
+  border: 1px solid var(--color-blue-border);
+  overflow: hidden;
+  isolation: isolate;
+}
+
+.portal-welcome__body {
+  position: relative;
+  display: flex;
+  align-items: stretch;
+  min-height: 22.5rem;
+  background: linear-gradient(135deg, #eaf2fb 0%, #eef3fb 50%, #f4f0fa 100%);
+}
+
+[data-theme="dark"] .portal-welcome__body {
+  background: linear-gradient(135deg, #0e0e10 0%, #121214 50%, #161618 100%);
+}
+
+/* ── Flowing gradient canvas: three radial blobs drifting at different
+   speeds for a slow, organic color flow. Purely decorative. ── */
+.portal-welcome__canvas {
+  position: absolute;
+  inset: -40%;
+  width: 180%;
+  height: 180%;
+  filter: blur(3.75rem);
+  pointer-events: none;
+  z-index: 0;
+}
+
+.portal-welcome__blob {
+  position: absolute;
+  border-radius: 50%;
+}
+
+.portal-welcome__blob--1 {
+  width: 60%;
+  height: 70%;
+  top: -10%;
+  left: 30%;
+  background: radial-gradient(
+    circle,
+    rgba(59, 130, 246, 0.35) 0%,
+    rgba(99, 102, 241, 0.2) 40%,
+    transparent 70%
+  );
+  animation: portalHeroBlob1 5s ease-in-out infinite;
+}
+
+.portal-welcome__blob--2 {
+  width: 55%;
+  height: 60%;
+  top: 10%;
+  right: -15%;
+  background: radial-gradient(
+    circle,
+    rgba(139, 92, 246, 0.4) 0%,
+    rgba(192, 132, 252, 0.2) 40%,
+    transparent 70%
+  );
+  animation: portalHeroBlob2 7s ease-in-out infinite;
+}
+
+.portal-welcome__blob--3 {
+  width: 50%;
+  height: 55%;
+  bottom: -15%;
+  left: 35%;
+  background: radial-gradient(
+    circle,
+    rgba(59, 130, 246, 0.25) 0%,
+    rgba(14, 165, 233, 0.15) 40%,
+    transparent 70%
+  );
+  animation: portalHeroBlob3 9s ease-in-out infinite;
+}
+
+[data-theme="dark"] .portal-welcome__blob--1 {
+  left: 20%;
+  background: radial-gradient(
+    circle,
+    rgba(96, 165, 250, 0.4) 0%,
+    rgba(99, 102, 241, 0.25) 40%,
+    transparent 70%
+  );
+}
+
+[data-theme="dark"] .portal-welcome__blob--2 {
+  background: radial-gradient(
+    circle,
+    rgba(167, 139, 250, 0.45) 0%,
+    rgba(192, 132, 252, 0.25) 40%,
+    transparent 70%
+  );
+}
+
+[data-theme="dark"] .portal-welcome__blob--3 {
+  left: 20%;
+  background: radial-gradient(
+    circle,
+    rgba(96, 165, 250, 0.3) 0%,
+    rgba(56, 189, 248, 0.18) 40%,
+    transparent 70%
+  );
+}
+
+@keyframes portalHeroBlob1 {
+  0% {
+    transform: translate(0%, 0%) scale(1);
+  }
+  33% {
+    transform: translate(18%, -25%) scale(1.15);
+  }
+  66% {
+    transform: translate(-10%, 18%) scale(0.9);
+  }
+  100% {
+    transform: translate(0%, 0%) scale(1);
+  }
+}
+
+@keyframes portalHeroBlob2 {
+  0% {
+    transform: translate(0%, 0%) scale(1);
+  }
+  33% {
+    transform: translate(-20%, 15%) scale(1.1);
+  }
+  66% {
+    transform: translate(15%, -20%) scale(1.15);
+  }
+  100% {
+    transform: translate(0%, 0%) scale(1);
+  }
+}
+
+@keyframes portalHeroBlob3 {
+  0% {
+    transform: translate(0%, 0%) scale(1.05);
+  }
+  33% {
+    transform: translate(22%, 10%) scale(0.9);
+  }
+  66% {
+    transform: translate(-15%, -15%) scale(1.15);
+  }
+  100% {
+    transform: translate(0%, 0%) scale(1.05);
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .portal-welcome__blob {
+    animation: none;
+  }
+}
+
+/* ── Left column: copy + CTAs ── */
+.portal-welcome__text {
+  position: relative;
+  z-index: 1;
+  flex: 1 1 0;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  padding: 2.75rem 0 2.75rem 3rem;
+}
+
+.portal-welcome__badge {
+  align-self: flex-start;
+  margin-bottom: 1rem;
+  padding: 0.3125rem 0.875rem;
+  border-radius: var(--radius-pill);
+  border: 1px solid var(--color-blue-border);
+  background: var(--color-surface);
+  font-size: 0.6875rem;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--color-blue);
+}
+
+.portal-welcome__title {
+  margin: 0 0 1.125rem;
+  font-size: 2.25rem;
+  font-weight: 700;
+  line-height: 1.2;
+  letter-spacing: -0.025em;
+  color: var(--color-text-1);
+}
+
+.portal-welcome__title-accent {
+  color: var(--color-blue);
+}
+
+.portal-welcome__sub {
+  margin: 0 0 1.75rem;
+  max-width: 32.5rem;
+  font-size: 1rem;
+  line-height: 1.6;
+  color: var(--color-text-3);
+}
+
+.portal-welcome__cta {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  flex-wrap: wrap;
+}
+
+.portal-welcome__perks {
+  margin: 1.375rem 0 0;
+  font-size: 0.78125rem;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  color: var(--color-text-4);
+}
+
+/* ── Right column: editor-card visual ── */
+.portal-welcome__visual {
+  position: relative;
+  z-index: 1;
+  display: flex;
+  align-items: flex-end;
+  justify-content: flex-end;
+  flex: none;
+  padding-left: 1.5rem;
+}
+
+@media (max-width: 60rem) {
+  .portal-welcome__visual {
+    display: none;
+  }
+  .portal-welcome__text {
+    padding: 2.5rem 2rem;
+  }
+}
+
+/* ── Dark editor card ── */
+.portal-welcome__editor {
+  align-self: flex-end;
+  width: 38.75rem;
+  max-width: 100%;
+  margin-right: 2.5rem;
+  min-height: 18.75rem;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+  border-radius: 0.75rem 0.75rem 0 0;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  border-bottom: none;
+  background: rgba(15, 23, 42, 0.92);
+  backdrop-filter: blur(0.75rem);
+  box-shadow:
+    0 0.5rem 2rem rgba(0, 0, 0, 0.25),
+    0 0.125rem 0.5rem rgba(0, 0, 0, 0.15);
+}
+
+.portal-welcome__editor-bar {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.75rem 1rem;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+  flex-shrink: 0;
+}
+
+.portal-welcome__editor-dots {
+  display: flex;
+  gap: 0.375rem;
+  flex-shrink: 0;
+}
+.portal-welcome__editor-dots span {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 50%;
+}
+.portal-welcome__editor-dots span:nth-child(1) {
+  background: #ef4444;
+}
+.portal-welcome__editor-dots span:nth-child(2) {
+  background: #f59e0b;
+}
+.portal-welcome__editor-dots span:nth-child(3) {
+  background: #22c55e;
+}
+
+.portal-welcome__editor-file {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex: 1;
+  min-width: 0;
+  font-size: 0.6875rem;
+  color: rgba(255, 255, 255, 0.6);
+}
+.portal-welcome__editor-name {
+  font-weight: 600;
+  color: rgba(255, 255, 255, 0.9);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.portal-welcome__editor-sep {
+  color: rgba(255, 255, 255, 0.35);
+  flex-shrink: 0;
+}
+.portal-welcome__editor-pages {
+  color: rgba(255, 255, 255, 0.55);
+  flex-shrink: 0;
+}
+.portal-welcome__editor-page {
+  font-size: 0.6875rem;
+  color: rgba(255, 255, 255, 0.55);
+  flex-shrink: 0;
+}
+
+.portal-welcome__editor-body {
+  display: flex;
+  align-items: stretch;
+  flex: 1;
+  min-height: 0;
+}
+
+.portal-welcome__rail {
+  width: 2.5rem;
+  flex-shrink: 0;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.25rem;
+  padding: 0.5rem 0;
+  color: rgba(255, 255, 255, 0.4);
+}
+.portal-welcome__editor-body > .portal-welcome__rail:first-child {
+  border-right: 1px solid rgba(255, 255, 255, 0.06);
+}
+.portal-welcome__editor-body > .portal-welcome__rail:last-child {
+  border-left: 1px solid rgba(255, 255, 255, 0.06);
+}
+.portal-welcome__rail-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.625rem;
+  height: 1.625rem;
+  border-radius: 0.3125rem;
+}
+.portal-welcome__rail-icon:nth-child(2) {
+  background: rgba(96, 165, 250, 0.18);
+  color: rgba(147, 197, 253, 0.95);
+}
+
+/* ── White document preview ── */
+.portal-welcome__doc {
+  flex: 1;
+  min-width: 0;
+  margin: 0.75rem 1rem 0;
+  padding: 0.875rem 1.125rem;
+  border-radius: 0.25rem 0.25rem 0 0;
+  background: #ffffff;
+  color: #0f172a;
+  box-shadow: 0 0.25rem 1.125rem rgba(0, 0, 0, 0.22);
+}
+
+.portal-welcome__doc-eyebrow {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 0.5rem;
+  font-size: 0.5625rem;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  color: #dc2626;
+}
+.portal-welcome__doc-critical {
+  padding: 0.1875rem 0.5625rem;
+  border-radius: 0.1875rem;
+  background: #fee2e2;
+  letter-spacing: 0.06em;
+}
+.portal-welcome__doc-title {
+  margin-bottom: 0.5rem;
+  font-size: 0.9375rem;
+  font-weight: 700;
+  line-height: 1.3;
+  color: #0f172a;
+}
+.portal-welcome__doc-divider {
+  border-top: 1px solid #e8e6e1;
+  margin-bottom: 0.625rem;
+}
+.portal-welcome__doc-meta {
+  display: flex;
+  gap: 1.5rem;
+  margin-bottom: 0.75rem;
+  font-size: 0.625rem;
+  color: #0f172a;
+  font-weight: 600;
+}
+.portal-welcome__doc-meta-key {
+  color: #9b9a97;
+  font-weight: 400;
+}
+.portal-welcome__doc-heading {
+  margin-bottom: 0.375rem;
+  font-size: 0.625rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  color: #0f172a;
+}
+.portal-welcome__doc-body {
+  margin: 0 0 0.75rem;
+  font-size: 0.625rem;
+  line-height: 1.5;
+  color: #6b6b6b;
+}
+.portal-welcome__doc-finding {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  padding: 0.4375rem 0.75rem;
+  border-radius: 0.1875rem;
+  font-size: 0.625rem;
+  font-weight: 500;
+}
+.portal-welcome__doc-finding--critical {
+  margin-bottom: 0.3125rem;
+  background: #fee2e2;
+  color: #7f1d1d;
+}
+.portal-welcome__doc-finding--high {
+  background: #fef3c7;
+  color: #92400e;
+}
+.portal-welcome__doc-dot {
+  width: 0.375rem;
+  height: 0.375rem;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+.portal-welcome__doc-finding--critical .portal-welcome__doc-dot {
+  background: #dc2626;
+}
+.portal-welcome__doc-finding--high .portal-welcome__doc-dot {
+  background: #d97706;
+}
+
+/* ── Attached footer strip (setup checklist) ── */
+.portal-welcome__footer {
+  position: relative;
+  z-index: 2;
+  border-top: 1px solid var(--color-border-light);
+  background: var(--color-surface);
+}
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.stories.tsx b/frontend/editor/src/portal/components/WelcomeBanner.stories.tsx
new file mode 100644
index 0000000000..0162d5f262
--- /dev/null
+++ b/frontend/editor/src/portal/components/WelcomeBanner.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { WelcomeBanner } from "@portal/components/WelcomeBanner";
+import { SetupChecklist } from "@portal/components/SetupChecklist";
+
+const meta: Meta<typeof WelcomeBanner> = {
+  title: "Portal/Home/WelcomeBanner",
+  component: WelcomeBanner,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "72rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof WelcomeBanner>;
+
+/** The hero on its own, no attached footer. */
+export const Default: Story = {};
+
+/** The hero as it renders on the free-tier home: the "Finish setting up"
+ *  checklist attached as the footer strip. */
+export const WithSetupChecklist: Story = {
+  args: {
+    footer: <SetupChecklist />,
+  },
+};
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.tsx b/frontend/editor/src/portal/components/WelcomeBanner.tsx
new file mode 100644
index 0000000000..8e9f71af29
--- /dev/null
+++ b/frontend/editor/src/portal/components/WelcomeBanner.tsx
@@ -0,0 +1,183 @@
+import type { ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import { useView } from "@portal/contexts/ViewContext";
+import {
+  DownloadIcon,
+  UsersIcon,
+  EditorIcon,
+  SearchIcon,
+  SourcesIcon,
+  PoliciesIcon,
+  SparklesIcon,
+  ComponentsIcon,
+  DocumentsIcon,
+  SettingsIcon,
+} from "@portal/components/icons";
+import "@portal/components/WelcomeBanner.css";
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Editor-card visual                                                       */
+/*                                                                           */
+/*  A decorative mock of the deployed PDF Editor reviewing a security        */
+/*  report. Purely presentational — hidden from assistive tech.              */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+const RAIL_ICONS = [
+  SearchIcon,
+  SourcesIcon,
+  PoliciesIcon,
+  EditorIcon,
+  ComponentsIcon,
+  SparklesIcon,
+  DocumentsIcon,
+  SettingsIcon,
+] as const;
+
+function EditorRail() {
+  return (
+    <div className="portal-welcome__rail" aria-hidden>
+      {RAIL_ICONS.map((Icon, i) => (
+        <span key={i} className="portal-welcome__rail-icon">
+          <Icon size={13} />
+        </span>
+      ))}
+    </div>
+  );
+}
+
+function WelcomeEditorCard() {
+  return (
+    <div className="portal-welcome__editor" aria-hidden>
+      <div className="portal-welcome__editor-bar">
+        <div className="portal-welcome__editor-dots">
+          <span />
+          <span />
+          <span />
+        </div>
+        <div className="portal-welcome__editor-file">
+          <EditorIcon size={12} />
+          <span className="portal-welcome__editor-name">
+            Vulnerability Assessment Report CVE-2026-1847.pdf
+          </span>
+          <span className="portal-welcome__editor-sep">·</span>
+          <span className="portal-welcome__editor-pages">18 pages</span>
+        </div>
+        <span className="portal-welcome__editor-page">1 / 18</span>
+      </div>
+
+      <div className="portal-welcome__editor-body">
+        <EditorRail />
+        <div className="portal-welcome__doc">
+          <div className="portal-welcome__doc-eyebrow">
+            <span>SECURITY ASSESSMENT</span>
+            <span className="portal-welcome__doc-critical">CRITICAL</span>
+          </div>
+          <div className="portal-welcome__doc-title">
+            Vulnerability Assessment Report CVE-2026-1847
+          </div>
+          <div className="portal-welcome__doc-divider" />
+          <div className="portal-welcome__doc-meta">
+            <span>
+              <span className="portal-welcome__doc-meta-key">
+                Assessment Date:{" "}
+              </span>
+              February 2026
+            </span>
+            <span>
+              <span className="portal-welcome__doc-meta-key">
+                Classification:{" "}
+              </span>
+              FOUO
+            </span>
+          </div>
+          <div className="portal-welcome__doc-heading">EXECUTIVE SUMMARY</div>
+          <p className="portal-welcome__doc-body">
+            This assessment identifies critical vulnerabilities in the target
+            environment and provides actionable remediation guidance prioritized
+            by risk severity.
+          </p>
+          <div className="portal-welcome__doc-heading">KEY FINDINGS</div>
+          <div className="portal-welcome__doc-finding portal-welcome__doc-finding--critical">
+            <span className="portal-welcome__doc-dot" />3 Critical
+            vulnerabilities identified
+          </div>
+          <div className="portal-welcome__doc-finding portal-welcome__doc-finding--high">
+            <span className="portal-welcome__doc-dot" />7 High-severity issues
+            requiring attention
+          </div>
+        </div>
+        <EditorRail />
+      </div>
+    </div>
+  );
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Welcome banner (free-tier hero)                                          */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+interface WelcomeBannerProps {
+  /**
+   * Rendered as an attached footer strip inside the banner card (e.g. the
+   * "Finish setting up" checklist). Kept as a slot so the hero stays a pure
+   * presentational shell.
+   */
+  footer?: ReactNode;
+}
+
+export function WelcomeBanner({ footer }: WelcomeBannerProps) {
+  const { t } = useTranslation();
+  const { setActiveView } = useView();
+
+  return (
+    <section
+      className="portal-welcome"
+      aria-label={t("portal.welcome.ariaLabel")}
+    >
+      <div className="portal-welcome__body">
+        <div className="portal-welcome__canvas" aria-hidden>
+          <div className="portal-welcome__blob portal-welcome__blob--1" />
+          <div className="portal-welcome__blob portal-welcome__blob--2" />
+          <div className="portal-welcome__blob portal-welcome__blob--3" />
+        </div>
+
+        <div className="portal-welcome__text">
+          <span className="portal-welcome__badge">
+            {t("portal.welcome.badge")}
+          </span>
+          <h1 className="portal-welcome__title">
+            {t("portal.welcome.title")}{" "}
+            <span className="portal-welcome__title-accent">
+              {t("portal.welcome.titleAccent")}
+            </span>
+          </h1>
+          <p className="portal-welcome__sub">{t("portal.welcome.subtitle")}</p>
+          <div className="portal-welcome__cta">
+            <Button
+              variant="primary"
+              leftSection={<DownloadIcon size={15} />}
+              onClick={() => setActiveView("editor")}
+            >
+              {t("portal.welcome.installEditor")}
+            </Button>
+            <Button
+              variant="secondary"
+              leftSection={<UsersIcon size={15} />}
+              onClick={() => setActiveView("users")}
+            >
+              {t("portal.welcome.inviteTeammates")}
+            </Button>
+          </div>
+          <p className="portal-welcome__perks">{t("portal.welcome.perks")}</p>
+        </div>
+
+        <div className="portal-welcome__visual">
+          <WelcomeEditorCard />
+        </div>
+      </div>
+
+      {footer && <div className="portal-welcome__footer">{footer}</div>}
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/WelcomeCarousel.css b/frontend/editor/src/portal/components/WelcomeCarousel.css
deleted file mode 100644
index 49a7d5fcc3..0000000000
--- a/frontend/editor/src/portal/components/WelcomeCarousel.css
+++ /dev/null
@@ -1,234 +0,0 @@
-.portal-carousel {
-  position: relative;
-  overflow: hidden;
-  padding: 2rem;
-  border-radius: var(--radius-xl);
-  background: var(--grad-banner);
-  border: 1px solid var(--color-border);
-  isolation: isolate;
-}
-
-.portal-carousel__inner {
-  position: relative;
-  z-index: 1;
-  display: grid;
-  grid-template-columns: minmax(0, 1fr) minmax(0, 20rem);
-  gap: 2rem;
-  align-items: center;
-  animation: fadeInUp var(--motion-enter) both;
-}
-
-@media (max-width: 50rem) {
-  .portal-carousel__inner {
-    grid-template-columns: 1fr;
-  }
-}
-
-.portal-carousel__text {
-  min-width: 0;
-}
-
-.portal-carousel__eyebrow {
-  font-size: 0.75rem;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.06em;
-  color: var(--color-blue);
-  margin-bottom: 0.5rem;
-}
-
-.portal-carousel__title {
-  margin: 0 0 0.75rem;
-  font-size: 1.75rem;
-  font-weight: 700;
-  line-height: 1.15;
-  color: var(--color-text-1);
-}
-
-.portal-carousel__sub {
-  margin: 0 0 1.25rem;
-  font-size: 0.9375rem;
-  line-height: 1.55;
-  color: var(--color-text-3);
-  max-width: 36rem;
-}
-
-.portal-carousel__cta {
-  display: flex;
-  gap: 0.5rem;
-  flex-wrap: wrap;
-}
-
-/* Ornament container */
-.portal-carousel__ornament {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-}
-
-/* Doc card ornament (slide 0) */
-.portal-carousel__doc {
-  width: 100%;
-  padding: 1rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-md);
-  box-shadow: var(--shadow-md);
-}
-.portal-carousel__doc-title {
-  margin-top: 0.5rem;
-  font-size: 0.9375rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-.portal-carousel__doc-sub {
-  margin-top: 0.125rem;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-.portal-carousel__doc-meta {
-  margin-top: 0.75rem;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-  display: flex;
-  gap: 0.375rem;
-  flex-wrap: wrap;
-}
-
-/* Code ornament (slide 1) */
-.portal-carousel__code {
-  width: 100%;
-  margin: 0;
-  padding: 0.875rem 1rem;
-  background: var(--code-bg);
-  color: var(--code-text);
-  border: 1px solid var(--code-border);
-  border-radius: var(--radius-md);
-  font-family: var(--font-mono);
-  font-size: 0.75rem;
-  line-height: 1.65;
-  white-space: pre-wrap;
-  word-break: break-word;
-  box-shadow: var(--shadow-lg);
-}
-.portal-carousel__code-method {
-  color: var(--code-fn);
-  font-weight: 600;
-}
-.portal-carousel__code-path {
-  color: var(--code-keyword);
-}
-.portal-carousel__code-key {
-  color: var(--code-property);
-}
-.portal-carousel__code-string {
-  color: var(--code-string);
-}
-
-/* Eval ornament (slide 2) */
-.portal-carousel__eval {
-  width: 100%;
-  padding: 1rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-md);
-  box-shadow: var(--shadow-md);
-}
-.portal-carousel__eval-head {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-}
-.portal-carousel__eval-title {
-  font-size: 0.875rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-.portal-carousel__eval-score {
-  font-size: 1.125rem;
-  font-weight: 700;
-  color: var(--color-green);
-}
-.portal-carousel__eval-sub {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-  margin-top: 0.125rem;
-}
-.portal-carousel__eval-bar {
-  margin-top: 0.75rem;
-  height: 0.375rem;
-  background: var(--color-bg-muted);
-  border-radius: var(--radius-pill);
-  overflow: hidden;
-}
-.portal-carousel__eval-fill {
-  height: 100%;
-  background: var(--grad-green-btn);
-}
-.portal-carousel__eval-meta {
-  margin-top: 0.625rem;
-  display: flex;
-  justify-content: space-between;
-  font-size: 0.6875rem;
-  color: var(--color-text-4);
-}
-
-/* Decoration blobs */
-.portal-carousel__decor {
-  position: absolute;
-  inset: 0;
-  z-index: 0;
-  pointer-events: none;
-}
-.portal-carousel__blob {
-  position: absolute;
-  border-radius: 50%;
-  filter: blur(2.5rem);
-}
-.portal-carousel__blob--1 {
-  top: -3rem;
-  right: -2rem;
-  width: 16rem;
-  height: 16rem;
-  background: radial-gradient(circle, var(--color-purple), transparent 70%);
-  opacity: 0.4;
-}
-.portal-carousel__blob--2 {
-  bottom: -4rem;
-  right: 8rem;
-  width: 12rem;
-  height: 12rem;
-  background: radial-gradient(circle, var(--color-blue), transparent 70%);
-  opacity: 0.3;
-}
-
-/* Pagination dots */
-.portal-carousel__dots {
-  position: absolute;
-  bottom: 0.875rem;
-  left: 50%;
-  transform: translateX(-50%);
-  display: flex;
-  gap: 0.375rem;
-  z-index: 2;
-}
-.portal-carousel__dot {
-  width: 0.4375rem;
-  height: 0.4375rem;
-  border-radius: 50%;
-  background: var(--color-text-5);
-  opacity: 0.4;
-  transition:
-    opacity var(--motion-fast),
-    background var(--motion-fast),
-    width var(--motion-fast);
-}
-.portal-carousel__dot:hover {
-  opacity: 0.7;
-}
-.portal-carousel__dot.is-active {
-  width: 1rem;
-  border-radius: var(--radius-pill);
-  background: var(--color-blue);
-  opacity: 1;
-}
diff --git a/frontend/editor/src/portal/components/WelcomeCarousel.stories.tsx b/frontend/editor/src/portal/components/WelcomeCarousel.stories.tsx
deleted file mode 100644
index 1db5790fcf..0000000000
--- a/frontend/editor/src/portal/components/WelcomeCarousel.stories.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { WelcomeCarousel } from "@portal/components/WelcomeCarousel";
-
-const meta: Meta<typeof WelcomeCarousel> = {
-  title: "Portal/Home/WelcomeCarousel",
-  component: WelcomeCarousel,
-  args: { onTryOp: () => console.log("try op") },
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "64rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof WelcomeCarousel>;
-
-export const AutoRotating: Story = {};
diff --git a/frontend/editor/src/portal/components/WelcomeCarousel.tsx b/frontend/editor/src/portal/components/WelcomeCarousel.tsx
deleted file mode 100644
index 42af5a6abb..0000000000
--- a/frontend/editor/src/portal/components/WelcomeCarousel.tsx
+++ /dev/null
@@ -1,232 +0,0 @@
-import { useEffect, useState, type ReactNode } from "react";
-import { useTranslation } from "react-i18next";
-import { Button, StatusBadge } from "@app/ui";
-import { useView, type ViewId } from "@portal/contexts/ViewContext";
-import "@portal/components/WelcomeCarousel.css";
-
-type SlideAction =
-  | { labelKey: string; target: ViewId }
-  | { labelKey: string; action: "try-op" };
-
-interface Slide {
-  id: string;
-  durationMs: number;
-  primary: SlideAction;
-  secondary: SlideAction;
-  ornament: ReactNode;
-}
-
-function EditorOrnament() {
-  const { t } = useTranslation();
-  return (
-    <div className="portal-carousel__doc">
-      <StatusBadge tone="danger" size="sm" pulse>
-        {t("portal.welcome.ornament.editor.critical")}
-      </StatusBadge>
-      <div className="portal-carousel__doc-title">
-        Vulnerability Assessment Report
-      </div>
-      <div className="portal-carousel__doc-sub">CVE-2026-1847 · 12 pages</div>
-      <div className="portal-carousel__doc-meta">
-        <span>{t("portal.welcome.ornament.editor.signed")}</span>
-        <span>·</span>
-        <span>{t("portal.welcome.ornament.editor.ocrClean")}</span>
-        <span>·</span>
-        <span>{t("portal.welcome.ornament.editor.schemaMatch")}</span>
-      </div>
-    </div>
-  );
-}
-
-function PlatformOrnament() {
-  return (
-    <pre className="portal-carousel__code">
-      <span className="portal-carousel__code-method">POST</span>{" "}
-      <span className="portal-carousel__code-path">/v1/secure</span>
-      {"\n"}
-      <span className="portal-carousel__code-key">Authorization</span>:{" "}
-      <span className="portal-carousel__code-string">Bearer sk_live_a3f8…</span>
-      {"\n"}
-      <span className="portal-carousel__code-key">file</span>:{" "}
-      <span className="portal-carousel__code-string">
-        federal_CUI_contract.pdf
-      </span>
-      {"\n"}
-      <span className="portal-carousel__code-key">pipeline</span>:{" "}
-      <span className="portal-carousel__code-string">cui-redact-v2</span>
-    </pre>
-  );
-}
-
-function AgentOrnament() {
-  return (
-    <div className="portal-carousel__eval">
-      <div className="portal-carousel__eval-head">
-        <span className="portal-carousel__eval-title">KYC Processor</span>
-        <span className="portal-carousel__eval-score">94%</span>
-      </div>
-      <div className="portal-carousel__eval-sub">
-        Eval pass rate · 28 test cases
-      </div>
-      <div className="portal-carousel__eval-bar">
-        <div
-          className="portal-carousel__eval-fill"
-          style={{ width: "94%" }}
-          aria-hidden
-        />
-      </div>
-      <div className="portal-carousel__eval-meta">
-        <span>26 passed</span>
-        <span>2 review</span>
-        <span>MCP · Claude</span>
-      </div>
-    </div>
-  );
-}
-
-const SLIDES: Slide[] = [
-  {
-    id: "editor",
-    durationMs: 12000,
-    primary: {
-      labelKey: "portal.welcome.slides.editor.primary",
-      target: "editor",
-    },
-    secondary: {
-      labelKey: "portal.welcome.slides.editor.secondary",
-      target: "editor",
-    },
-    ornament: <EditorOrnament />,
-  },
-  {
-    id: "platform",
-    durationMs: 8000,
-    primary: {
-      labelKey: "portal.welcome.slides.platform.primary",
-      action: "try-op",
-    },
-    secondary: {
-      labelKey: "portal.welcome.slides.platform.secondary",
-      target: "infrastructure",
-    },
-    ornament: <PlatformOrnament />,
-  },
-  {
-    id: "agents",
-    durationMs: 8000,
-    primary: {
-      labelKey: "portal.welcome.slides.agents.primary",
-      target: "sources",
-    },
-    secondary: {
-      labelKey: "portal.welcome.slides.agents.secondary",
-      target: "docs",
-    },
-    ornament: <AgentOrnament />,
-  },
-];
-
-interface WelcomeCarouselProps {
-  /** Called when a slide CTA wants to invoke the single-op runner. */
-  onTryOp: () => void;
-}
-
-export function WelcomeCarousel({ onTryOp }: WelcomeCarouselProps) {
-  const { t } = useTranslation();
-  const [index, setIndex] = useState(0);
-  const [paused, setPaused] = useState(false);
-  const { setActiveView } = useView();
-
-  function runAction(act: SlideAction) {
-    if ("action" in act && act.action === "try-op") {
-      onTryOp();
-    } else if ("target" in act) {
-      setActiveView(act.target);
-    }
-  }
-
-  useEffect(() => {
-    if (paused) return;
-    const duration = SLIDES[index].durationMs;
-    const t = window.setTimeout(() => {
-      setIndex((i) => (i + 1) % SLIDES.length);
-    }, duration);
-    return () => window.clearTimeout(t);
-  }, [index, paused]);
-
-  const slide = SLIDES[index];
-
-  return (
-    <section
-      className="portal-carousel"
-      onMouseEnter={() => setPaused(true)}
-      onMouseLeave={() => setPaused(false)}
-      onFocus={() => setPaused(true)}
-      onBlur={(e) => {
-        // onBlur bubbles from children; only unpause when focus actually
-        // leaves the carousel, not when tabbing between the dot buttons.
-        if (!e.currentTarget.contains(e.relatedTarget as Node | null)) {
-          setPaused(false);
-        }
-      }}
-      aria-label={t("portal.welcome.ariaLabel")}
-      aria-roledescription="carousel"
-    >
-      <div className="portal-carousel__inner" key={slide.id}>
-        <div className="portal-carousel__text">
-          <div className="portal-carousel__eyebrow">
-            {t(`portal.welcome.slides.${slide.id}.eyebrow`)}
-          </div>
-          <h1 className="portal-carousel__title">
-            {t(`portal.welcome.slides.${slide.id}.title`)}
-          </h1>
-          <p className="portal-carousel__sub">
-            {t(`portal.welcome.slides.${slide.id}.sub`)}
-          </p>
-          <div className="portal-carousel__cta">
-            <Button
-              onClick={() => runAction(slide.primary)}
-              rightSection={<span aria-hidden>→</span>}
-            >
-              {t(slide.primary.labelKey)}
-            </Button>
-            <Button
-              variant="secondary"
-              onClick={() => runAction(slide.secondary)}
-            >
-              {t(slide.secondary.labelKey)}
-            </Button>
-          </div>
-        </div>
-        <div className="portal-carousel__ornament">{slide.ornament}</div>
-      </div>
-
-      <div className="portal-carousel__decor" aria-hidden>
-        <div className="portal-carousel__blob portal-carousel__blob--1" />
-        <div className="portal-carousel__blob portal-carousel__blob--2" />
-      </div>
-
-      <div
-        className="portal-carousel__dots"
-        role="group"
-        aria-label={t("portal.welcome.pagination")}
-      >
-        {SLIDES.map((s, i) => (
-          <Button
-            key={s.id}
-            variant="tertiary"
-            aria-current={i === index ? "true" : undefined}
-            aria-label={t("portal.welcome.slideLabel", {
-              number: i + 1,
-              title: t(`portal.welcome.slides.${s.id}.title`),
-            })}
-            className={
-              "portal-carousel__dot" + (i === index ? " is-active" : "")
-            }
-            onClick={() => setIndex(i)}
-          />
-        ))}
-      </div>
-    </section>
-  );
-}
diff --git a/frontend/editor/src/portal/components/icons.tsx b/frontend/editor/src/portal/components/icons.tsx
index 51a8f0693c..c5e93b8f08 100644
--- a/frontend/editor/src/portal/components/icons.tsx
+++ b/frontend/editor/src/portal/components/icons.tsx
@@ -254,6 +254,16 @@ export function ProcurementIcon(props: IconProps) {
   );
 }
 
+export function DownloadIcon(props: IconProps) {
+  return (
+    <Svg {...props}>
+      <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+      <polyline points="7 10 12 15 17 10" />
+      <line x1="12" y1="15" x2="12" y2="3" />
+    </Svg>
+  );
+}
+
 export function LinkIcon(props: IconProps) {
   return (
     <Svg {...props}>
@@ -262,3 +272,24 @@ export function LinkIcon(props: IconProps) {
     </Svg>
   );
 }
+
+export function UserPlusIcon(props: IconProps) {
+  return (
+    <Svg {...props}>
+      <path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" />
+      <circle cx="9" cy="7" r="4" />
+      <line x1="19" y1="8" x2="19" y2="14" />
+      <line x1="22" y1="11" x2="16" y2="11" />
+    </Svg>
+  );
+}
+
+export function ExternalLinkIcon(props: IconProps) {
+  return (
+    <Svg {...props}>
+      <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" />
+      <polyline points="15 3 21 3 21 9" />
+      <line x1="10" y1="14" x2="21" y2="3" />
+    </Svg>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx b/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
new file mode 100644
index 0000000000..fffc2479be
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
@@ -0,0 +1,79 @@
+import { useTranslation } from "react-i18next";
+import { Button, Card } from "@app/ui";
+import { useView } from "@portal/contexts/ViewContext";
+import { DealStatusHero } from "@portal/components/procurement/DealStatusHero";
+import type { ProcurementController } from "@portal/components/procurement/useProcurement";
+
+/**
+ * The deal-status hero, wired to a shared ProcurementController. Rendered both
+ * standalone (the /procurement route) and as the Home hero card's footer once a
+ * deal is underway. Assumes an active deal (controller.data present).
+ */
+export function ControlledDealStatusHero({
+  controller,
+}: {
+  controller: ProcurementController;
+}) {
+  const { setActiveView } = useView();
+  if (!controller.data) return null;
+  return (
+    <DealStatusHero
+      snapshot={controller.data}
+      busy={controller.busy}
+      onExpand={() => controller.setOpen(true)}
+      onKeyDocs={() => controller.setExtra("docs")}
+      onInvite={() => setActiveView("users")}
+      onSchedule={() => controller.setExtra("schedule")}
+      onManageTrial={() => controller.setExtra("trial")}
+      onNavigate={setActiveView}
+    />
+  );
+}
+
+/**
+ * Enterprise on-ramp shown when no deal exists yet. Only used on the dedicated
+ * /procurement route — on Home the setup checklist's Enterprise rung owns the
+ * on-ramp, so this doesn't render there.
+ */
+export function ProcurementUpsell({
+  controller,
+}: {
+  controller: ProcurementController;
+}) {
+  const { t } = useTranslation();
+  return (
+    <Card className="portal-proc__upsell">
+      <div className="portal-proc__upsell-text">
+        <span className="portal-proc__upsell-badge">
+          {t("portal.procurement.upsell.homeBadge")}
+        </span>
+        <p className="portal-proc__upsell-copy">
+          <strong>{t("portal.procurement.upsell.homeHeadline")} </strong>
+          {t("portal.procurement.upsell.homeBody")}
+        </p>
+      </div>
+      <Button
+        variant="secondary"
+        accent="default"
+        loading={controller.busy}
+        disabled={!controller.isLinked}
+        onClick={controller.onStartTrial}
+      >
+        {t("portal.procurement.upsell.homeCta")}
+      </Button>
+    </Card>
+  );
+}
+
+/** Deal-status hero when a deal is underway, otherwise the enterprise on-ramp. */
+export function ProcurementBanner({
+  controller,
+}: {
+  controller: ProcurementController;
+}) {
+  return controller.isLinked && controller.started && controller.data ? (
+    <ControlledDealStatusHero controller={controller} />
+  ) : (
+    <ProcurementUpsell controller={controller} />
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
new file mode 100644
index 0000000000..011902c35d
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
@@ -0,0 +1,181 @@
+import { useTranslation } from "react-i18next";
+import { Banner, Button, EmptyState, Skeleton } from "@app/ui";
+import { useUI } from "@portal/contexts/UIContext";
+import { JOURNEY } from "@portal/api/procurement";
+import { ProcurementAgreement } from "@portal/components/procurement/ProcurementAgreement";
+import {
+  KeyDocumentsModal,
+  ScheduleCallModal,
+  TrialManageModal,
+} from "@portal/components/procurement/ProcurementExtras";
+import { ProcurementModal } from "@portal/components/procurement/ProcurementModal";
+import {
+  LiveStageCard,
+  PaymentStageCard,
+  QuoteMilestoneCard,
+} from "@portal/components/procurement/ProcurementStages";
+import { QuoteBuilder } from "@portal/components/procurement/QuoteBuilder";
+import { StageStepper } from "@portal/components/procurement/StageStepper";
+import type { ProcurementController } from "@portal/components/procurement/useProcurement";
+
+/**
+ * The procurement takeover flow: the full-screen journey modal (quote builder →
+ * milestone → agreement → payment → live) plus the key-documents, schedule-call,
+ * and trial-management modals. Driven entirely by a shared ProcurementController
+ * so it can sit next to a deal-status hero rendered elsewhere (e.g. inside the
+ * tier hero card on Home).
+ */
+export function ProcurementFlow({
+  controller,
+}: {
+  controller: ProcurementController;
+}) {
+  const { t } = useTranslation();
+  const { openLinkModal } = useUI();
+  const {
+    isLinked,
+    loading,
+    data,
+    started,
+    stage,
+    latest,
+    isIssued,
+    isDraft,
+    busy,
+    downloading,
+    error,
+    setError,
+    open,
+    setOpen,
+    editing,
+    setEditing,
+    extra,
+    setExtra,
+    invoicePdf,
+    onExtendTrial,
+    onReset,
+    onGenerate,
+    onAcceptQuote,
+    onAgree,
+    onGoLive,
+    onDownloadPdf,
+  } = controller;
+
+  return (
+    <>
+      <ProcurementModal
+        open={open}
+        onClose={() => setOpen(false)}
+        title={t("portal.procurement.title")}
+        subtitle={t("portal.procurement.subtitle")}
+      >
+        {error && (
+          <Banner
+            tone="danger"
+            title={t("portal.procurement.error.title")}
+            onDismiss={() => setError(null)}
+          >
+            {error}
+          </Banner>
+        )}
+
+        {!isLinked && (
+          <EmptyState
+            eyebrow={t("portal.procurement.link.eyebrow")}
+            title={t("portal.procurement.link.title")}
+            description={t("portal.procurement.link.description")}
+            actions={
+              <Button
+                variant="primary"
+                accent="premium"
+                onClick={() => openLinkModal()}
+              >
+                {t("portal.procurement.link.cta")}
+              </Button>
+            }
+          />
+        )}
+
+        {isLinked && (loading || !started) && <Skeleton height="10rem" />}
+
+        {isLinked && started && (
+          <>
+            <div className="portal-proc__modal-stepper">
+              <StageStepper journey={JOURNEY} currentStage={stage!} />
+            </div>
+
+            {(editing ||
+              (isDraft && (stage === "trial" || stage === "quote"))) && (
+              <QuoteBuilder
+                deployment="cloud"
+                initial={latest?.config}
+                onGenerate={onGenerate}
+              />
+            )}
+
+            {!editing && isIssued && stage === "quote" && latest && (
+              <QuoteMilestoneCard
+                quote={latest}
+                busy={busy}
+                downloading={downloading}
+                onAccept={onAcceptQuote}
+                onDownload={onDownloadPdf}
+                onEdit={() => setEditing(true)}
+              />
+            )}
+
+            {!editing && stage === "security" && latest && (
+              <ProcurementAgreement
+                quote={latest}
+                busy={busy}
+                onAgree={onAgree}
+              />
+            )}
+
+            {!editing && stage === "procurement" && latest && (
+              <PaymentStageCard
+                invoiceUrl={latest.invoiceUrl}
+                invoicePdf={invoicePdf}
+                busy={busy}
+                onSimulate={onGoLive}
+              />
+            )}
+
+            {!editing && stage === "active" && <LiveStageCard />}
+
+            <div className="portal-proc__reset">
+              <button type="button" onClick={onReset} disabled={busy}>
+                {t("portal.procurement.reset")}
+              </button>
+            </div>
+          </>
+        )}
+      </ProcurementModal>
+
+      <KeyDocumentsModal
+        open={extra === "docs"}
+        onClose={() => setExtra(null)}
+      />
+      <ScheduleCallModal
+        open={extra === "schedule"}
+        onClose={() => setExtra(null)}
+      />
+      {data && (
+        <TrialManageModal
+          open={extra === "trial"}
+          onClose={() => setExtra(null)}
+          snapshot={data}
+          busy={busy}
+          onExtend={async () => {
+            await onExtendTrial();
+            setExtra(null);
+          }}
+          onCancel={async () => {
+            await onReset();
+            setExtra(null);
+          }}
+        />
+      )}
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
index 641bd55599..1877e0bc3c 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementHome.tsx
@@ -1,296 +1,22 @@
-import { useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Banner, Button, Card, EmptyState, Skeleton } from "@app/ui";
-import { usePortalLinked } from "@portal/contexts/usePortalLinked";
-import { useUI } from "@portal/contexts/UIContext";
-import { useView } from "@portal/contexts/ViewContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  acceptQuote,
-  extendTrial,
-  fetchQuotePdf,
-  fetchSnapshot,
-  goLive,
-  issueQuote,
-  JOURNEY,
-  resetProcurement,
-  startAgreement,
-  startTrial,
-  type ProcurementSnapshot,
-  type QuoteResult,
-} from "@portal/api/procurement";
-import { DealStatusHero } from "@portal/components/procurement/DealStatusHero";
-import { ProcurementAgreement } from "@portal/components/procurement/ProcurementAgreement";
-import {
-  KeyDocumentsModal,
-  ScheduleCallModal,
-  TrialManageModal,
-} from "@portal/components/procurement/ProcurementExtras";
-import { ProcurementModal } from "@portal/components/procurement/ProcurementModal";
-import {
-  LiveStageCard,
-  PaymentStageCard,
-  QuoteMilestoneCard,
-} from "@portal/components/procurement/ProcurementStages";
-import { QuoteBuilder } from "@portal/components/procurement/QuoteBuilder";
-import { StageStepper } from "@portal/components/procurement/StageStepper";
+import { ProcurementBanner } from "@portal/components/procurement/ProcurementBanner";
+import { ProcurementFlow } from "@portal/components/procurement/ProcurementFlow";
+import { useProcurement } from "@portal/components/procurement/useProcurement";
 import "@portal/views/Procurement.css";
 
 /**
- * The procurement experience on Home: a compact deal-status hero once a trial is running (or the
- * enterprise upsell on-ramp before it), both expanding into the full-screen takeover modal that
- * holds the journey — build + issue a quote (a Stripe Quote with a real PDF, the milestone the buyer
- * can share and return to), review + agree to the enterprise agreement, then accept into a committed
- * subscription. Starting a trial is a single click (no "start a trial" prompt); the deadline + next
- * steps then show on the hero. Rendered on Home and at /procurement (autoOpen). Gated on a link.
+ * The standalone procurement experience: a deal-status hero (or enterprise
+ * on-ramp when no deal exists) above the full-screen takeover flow that holds
+ * the journey — build + issue a quote, review + agree to the enterprise
+ * agreement, then accept into a committed subscription. Rendered at
+ * /procurement (autoOpen). On Home the deal-status hero instead attaches to the
+ * tier hero card's footer (see HomeHero) so this component isn't used there.
  */
 export function ProcurementHome({ autoOpen = false }: { autoOpen?: boolean }) {
-  const { t } = useTranslation();
-  const isLinked = usePortalLinked();
-  const { openLinkModal } = useUI();
-  const { setActiveView } = useView();
-
-  const state = useAsync<ProcurementSnapshot | null>(
-    () => (isLinked ? fetchSnapshot() : Promise.resolve(null)),
-    [isLinked],
-  );
-  const [snap, setSnap] = useState<ProcurementSnapshot | null>(null);
-  const [open, setOpen] = useState(false);
-  const [busy, setBusy] = useState(false);
-  const [editing, setEditing] = useState(false);
-  const [downloading, setDownloading] = useState(false);
-  const [invoicePdf, setInvoicePdf] = useState<string | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const [extra, setExtra] = useState<null | "docs" | "schedule" | "trial">(
-    null,
-  );
-
-  const data = snap ?? (state.loading ? null : state.data);
-  const started = data?.dealId != null;
-  const stage = data?.stage;
-  const latest = data?.latestQuote ?? null;
-  const isIssued = latest?.status === "sent" || latest?.status === "open";
-  // No live quote to act on (none yet, still a draft, or expired/canceled) → the buyer (re)builds.
-  const isDraft =
-    !latest ||
-    ["draft", "expired", "canceled", "cancelled"].includes(latest.status);
-
-  async function run(fn: () => Promise<unknown>) {
-    setBusy(true);
-    setError(null);
-    try {
-      await fn();
-      setSnap(await fetchSnapshot());
-    } catch (e) {
-      console.error("[procurement] action failed", e);
-      setError(e instanceof Error ? e.message : String(e));
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  const onStartTrial = () => run(startTrial);
-  const onExtendTrial = () => run(extendTrial);
-  const onReset = () =>
-    run(async () => {
-      await resetProcurement();
-      setEditing(false);
-      setInvoicePdf(null);
-    });
-  const onGenerate = (draft: QuoteResult) =>
-    run(async () => {
-      await issueQuote(draft.quoteId);
-      setEditing(false);
-    });
-  // Milestone → agreement (security) stage; then agreeing accepts into a subscription.
-  const onAcceptQuote = () => run(startAgreement);
-  const onAgree = () =>
-    run(async () => {
-      if (!latest) return;
-      const res = await acceptQuote(latest.quoteId);
-      setInvoicePdf(res.invoicePdf);
-    });
-
-  async function onDownloadPdf() {
-    if (!latest) return;
-    setDownloading(true);
-    try {
-      const blob = await fetchQuotePdf(latest.quoteId);
-      // A same-gesture <a download> click is reliable; window.open after an await is often
-      // popup-blocked (which is what made this take "a few goes").
-      const url = URL.createObjectURL(blob);
-      const a = document.createElement("a");
-      a.href = url;
-      a.download = `${latest.quoteNumber || "quote"}.pdf`;
-      document.body.appendChild(a);
-      a.click();
-      a.remove();
-      setTimeout(() => URL.revokeObjectURL(url), 60_000);
-    } catch (e) {
-      console.error("[procurement] quote PDF download failed", e);
-      setError(t("portal.procurement.milestone.downloadError"));
-    } finally {
-      setDownloading(false);
-    }
-  }
-
-  // A deep link (/procurement) opens the flow when a deal is already underway; if there's no deal
-  // yet it must NOT silently start a trial — leave the modal closed so the Start-trial CTA shows.
-  useEffect(() => {
-    if (autoOpen && started) setOpen(true);
-  }, [autoOpen, started]);
-
-  const banner =
-    isLinked && started && data ? (
-      <DealStatusHero
-        snapshot={data}
-        busy={busy}
-        onExpand={() => setOpen(true)}
-        onKeyDocs={() => setExtra("docs")}
-        onInvite={() => setActiveView("users")}
-        onSchedule={() => setExtra("schedule")}
-        onManageTrial={() => setExtra("trial")}
-        onNavigate={setActiveView}
-      />
-    ) : (
-      <Card className="portal-proc__upsell">
-        <div className="portal-proc__upsell-text">
-          <span className="portal-proc__upsell-badge">
-            {t("portal.procurement.upsell.homeBadge")}
-          </span>
-          <p className="portal-proc__upsell-copy">
-            <strong>{t("portal.procurement.upsell.homeHeadline")} </strong>
-            {t("portal.procurement.upsell.homeBody")}
-          </p>
-        </div>
-        <Button
-          variant="secondary"
-          accent="default"
-          loading={busy}
-          disabled={!isLinked}
-          onClick={onStartTrial}
-        >
-          {t("portal.procurement.upsell.homeCta")}
-        </Button>
-      </Card>
-    );
-
+  const controller = useProcurement(autoOpen);
   return (
     <>
-      {banner}
-      <ProcurementModal
-        open={open}
-        onClose={() => setOpen(false)}
-        title={t("portal.procurement.title")}
-        subtitle={t("portal.procurement.subtitle")}
-      >
-        {error && (
-          <Banner
-            tone="danger"
-            title={t("portal.procurement.error.title")}
-            onDismiss={() => setError(null)}
-          >
-            {error}
-          </Banner>
-        )}
-
-        {!isLinked && (
-          <EmptyState
-            eyebrow={t("portal.procurement.link.eyebrow")}
-            title={t("portal.procurement.link.title")}
-            description={t("portal.procurement.link.description")}
-            actions={
-              <Button
-                variant="primary"
-                accent="premium"
-                onClick={() => openLinkModal()}
-              >
-                {t("portal.procurement.link.cta")}
-              </Button>
-            }
-          />
-        )}
-
-        {isLinked && (state.loading || !started) && <Skeleton height="10rem" />}
-
-        {isLinked && started && (
-          <>
-            <div className="portal-proc__modal-stepper">
-              <StageStepper journey={JOURNEY} currentStage={stage!} />
-            </div>
-
-            {(editing ||
-              (isDraft && (stage === "trial" || stage === "quote"))) && (
-              <QuoteBuilder
-                deployment="cloud"
-                initial={latest?.config}
-                onGenerate={onGenerate}
-              />
-            )}
-
-            {!editing && isIssued && stage === "quote" && latest && (
-              <QuoteMilestoneCard
-                quote={latest}
-                busy={busy}
-                downloading={downloading}
-                onAccept={onAcceptQuote}
-                onDownload={onDownloadPdf}
-                onEdit={() => setEditing(true)}
-              />
-            )}
-
-            {!editing && stage === "security" && latest && (
-              <ProcurementAgreement
-                quote={latest}
-                busy={busy}
-                onAgree={onAgree}
-              />
-            )}
-
-            {!editing && stage === "procurement" && latest && (
-              <PaymentStageCard
-                invoiceUrl={latest.invoiceUrl}
-                invoicePdf={invoicePdf}
-                busy={busy}
-                onSimulate={() => run(goLive)}
-              />
-            )}
-
-            {!editing && stage === "active" && <LiveStageCard />}
-
-            <div className="portal-proc__reset">
-              <button type="button" onClick={onReset} disabled={busy}>
-                {t("portal.procurement.reset")}
-              </button>
-            </div>
-          </>
-        )}
-      </ProcurementModal>
-
-      <KeyDocumentsModal
-        open={extra === "docs"}
-        onClose={() => setExtra(null)}
-      />
-      <ScheduleCallModal
-        open={extra === "schedule"}
-        onClose={() => setExtra(null)}
-      />
-      {data && (
-        <TrialManageModal
-          open={extra === "trial"}
-          onClose={() => setExtra(null)}
-          snapshot={data}
-          busy={busy}
-          onExtend={async () => {
-            await onExtendTrial();
-            setExtra(null);
-          }}
-          onCancel={async () => {
-            await onReset();
-            setExtra(null);
-          }}
-        />
-      )}
+      <ProcurementBanner controller={controller} />
+      <ProcurementFlow controller={controller} />
     </>
   );
 }
diff --git a/frontend/editor/src/portal/components/procurement/useProcurement.ts b/frontend/editor/src/portal/components/procurement/useProcurement.ts
new file mode 100644
index 0000000000..70f64f8f30
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/useProcurement.ts
@@ -0,0 +1,179 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { usePortalLinked } from "@portal/contexts/usePortalLinked";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  acceptQuote,
+  extendTrial,
+  fetchQuotePdf,
+  fetchSnapshot,
+  goLive,
+  issueQuote,
+  resetProcurement,
+  startAgreement,
+  startTrial,
+  type ProcurementSnapshot,
+  type QuoteResult,
+} from "@portal/api/procurement";
+
+export type ProcurementExtra = null | "docs" | "schedule" | "trial";
+
+/**
+ * Owns the procurement deal state and actions shared by the Home hero footer
+ * (deal-status hero) and the takeover flow modals. Extracted from
+ * ProcurementHome so the deal-status hero can render inside the tier hero card
+ * while the flow modals live alongside it. Gated on an account link.
+ */
+export interface ProcurementController {
+  isLinked: boolean;
+  loading: boolean;
+  data: ProcurementSnapshot | null;
+  started: boolean;
+  stage: ProcurementSnapshot["stage"] | undefined;
+  latest: QuoteResult | null;
+  isIssued: boolean;
+  isDraft: boolean;
+  busy: boolean;
+  downloading: boolean;
+  error: string | null;
+  setError: (e: string | null) => void;
+  open: boolean;
+  setOpen: (b: boolean) => void;
+  editing: boolean;
+  setEditing: (b: boolean) => void;
+  extra: ProcurementExtra;
+  setExtra: (e: ProcurementExtra) => void;
+  invoicePdf: string | null;
+  onStartTrial: () => void;
+  onExtendTrial: () => void;
+  onReset: () => void;
+  onGenerate: (draft: QuoteResult) => void;
+  onAcceptQuote: () => void;
+  onAgree: () => void;
+  onGoLive: () => void;
+  onDownloadPdf: () => Promise<void>;
+}
+
+export function useProcurement(autoOpen = false): ProcurementController {
+  const { t } = useTranslation();
+  const isLinked = usePortalLinked();
+
+  const state = useAsync<ProcurementSnapshot | null>(
+    () => (isLinked ? fetchSnapshot() : Promise.resolve(null)),
+    [isLinked],
+  );
+  const [snap, setSnap] = useState<ProcurementSnapshot | null>(null);
+  const [open, setOpen] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [editing, setEditing] = useState(false);
+  const [downloading, setDownloading] = useState(false);
+  const [invoicePdf, setInvoicePdf] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [extra, setExtra] = useState<ProcurementExtra>(null);
+
+  const data = snap ?? (state.loading ? null : state.data);
+  const started = data?.dealId != null;
+  const stage = data?.stage;
+  const latest = data?.latestQuote ?? null;
+  const isIssued = latest?.status === "sent" || latest?.status === "open";
+  // No live quote to act on (none yet, still a draft, or expired/canceled) → the buyer (re)builds.
+  const isDraft =
+    !latest ||
+    ["draft", "expired", "canceled", "cancelled"].includes(latest.status);
+
+  async function run(fn: () => Promise<unknown>) {
+    setBusy(true);
+    setError(null);
+    try {
+      await fn();
+      setSnap(await fetchSnapshot());
+    } catch (e) {
+      console.error("[procurement] action failed", e);
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const onStartTrial = () => run(startTrial);
+  const onExtendTrial = () => run(extendTrial);
+  const onReset = () =>
+    run(async () => {
+      await resetProcurement();
+      setEditing(false);
+      setInvoicePdf(null);
+    });
+  const onGenerate = (draft: QuoteResult) =>
+    run(async () => {
+      await issueQuote(draft.quoteId);
+      setEditing(false);
+    });
+  // Milestone → agreement (security) stage; then agreeing accepts into a subscription.
+  const onAcceptQuote = () => run(startAgreement);
+  const onAgree = () =>
+    run(async () => {
+      if (!latest) return;
+      const res = await acceptQuote(latest.quoteId);
+      setInvoicePdf(res.invoicePdf);
+    });
+  const onGoLive = () => run(goLive);
+
+  async function onDownloadPdf() {
+    if (!latest) return;
+    setDownloading(true);
+    try {
+      const blob = await fetchQuotePdf(latest.quoteId);
+      // A same-gesture <a download> click is reliable; window.open after an await is often
+      // popup-blocked (which is what made this take "a few goes").
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = `${latest.quoteNumber || "quote"}.pdf`;
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      setTimeout(() => URL.revokeObjectURL(url), 60_000);
+    } catch (e) {
+      console.error("[procurement] quote PDF download failed", e);
+      setError(t("portal.procurement.milestone.downloadError"));
+    } finally {
+      setDownloading(false);
+    }
+  }
+
+  // A deep link (/procurement) opens the flow when a deal is already underway; if there's no deal
+  // yet it must NOT silently start a trial — leave the modal closed so the Start-trial CTA shows.
+  useEffect(() => {
+    if (autoOpen && started) setOpen(true);
+  }, [autoOpen, started]);
+
+  return {
+    isLinked,
+    loading: state.loading,
+    data,
+    started,
+    stage,
+    latest,
+    isIssued,
+    isDraft,
+    busy,
+    downloading,
+    error,
+    setError,
+    open,
+    setOpen,
+    editing,
+    setEditing,
+    extra,
+    setExtra,
+    invoicePdf,
+    onStartTrial,
+    onExtendTrial,
+    onReset,
+    onGenerate,
+    onAcceptQuote,
+    onAgree,
+    onGoLive,
+    onDownloadPdf,
+  };
+}
diff --git a/frontend/editor/src/portal/mocks/editorDeploy.ts b/frontend/editor/src/portal/mocks/editorDeploy.ts
index 398ef69470..32d98432f2 100644
--- a/frontend/editor/src/portal/mocks/editorDeploy.ts
+++ b/frontend/editor/src/portal/mocks/editorDeploy.ts
@@ -108,6 +108,8 @@ export interface DeploymentSummary {
   serviceToken: { masked: string; lastRotated: string };
   /** Air-gapped activation is enterprise-only; gate the card on this flag. */
   offlineActivationAvailable: boolean;
+  /** Where users launch the Editor — the org workspace URL (Open in browser). */
+  workspaceUrl: string;
 }
 
 export interface EditorDeploymentResponse {
@@ -377,6 +379,7 @@ function summaryFor(
       lastRotated: tier === "enterprise" ? "11 days ago" : "34 days ago",
     },
     offlineActivationAvailable: tier === "enterprise",
+    workspaceUrl: "https://app.stirlingpdf.com/o/acme/editor",
   };
 }
 
diff --git a/frontend/editor/src/portal/mocks/handlers/home.ts b/frontend/editor/src/portal/mocks/handlers/home.ts
index d5ba2825a0..5f295a7267 100644
--- a/frontend/editor/src/portal/mocks/handlers/home.ts
+++ b/frontend/editor/src/portal/mocks/handlers/home.ts
@@ -5,7 +5,6 @@ import {
   buildUsageSeriesResponse,
   enterpriseKpisFor,
   FREE_KPIS,
-  FREE_ONBOARDING,
   proKpisFor,
   RECENT_ACTIVITY,
   REGION_HEALTH,
@@ -41,9 +40,4 @@ export const homeHandlers = [
     await delay(120);
     return HttpResponse.json(REGION_HEALTH);
   }),
-
-  http.get("/v1/onboarding", async () => {
-    await delay(120);
-    return HttpResponse.json(FREE_ONBOARDING);
-  }),
 ];
diff --git a/frontend/editor/src/portal/mocks/home.ts b/frontend/editor/src/portal/mocks/home.ts
index 125a25d336..373ae4adc1 100644
--- a/frontend/editor/src/portal/mocks/home.ts
+++ b/frontend/editor/src/portal/mocks/home.ts
@@ -280,42 +280,6 @@ export const PIPELINE_STAGES: PipelineStage[] = [
   { key: "store", label: "Store", detail: "Emit JSON, persist, notify" },
 ];
 
-export interface OnboardingStep {
-  id: string;
-  title: string;
-  blurb: string;
-  done: boolean;
-  /** What to render in the per-step CTA slot. */
-  cta?: { kind: "try-op" } | { kind: "navigate"; target: string };
-}
-
-export const FREE_ONBOARDING: OnboardingStep[] = [
-  {
-    id: "first-op",
-    title: "Run your first operation",
-    blurb: "Try extract, redact, or OCR on a sample document.",
-    done: true,
-    cta: { kind: "try-op" },
-  },
-  {
-    id: "connect-source",
-    title: "Connect a source",
-    blurb: "Attach an S3 bucket, webhook, or email inbox.",
-    done: false,
-    cta: { kind: "navigate", target: "sources" },
-  },
-  {
-    id: "build-pipeline",
-    title: "Build a pipeline",
-    blurb: "Compose ops into a repeatable workflow.",
-    done: false,
-    cta: { kind: "navigate", target: "pipelines" },
-  },
-  {
-    id: "wire-agent",
-    title: "Wire an agent",
-    blurb: "Expose Stirling via MCP or REST tool definitions.",
-    done: false,
-    cta: { kind: "navigate", target: "sources" },
-  },
-];
+// The free/subscribed "Finish setting up" checklist is no longer fixture-driven:
+// SetupChecklist builds its steps client-side and derives completion from the
+// live policies + sources APIs. See components/SetupChecklist.tsx.
diff --git a/frontend/editor/src/portal/views/Home.css b/frontend/editor/src/portal/views/Home.css
index c2f8bf6f23..7a4a1f5a37 100644
--- a/frontend/editor/src/portal/views/Home.css
+++ b/frontend/editor/src/portal/views/Home.css
@@ -7,6 +7,23 @@
   margin: 0 auto;
 }
 
+/* Paid-tier greeting header */
+.portal-home__greeting {
+  margin-bottom: -0.25rem;
+}
+.portal-home__greeting-title {
+  margin: 0 0 0.25rem;
+  font-size: 1.5rem;
+  font-weight: 700;
+  letter-spacing: -0.02em;
+  color: var(--color-text-2);
+}
+.portal-home__greeting-date {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+}
+
 /* Product card grid */
 .portal-home__product-grid {
   display: grid;
@@ -138,90 +155,6 @@
   color: var(--color-blue);
 }
 
-/* Free-tier onboarding card */
-.portal-home__onboard-head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 0.5rem;
-  margin-bottom: 0.875rem;
-}
-
-.portal-home__onboard-title {
-  margin: 0;
-  font-size: 0.9375rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-home__onboard-sub {
-  margin: 0;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-home__onboard-list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-home__onboard-step {
-  display: grid;
-  grid-template-columns: auto 1fr auto;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 0.5rem 0.625rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-}
-
-.portal-home__onboard-step.is-done {
-  background: var(--color-green-light);
-  border-color: color-mix(in srgb, var(--color-green) 30%, transparent);
-}
-
-.portal-home__onboard-mark {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.5rem;
-  height: 1.5rem;
-  border-radius: 50%;
-  font-size: 0.75rem;
-  font-weight: 600;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  color: var(--color-text-4);
-}
-
-.portal-home__onboard-step.is-done .portal-home__onboard-mark {
-  background: var(--color-green);
-  color: var(--color-text-on-accent);
-  border-color: var(--color-green);
-}
-
-.portal-home__onboard-text {
-  display: flex;
-  flex-direction: column;
-  min-width: 0;
-}
-
-.portal-home__onboard-text strong {
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-  font-weight: 600;
-}
-
-.portal-home__onboard-text span {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
 /* Enterprise region strip */
 .portal-home__regions {
   display: grid;
diff --git a/frontend/editor/src/portal/views/Home.stories.tsx b/frontend/editor/src/portal/views/Home.stories.tsx
index 6e7aec49a0..feed3f25da 100644
--- a/frontend/editor/src/portal/views/Home.stories.tsx
+++ b/frontend/editor/src/portal/views/Home.stories.tsx
@@ -14,6 +14,32 @@ export const ProTier: Story = { globals: { tier: "pro" } };
 export const FreeTier: Story = { globals: { tier: "free" } };
 export const EnterpriseTier: Story = { globals: { tier: "enterprise" } };
 
+/**
+ * A subscribed org with a procurement deal underway: the deal-status hero
+ * replaces the setup checklist as the editor hero's footer (procurement is a
+ * bolt-on to any tier). Seeds an active trial snapshot on the SaaS mock.
+ */
+export const SubscribedInProcurement: Story = {
+  globals: { tier: "pro" },
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("http://saas.mock/api/v1/procurement", () =>
+          HttpResponse.json({
+            dealId: 1,
+            stage: "trial",
+            trialStartedAt: "2026-07-01T00:00:00.000Z",
+            trialEndsAt: "2026-07-21T00:00:00.000Z",
+            trialExtensionsUsed: 0,
+            licensed: true,
+            latestQuote: null,
+          }),
+        ),
+      ],
+    },
+  },
+};
+
 export const SlowUsage: Story = {
   globals: { tier: "pro" },
   parameters: {
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index fef96810e1..ff247271c6 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -14,21 +14,19 @@ import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import {
   fetchHomeKpis,
-  fetchOnboarding,
   fetchRegionHealth,
   fetchUsageSeries,
   type KpiEntry,
-  type OnboardingStep,
   type RegionHealth,
   type UsageSeriesResponse,
 } from "@portal/api/home";
-import { WelcomeCarousel } from "@portal/components/WelcomeCarousel";
+import { HomeHero } from "@portal/components/HomeHero";
+import { HomeGreeting } from "@portal/components/HomeGreeting";
 import { PopularUseCases } from "@portal/components/PopularUseCases";
 import { UsageAreaChart } from "@portal/components/UsageAreaChart";
 import { RecentActivity } from "@portal/components/RecentActivity";
 import { SingleOpRunner } from "@portal/components/SingleOpRunner";
 import { ProcessingStatusStrip } from "@portal/components/ProcessingStatusStrip";
-import { ProcurementHome } from "@portal/components/procurement/ProcurementHome";
 import { PolicySummary } from "@portal/components/PolicySummary";
 import { PipelineForkWizard } from "@portal/components/PipelineForkWizard";
 import "@portal/views/Home.css";
@@ -234,117 +232,6 @@ function QuickActions({ onTryOp }: { onTryOp: () => void }) {
   );
 }
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Free-tier onboarding checklist                                           */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-function FreeOnboarding({ onTryOp }: { onTryOp: () => void }) {
-  const { t } = useTranslation();
-  const { setActiveView } = useView();
-  const state = useAsync<OnboardingStep[]>(() => fetchOnboarding(), []);
-  const { data: steps } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const doneCount = steps?.filter((s) => s.done).length ?? 0;
-
-  function renderCta(step: OnboardingStep) {
-    if (step.done) {
-      return (
-        <Button size="sm" variant="tertiary" onClick={onTryOp}>
-          {t("portal.home.onboarding.runAgain")}
-        </Button>
-      );
-    }
-    if (!step.cta) return null;
-    if (step.cta.kind === "try-op") {
-      return (
-        <Button size="sm" variant="secondary" onClick={onTryOp}>
-          {t("portal.home.onboarding.start")}
-        </Button>
-      );
-    }
-    const target = step.cta.target;
-    return (
-      <Button
-        size="sm"
-        variant="secondary"
-        onClick={() => setActiveView(target as ViewId)}
-      >
-        {t("portal.home.onboarding.start")}
-      </Button>
-    );
-  }
-
-  return (
-    <Card padding="loose" className="portal-home__onboard">
-      <div className="portal-home__onboard-head">
-        <div>
-          <h2 className="portal-home__onboard-title">
-            {t("portal.home.onboarding.title")}
-          </h2>
-          <p className="portal-home__onboard-sub">
-            {t("portal.home.onboarding.subtitle")}
-          </p>
-        </div>
-        {steps && steps.length > 0 && (
-          <StatusBadge tone="info" size="sm">
-            {t("portal.home.onboarding.progress", {
-              done: doneCount,
-              total: steps.length,
-            })}
-          </StatusBadge>
-        )}
-      </div>
-
-      {isLoading && (
-        <ol className="portal-home__onboard-list" aria-hidden>
-          {Array.from({ length: 4 }).map((_, i) => (
-            <li
-              key={`skel-${i}`}
-              className="portal-home__onboard-step is-loading"
-            >
-              <span className="portal-home__onboard-mark" />
-              <div className="portal-home__onboard-text">
-                <div className="portal-home__onboard-skel" />
-              </div>
-            </li>
-          ))}
-        </ol>
-      )}
-
-      {isEmpty && (
-        <EmptyState
-          size="compact"
-          title={t("portal.home.onboarding.empty.title")}
-          description={t("portal.home.onboarding.empty.description")}
-        />
-      )}
-
-      {steps && steps.length > 0 && (
-        <ol className="portal-home__onboard-list">
-          {steps.map((s, i) => (
-            <li
-              key={s.id}
-              className={
-                "portal-home__onboard-step" + (s.done ? " is-done" : "")
-              }
-            >
-              <span className="portal-home__onboard-mark">
-                {s.done ? "✓" : i + 1}
-              </span>
-              <div className="portal-home__onboard-text">
-                <strong>{s.title}</strong>
-                <span>{s.blurb}</span>
-              </div>
-              {renderCta(s)}
-            </li>
-          ))}
-        </ol>
-      )}
-    </Card>
-  );
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Tier KPI strip                                                           */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -543,18 +430,18 @@ export function Home() {
 
   return (
     <div className="portal-home">
-      <WelcomeCarousel onTryOp={() => setRunnerOpen(true)} />
-      <ProcessingStatusStrip />
+      {/* Paid tiers open with a greeting; free opens straight with the banner. */}
+      {tier !== "free" && <HomeGreeting />}
 
-      <ProcurementHome />
+      {/* Per-tier hero. Its footer is the deal-status hero while a procurement
+          deal is underway (a bolt-on to any tier), otherwise the setup checklist. */}
+      <HomeHero tier={tier} />
 
       {tier === "free" && (
         <>
+          <ProcessingStatusStrip />
           <TierKpiStrip />
-          <div className="portal-home__row">
-            <FreeOnboarding onTryOp={() => setRunnerOpen(true)} />
-            <QuickActions onTryOp={() => setRunnerOpen(true)} />
-          </div>
+          <QuickActions onTryOp={() => setRunnerOpen(true)} />
           <PolicySummary />
           <PipelineForkWizard />
           <ProductGrid />
@@ -564,6 +451,7 @@ export function Home() {
 
       {tier === "pro" && (
         <>
+          <ProcessingStatusStrip />
           <ChartSection />
           <TierKpiStrip />
           <div className="portal-home__row">
@@ -579,6 +467,7 @@ export function Home() {
 
       {tier === "enterprise" && (
         <>
+          <ProcessingStatusStrip />
           <ChartSection />
           <TierKpiStrip />
           <EnterpriseRegions />
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 99fa3bf55f..d954ca4006 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -240,6 +240,20 @@ export default defineConfig(
       "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],
     },
   },
+  // TEMPORARY (same rationale as procurement above): the portal home hero
+  // reuses the same bespoke CSS-styled raw <button> controls as the procurement
+  // deal hero — status/invite chips and full-width checklist rows that the
+  // shared Button can't represent. Exempt ONLY the raw-<button> rule; the
+  // Mantine import bans stay. Migrate these alongside the procurement buttons.
+  {
+    files: [
+      "editor/src/portal/components/EditorStatusCard.tsx",
+      "editor/src/portal/components/SetupChecklist.tsx",
+    ],
+    rules: {
+      "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],
+    },
+  },
   // Stricter rules that not all sub-folders are conformant to yet.
   {
     files: srcGlobs,

From 18b0b19a67d143cf4f46c0ee09651b27a9cf5358 Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:09:23 +0100
Subject: [PATCH 29/35] Block file exit points while a per-file policy run is
 enforcing (#6904)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

While a per-file policy run is in flight, the editor now blocks every
way the file can leave the app, and shows why:

- **Viewer** — a blocking overlay with live progress ("Enforcing
policy…"). Dismissible: collapses to a corner badge (top right, tinted
with the policy's accent) so the file stays readable while the run
finishes.
- **Workbench bar** — Print / Download / Save As / Share are disabled
with an explanatory tooltip and progress bar. The Ctrl+P shortcut and
the form-fill bar's "Download PDF" button are covered too.
- **File lists** — the file sidebar, file-editor thumbnails, and files
page show a spinning shield badge on the affected file, and thumbnail
hover actions (download / upload to server) are blocked with the same
tooltip.

Once a run settles, everything unblocks — including FAILED and CANCELLED
runs. A failed check surfaces through the run's activity feed; it never
locks the user out of their file.

## Why

Upload-triggered policies exist so the enforced output is what leaves
the app. Before this, a file could be printed, downloaded, or shared
while its policy run was still processing.

## Also in here

- **One shared `PolicyBadges` component** — the sidebar, thumbnails, and
files page each had their own copy of the badge markup/CSS and had
drifted (different sizes, tints, missing spinner and glow on the files
page, hardcoded English tooltips). All badge surfaces now render the
same component: accent-tinted shield, spinner while enforcing, one-off
glow when recent, i18n'd tooltips.
- **Cascade fix:** outputs imported from reconciled
(server-rediscovered) runs are now tagged `derivedFromTool`, stopping an
auto-run → import → auto-run loop that produced ever-growing
`_sanitized_sanitized…` filename chains on fresh devices.
- **Core stub for `policyRunStore`** so the core build compiles —
`WorkbenchBar` and `ViewerShareButton` resolve `usePolicyRuns` via
`@app/*`.

## Testing

- `task frontend:check` green: proprietary typecheck, ESLint + dpdm,
Prettier, 915+ editor + 81 portal unit tests.
- `typecheck:core` / `saas` / `desktop` variants all pass.
- Enforcement flow exercised manually against a live backend with an
upload-triggered policy (overlay + progress during the run, dismiss to
corner badge, unblock on completion).

---------

Co-authored-by: James Brunton <jbrunton96@gmail.com>
---
 .../public/locales/en-US/translation.toml     |   8 +
 .../core/components/fileEditor/FileEditor.tsx |  62 +++----
 .../fileEditor/FileEditorThumbnail.module.css |  15 ++
 .../fileEditor/FileEditorThumbnail.tsx        | 106 ++++++++----
 .../core/components/filesPage/FileGrid.tsx    |  23 +--
 .../core/components/filesPage/FilesPage.css   |  18 --
 .../components/policies/policyRunStore.ts     |  27 +++
 .../components/shared/FileSidebarFileItem.css |  45 -----
 .../components/shared/FileSidebarFileItem.tsx | 159 ++++++++++--------
 .../components/shared/HoverActionMenu.tsx     |  30 ++--
 .../core/components/shared/PolicyBadges.css   |  62 +++++++
 .../core/components/shared/PolicyBadges.tsx   |  72 ++++++++
 .../shared/PolicyEnforcingOverlay.tsx         |   7 +
 .../core/components/shared/WorkbenchBar.tsx   |  88 +++++++++-
 .../core/components/viewer/EmbedPdfViewer.tsx |  15 +-
 .../components/viewer/ViewerShareButton.tsx   |  58 ++++++-
 .../editor/src/core/contexts/FileContext.tsx  |   1 +
 .../src/core/contexts/file/fileActions.ts     |   4 +
 .../src/core/hooks/usePolicyFileBadges.ts     |   2 +-
 .../src/core/tools/formFill/FormSaveBar.tsx   |   5 +-
 .../components/policies/policyRunStore.ts     |  24 ++-
 .../components/policies/policyStatus.ts       |  14 ++
 .../policies/usePolicyAutoRun.import.test.tsx |  13 +-
 .../components/policies/usePolicyAutoRun.ts   |  23 ++-
 .../shared/PolicyEnforcingOverlay.tsx         |  91 ++++++++++
 .../viewer/PolicyEnforcementOverlay.tsx       |  75 +++++++++
 .../proprietary/components/viewer/Viewer.tsx  |  59 +++++++
 .../hooks/usePolicyFileBadges.test.ts         |  69 ++++++++
 .../proprietary/hooks/usePolicyFileBadges.ts  |  51 ++++--
 29 files changed, 961 insertions(+), 265 deletions(-)
 create mode 100644 frontend/editor/src/core/components/policies/policyRunStore.ts
 create mode 100644 frontend/editor/src/core/components/shared/PolicyBadges.css
 create mode 100644 frontend/editor/src/core/components/shared/PolicyBadges.tsx
 create mode 100644 frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
 create mode 100644 frontend/editor/src/proprietary/components/viewer/PolicyEnforcementOverlay.tsx
 create mode 100644 frontend/editor/src/proprietary/components/viewer/Viewer.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 55397ccb9e..233760298a 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6062,6 +6062,14 @@ stepOf = "Step {{step}} of {{total}}"
 toolChainDesc = "Configure the tools this policy runs on each document."
 typesSelected = "{{count}} types selected"
 
+[policy]
+badgeEnforcing = "{{name}} enforcing..."
+badgeRan = "{{name}} policy ran on this file"
+blockingAction = "{{action}} blocked while enforcing policy, please wait..."
+dismiss = "Dismiss overlay"
+enforcingTitle = "Enforcing policy..."
+viewAnyway = "View file (policy still enforcing)"
+
 [portal.accountLink.card]
 billingNote = "Unattended processing bills against your org wallet."
 eyebrow = "Account link"
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditor.tsx b/frontend/editor/src/core/components/fileEditor/FileEditor.tsx
index ed8944fb01..8cfef80d83 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditor.tsx
+++ b/frontend/editor/src/core/components/fileEditor/FileEditor.tsx
@@ -1,4 +1,4 @@
-import { useState, useCallback, useMemo, useEffect } from "react";
+import { useState, useCallback, useMemo, useEffect, useRef } from "react";
 import { flushSync } from "react-dom";
 import { Center, Box, LoadingOverlay } from "@mantine/core";
 import { Dropzone } from "@mantine/dropzone";
@@ -19,6 +19,10 @@ import { FileId, StirlingFile } from "@app/types/fileContext";
 import { alert } from "@app/components/toast";
 import { downloadFileWithPolicy as downloadFile } from "@app/services/exportWithPolicy";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
+import { usePolicyFileBadges } from "@app/hooks/usePolicyFileBadges";
+import type { FileItemPolicyRef } from "@app/components/shared/PolicyBadges";
+
+const EMPTY_POLICIES: FileItemPolicyRef[] = [];
 
 interface FileEditorProps {
   onOpenPageEditor?: () => void;
@@ -31,6 +35,8 @@ const FileEditor = ({
   toolMode = false,
   supportedExtensions = ["pdf"],
 }: FileEditorProps) => {
+  const policyFileBadges = usePolicyFileBadges();
+
   // Utility function to check if a file extension is supported
   const isFileSupported = useCallback(
     (fileName: string): boolean => {
@@ -52,6 +58,14 @@ const FileEditor = ({
     [state.files.byId, state.files.ids],
   );
 
+  // Always-current refs so callbacks can read the latest stubs/selection without
+  // closing over them as deps — prevents every callback from regenerating whenever
+  // any stub changes (e.g. thumbnail load), which would bust React.memo on every thumbnail.
+  const stubsRef = useRef(activeStirlingFileStubs);
+  stubsRef.current = activeStirlingFileStubs;
+  const selectedFileIdsRef = useRef(selectedFileIds);
+  selectedFileIdsRef.current = selectedFileIds;
+
   // Get navigation actions
   const { actions: navActions } = useNavigationActions();
 
@@ -141,7 +155,7 @@ const FileEditor = ({
   // File reordering handler for drag and drop
   const handleReorderFiles = useCallback(
     (sourceFileId: FileId, targetFileId: FileId, selectedFileIds: FileId[]) => {
-      const currentIds = activeStirlingFileStubs.map((r) => r.id);
+      const currentIds = stubsRef.current.map((r) => r.id);
 
       // Find indices
       const sourceIndex = currentIds.findIndex((id) => id === sourceFileId);
@@ -211,38 +225,27 @@ const FileEditor = ({
       const moveCount = filesToMove.length;
       showStatus(`${moveCount > 1 ? `${moveCount} files` : "File"} reordered`);
     },
-    [activeStirlingFileStubs, reorderFiles, _setStatus],
+    [reorderFiles, showStatus],
   );
 
   // File operations using context
   const handleCloseFile = useCallback(
     (fileId: FileId) => {
-      const record = activeStirlingFileStubs.find((r) => r.id === fileId);
+      const record = stubsRef.current.find((r) => r.id === fileId);
       const file = record ? selectors.getFile(record.id) : null;
       if (record && file) {
-        // Remove file from context but keep in storage (close, don't delete)
-        const contextFileId = record.id;
-        removeFiles([contextFileId], false);
-
-        // Remove from context selections
-        const currentSelected = selectedFileIds.filter(
-          (id) => id !== contextFileId,
+        removeFiles([record.id], false);
+        setSelectedFiles(
+          selectedFileIdsRef.current.filter((id) => id !== record.id),
         );
-        setSelectedFiles(currentSelected);
       }
     },
-    [
-      activeStirlingFileStubs,
-      selectors,
-      removeFiles,
-      setSelectedFiles,
-      selectedFileIds,
-    ],
+    [selectors, removeFiles, setSelectedFiles],
   );
 
   const handleDownloadFile = useCallback(
     async (fileId: FileId) => {
-      const record = activeStirlingFileStubs.find((r) => r.id === fileId);
+      const record = stubsRef.current.find((r) => r.id === fileId);
       const file = record ? selectors.getFile(record.id) : null;
       console.log("[FileEditor] handleDownloadFile called:", {
         fileId,
@@ -278,12 +281,12 @@ const FileEditor = ({
         }
       }
     },
-    [activeStirlingFileStubs, selectors, fileActions],
+    [selectors, fileActions],
   );
 
   const handleUnzipFile = useCallback(
     async (fileId: FileId) => {
-      const record = activeStirlingFileStubs.find((r) => r.id === fileId);
+      const record = stubsRef.current.find((r) => r.id === fileId);
       const file = record ? selectors.getFile(record.id) : null;
       if (record && file) {
         try {
@@ -326,24 +329,19 @@ const FileEditor = ({
         }
       }
     },
-    [activeStirlingFileStubs, selectors, fileActions, removeFiles],
+    [selectors, fileActions, removeFiles],
   );
 
   const handleViewFile = useCallback(
     (fileId: FileId) => {
-      const index = activeStirlingFileStubs.findIndex((r) => r.id === fileId);
+      const index = stubsRef.current.findIndex((r) => r.id === fileId);
       if (index !== -1) {
         setActiveFileId(fileId as string);
         setActiveFileIndex(index);
         navActions.setWorkbench("viewer");
       }
     },
-    [
-      activeStirlingFileStubs,
-      setActiveFileId,
-      setActiveFileIndex,
-      navActions.setWorkbench,
-    ],
+    [setActiveFileId, setActiveFileIndex, navActions.setWorkbench],
   );
 
   const handleLoadFromStorage = useCallback(async (selectedFiles: File[]) => {
@@ -412,6 +410,10 @@ const FileEditor = ({
                     onUnzipFile={handleUnzipFile}
                     toolMode={toolMode}
                     isSupported={isFileSupported(record.name)}
+                    policies={
+                      policyFileBadges.get(record.id as string) ??
+                      EMPTY_POLICIES
+                    }
                   />
                 );
               })}
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
index fcd0335238..f0e0ce91bc 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
@@ -123,6 +123,14 @@
   left: 0;
   right: 0;
   bottom: calc(var(--file-meta-line-height) + var(--file-meta-gap));
+  display: flex;
+  align-items: flex-start;
+  justify-content: center;
+  gap: 4px;
+  overflow: hidden;
+}
+
+.fileNameText {
   display: -webkit-box;
   -webkit-line-clamp: 2;
   line-clamp: 2;
@@ -131,6 +139,12 @@
   text-overflow: ellipsis;
   overflow-wrap: break-word;
   word-break: normal;
+  min-width: 0;
+}
+
+/* Layout-only wrapper for the shared PolicyBadges row in the file-name line. */
+.fileNameBadges {
+  padding-top: 2px;
 }
 
 .fileMeta {
@@ -207,6 +221,7 @@
   pointer-events: auto;
 }
 
+/* Policy badges pinned to top-right of thumbnail */
 .statusDot {
   display: inline-block;
   width: 8px;
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
index 07d134f75c..fe834b43d7 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
@@ -1,5 +1,5 @@
 import React, { useState, useCallback, useRef, useMemo } from "react";
-import { Text, Modal, Group, Stack, Tooltip } from "@mantine/core";
+import { Text, Modal, Group, Loader, Stack, Tooltip } from "@mantine/core";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { Button } from "@app/ui/Button";
 import { useIsMobile } from "@app/hooks/useIsMobile";
@@ -16,11 +16,17 @@ import HistoryIcon from "@mui/icons-material/History";
 import PushPinIcon from "@mui/icons-material/PushPin";
 import LockOpenIcon from "@mui/icons-material/LockOpen";
 import DragIndicatorIcon from "@mui/icons-material/DragIndicator";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import {
   draggable,
   dropTargetForElements,
 } from "@atlaskit/pragmatic-drag-and-drop/element/adapter";
 import { StirlingFileStub } from "@app/types/fileContext";
+import {
+  PolicyBadges,
+  type FileItemPolicyRef,
+} from "@app/components/shared/PolicyBadges";
+import { PolicyEnforcingOverlay } from "@app/components/shared/PolicyEnforcingOverlay";
 import { zipFileService } from "@app/services/zipFileService";
 
 import styles from "@app/components/fileEditor/FileEditorThumbnail.module.css";
@@ -57,6 +63,7 @@ interface FileEditorThumbnailProps {
   onUnzipFile?: (fileId: FileId) => void;
   toolMode?: boolean;
   isSupported?: boolean;
+  policies?: FileItemPolicyRef[];
 }
 
 const FileEditorThumbnail = ({
@@ -67,6 +74,7 @@ const FileEditorThumbnail = ({
   onDownloadFile,
   onUnzipFile,
   isSupported = true,
+  policies = [],
 }: FileEditorThumbnailProps) => {
   const { t } = useTranslation();
   const { config } = useAppConfig();
@@ -286,8 +294,28 @@ const FileEditorThumbnail = ({
 
   const [showVersionHistory, setShowVersionHistory] = useState(false);
 
-  const hoverActions = useMemo<HoverAction[]>(
-    () => [
+  const policyEnforcing = policies.some((p) => p.enforcing);
+
+  const hoverActions = useMemo<HoverAction[]>(() => {
+    const uploadLabel = isUploaded
+      ? t("fileManager.updateOnServer", "Update on Server")
+      : t("fileManager.uploadToServer", "Upload to Server");
+    const enforcingTooltip = (action: string): React.ReactNode => (
+      <Stack gap={4} py={2} w={180}>
+        <Group gap={6} wrap="nowrap">
+          <ShieldOutlinedIcon style={{ fontSize: 13 }} />
+          <Text size="xs" fw={600}>
+            {t(
+              "policy.blockingAction",
+              "{{action}} blocked while enforcing policy, please wait...",
+              { action },
+            )}
+          </Text>
+        </Group>
+        <Loader size="xs" />
+      </Stack>
+    );
+    return [
       {
         id: "view",
         icon: <VisibilityIcon style={{ fontSize: 20 }} />,
@@ -331,6 +359,10 @@ const FileEditorThumbnail = ({
         id: "download",
         icon: <DownloadOutlinedIcon style={{ fontSize: 20 }} />,
         label: terminology.download,
+        disabled: policyEnforcing,
+        tooltip: policyEnforcing
+          ? enforcingTooltip(terminology.download)
+          : undefined,
         onClick: (e) => {
           e.stopPropagation();
           onDownloadFile(file.id);
@@ -341,9 +373,11 @@ const FileEditorThumbnail = ({
             {
               id: "upload",
               icon: <CloudUploadIcon style={{ fontSize: 20 }} />,
-              label: isUploaded
-                ? t("fileManager.updateOnServer", "Update on Server")
-                : t("fileManager.uploadToServer", "Upload to Server"),
+              label: uploadLabel,
+              disabled: policyEnforcing,
+              tooltip: policyEnforcing
+                ? enforcingTooltip(uploadLabel)
+                : undefined,
               onClick: (e: React.MouseEvent) => {
                 e.stopPropagation();
                 setShowUploadModal(true);
@@ -357,6 +391,10 @@ const FileEditorThumbnail = ({
               id: "share",
               icon: <LinkIcon style={{ fontSize: 20 }} />,
               label: t("fileManager.share", "Share"),
+              disabled: policyEnforcing,
+              tooltip: policyEnforcing
+                ? enforcingTooltip(t("fileManager.share", "Share"))
+                : undefined,
               onClick: (e: React.MouseEvent) => {
                 e.stopPropagation();
                 setShowShareModal(true);
@@ -402,30 +440,30 @@ const FileEditorThumbnail = ({
         },
         color: "red",
       },
-    ],
-    [
-      t,
-      file.id,
-      file.name,
-      file.versionNumber,
-      isZipFile,
-      isCBZ,
-      isCBR,
-      isPinned,
-      actualFile,
-      terminology,
-      DownloadOutlinedIcon,
-      onViewFile,
-      onDownloadFile,
-      onUnzipFile,
-      handleCloseWithConfirmation,
-      canUpload,
-      canShare,
-      isUploaded,
-      pinFile,
-      unpinFile,
-    ],
-  );
+    ];
+  }, [
+    t,
+    file.id,
+    file.name,
+    file.versionNumber,
+    isZipFile,
+    isCBZ,
+    isCBR,
+    isPinned,
+    actualFile,
+    terminology,
+    DownloadOutlinedIcon,
+    onViewFile,
+    onDownloadFile,
+    onUnzipFile,
+    handleCloseWithConfirmation,
+    policyEnforcing,
+    canUpload,
+    canShare,
+    isUploaded,
+    pinFile,
+    unpinFile,
+  ]);
 
   const handleCardClick = () => {
     if (!isSupported) return;
@@ -497,6 +535,9 @@ const FileEditorThumbnail = ({
                 </div>
               )}
 
+              {/* Policy enforcement overlay — shown while any policy is in-flight */}
+              <PolicyEnforcingOverlay enforcing={policyEnforcing} zIndex={2} />
+
               {/* Thumbnail image or loading state */}
               <DocumentThumbnail
                 file={file}
@@ -580,7 +621,10 @@ const FileEditorThumbnail = ({
       {/* File name + meta */}
       <div className={styles.fileText}>
         <p className={styles.fileName}>
-          <PrivateContent>{truncateCenter(file.name, 40)}</PrivateContent>
+          <span className={styles.fileNameText}>
+            <PrivateContent>{truncateCenter(file.name, 40)}</PrivateContent>
+          </span>
+          <PolicyBadges policies={policies} className={styles.fileNameBadges} />
         </p>
         <p className={styles.fileMeta}>{metaLine}</p>
       </div>
diff --git a/frontend/editor/src/core/components/filesPage/FileGrid.tsx b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
index 4d18fccc80..69c30f98a3 100644
--- a/frontend/editor/src/core/components/filesPage/FileGrid.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
@@ -4,7 +4,7 @@ import { Checkbox, Menu, Tooltip } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
-import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
+import { PolicyBadges as PolicyBadgeRow } from "@app/components/shared/PolicyBadges";
 import FolderIcon from "@mui/icons-material/Folder";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import InsertDriveFileIcon from "@mui/icons-material/InsertDriveFile";
@@ -581,26 +581,7 @@ function FolderCard({
 /** Shield badges for the policies that have run on a file. */
 function PolicyBadges({ fileId }: { fileId: string }) {
   const badges = usePolicyFileBadges().get(fileId) ?? [];
-  if (badges.length === 0) return null;
-  return (
-    <span className="files-page-policy-badges" data-no-select>
-      {badges.slice(0, 3).map((policy) => (
-        <Tooltip
-          key={policy.id}
-          label={`${policy.name} policy ran on this file`}
-          withArrow
-          position="top"
-        >
-          <span
-            className="files-page-policy-badge"
-            style={{ color: policy.accentColor }}
-          >
-            <ShieldOutlinedIcon sx={{ fontSize: "0.7rem" }} />
-          </span>
-        </Tooltip>
-      ))}
-    </span>
-  );
+  return <PolicyBadgeRow policies={badges} />;
 }
 
 interface FileCardProps {
diff --git a/frontend/editor/src/core/components/filesPage/FilesPage.css b/frontend/editor/src/core/components/filesPage/FilesPage.css
index dcc11bd0f3..86266b99bc 100644
--- a/frontend/editor/src/core/components/filesPage/FilesPage.css
+++ b/frontend/editor/src/core/components/filesPage/FilesPage.css
@@ -484,24 +484,6 @@
   gap: 0.4rem;
 }
 
-/* Policy activity badges (a shield per policy that has run on the file). */
-.files-page-policy-badges {
-  display: inline-flex;
-  align-items: center;
-  gap: 3px;
-  flex-shrink: 0;
-}
-.files-page-policy-badge {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 15px;
-  height: 15px;
-  border-radius: 4px;
-  /* `color` set inline to the policy accent; tint follows it. */
-  background: color-mix(in srgb, currentColor 16%, transparent);
-}
-
 /* Parent-folder breadcrumb shown on cards/rows during recursive search so
    the user can tell which folder each hit lives in without navigating. */
 .files-page-card-path {
diff --git a/frontend/editor/src/core/components/policies/policyRunStore.ts b/frontend/editor/src/core/components/policies/policyRunStore.ts
new file mode 100644
index 0000000000..798149a911
--- /dev/null
+++ b/frontend/editor/src/core/components/policies/policyRunStore.ts
@@ -0,0 +1,27 @@
+/**
+ * Core stub — the real implementation lives in the proprietary overlay.
+ * Returns empty state so core-build consumers compile without a policyRunStore module.
+ */
+
+export interface PolicyRunRecord {
+  runId: string;
+  categoryId: string;
+  fileId: string;
+  fileName: string;
+  status: string;
+  currentStep?: number;
+  stepCount?: number;
+  error: string | null;
+  retrying?: boolean;
+  startedAt: number;
+}
+
+export const POLICY_IN_FLIGHT_STATUSES = [
+  "PENDING",
+  "RUNNING",
+  "WAITING_FOR_INPUT",
+] as const;
+
+export function usePolicyRuns(): PolicyRunRecord[] {
+  return [];
+}
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
index af6d9e06cc..5763ab2648 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
@@ -36,32 +36,6 @@
   background-color: rgba(59, 130, 246, 0.06);
 }
 
-/* A policy-enforced file glows in that policy's accent colour so it's obvious
-   the file has had a policy applied: it pulses a few times to catch the eye and
-   then fades out (no lingering glow). */
-.file-sidebar-file-item.policy-enforced {
-  animation: policy-glow-fade 4.5s ease-in-out forwards;
-}
-@keyframes policy-glow-fade {
-  0%,
-  24%,
-  48% {
-    box-shadow:
-      inset 0 0 0 1px color-mix(in srgb, var(--policy-glow) 30%, transparent),
-      0 0 6px -2px var(--policy-glow);
-  }
-  12%,
-  36%,
-  60% {
-    box-shadow:
-      inset 0 0 0 1px color-mix(in srgb, var(--policy-glow) 75%, transparent),
-      0 0 16px 0 var(--policy-glow);
-  }
-  100% {
-    box-shadow: 0 0 0 0 transparent;
-  }
-}
-
 .file-sidebar-file-item.selected {
   background-color: rgba(59, 130, 246, 0.12);
 }
@@ -160,25 +134,6 @@
   text-overflow: ellipsis;
 }
 
-/* ---- Policy activity badges (a shield per policy that has run on the file) ---- */
-.file-sidebar-policy-badges {
-  display: inline-flex;
-  align-items: center;
-  gap: 3px;
-  flex-shrink: 0;
-}
-.file-sidebar-policy-badge {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 15px;
-  height: 15px;
-  border-radius: 4px;
-  /* `color` is set inline to the policy's accent; the tint follows it. */
-  color: var(--text-secondary);
-  background: color-mix(in srgb, currentColor 16%, transparent);
-}
-
 /* ---- Cloud badge (file saved to the server) ---- */
 .file-sidebar-cloud-badge {
   display: inline-flex;
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
index ff48a9704d..3fb26afa5d 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
@@ -1,6 +1,6 @@
-import { useState, useCallback, useRef } from "react";
+import React, { useState, useCallback, useRef } from "react";
 import { createPortal } from "react-dom";
-import { Menu, Tooltip } from "@mantine/core";
+import { Group, Loader, Menu, Stack, Text, Tooltip } from "@mantine/core";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { useTranslation } from "react-i18next";
 import VisibilityOutlinedIcon from "@mui/icons-material/VisibilityOutlined";
@@ -13,6 +13,10 @@ import DeleteOutlineIcon from "@mui/icons-material/DeleteOutlined";
 import HistoryIcon from "@mui/icons-material/History";
 import type { FileId } from "@app/types/file";
 import { FileDocIcon } from "@app/components/shared/FileDocIcon";
+import {
+  PolicyBadges,
+  type FileItemPolicyRef,
+} from "@app/components/shared/PolicyBadges";
 import { getFileDocVariant } from "@app/components/shared/filePreview/getFileTypeIcon";
 import { useLazyThumbnail } from "@app/hooks/useLazyThumbnail";
 import { IMAGE_EXTENSIONS } from "@app/utils/fileUtils";
@@ -132,17 +136,6 @@ export interface FileItemFolderRef {
   accentColor: string;
 }
 
-/** A policy that has run on this file, used for the activity badges. */
-export interface FileItemPolicyRef {
-  id: string;
-  name: string;
-  /** CSS colour for the badge (matches the policy's accent). */
-  accentColor: string;
-  /** True only just after the policy was applied — drives the one-off glow, so
-   *  it doesn't replay on every reload of an already-enforced file. */
-  recent: boolean;
-}
-
 export interface FileItemProps {
   fileId: FileId;
   name: string;
@@ -178,7 +171,6 @@ export interface FileItemProps {
 }
 
 const MAX_VISIBLE_FOLDER_TAGS = 2;
-const MAX_VISIBLE_POLICY_BADGES = 3;
 
 export function FileItem({
   fileId,
@@ -208,6 +200,23 @@ export function FileItem({
   const dateLabel = lastModified ? formatFileDate(lastModified) : "";
   const typeLabel = ext ? ext.toUpperCase() : "File";
 
+  const policyEnforcing = policies.some((p) => p.enforcing);
+  const enforcingTooltip = (action: string): React.ReactNode => (
+    <Stack gap={6} py={2} w={200}>
+      <Group gap={6} wrap="nowrap">
+        <ShieldOutlinedIcon style={{ fontSize: 13 }} />
+        <Text size="xs" fw={600}>
+          {t(
+            "policy.blockingAction",
+            "{{action}} blocked while enforcing policy, please wait...",
+            { action },
+          )}
+        </Text>
+      </Group>
+      <Loader size="xs" />
+    </Stack>
+  );
+
   const visibleFolders = folders.slice(0, MAX_VISIBLE_FOLDER_TAGS);
   const overflowFolders = folders.slice(MAX_VISIBLE_FOLDER_TAGS);
 
@@ -228,9 +237,6 @@ export function FileItem({
 
   const handleMouseLeave = useCallback(() => setHoverRect(null), []);
 
-  // A just-applied policy (recent run) drives the one-off row glow.
-  const recentPolicy = policies.find((p) => p.recent);
-
   // Reactive: tooltip appears as soon as both hover rect and thumbnail are ready
   const thumbPos =
     hoverRect && resolvedThumbnail
@@ -244,14 +250,7 @@ export function FileItem({
     <>
       <div
         ref={itemRef}
-        className={`file-sidebar-file-item${isSelected ? " selected" : ""}${isActive ? " active" : ""}${isViewedInViewer ? " viewed" : ""}${recentPolicy ? " policy-enforced" : ""}`}
-        style={
-          recentPolicy
-            ? ({
-                "--policy-glow": recentPolicy.accentColor,
-              } as React.CSSProperties)
-            : undefined
-        }
+        className={`file-sidebar-file-item${isSelected ? " selected" : ""}${isActive ? " active" : ""}${isViewedInViewer ? " viewed" : ""}`}
         onClick={() => onClick(fileId)}
         draggable={draggable}
         onDragStart={
@@ -301,25 +300,7 @@ export function FileItem({
                 </span>
               </Tooltip>
             )}
-            {policies.length > 0 && (
-              <span className="file-sidebar-policy-badges" data-no-select>
-                {policies.slice(0, MAX_VISIBLE_POLICY_BADGES).map((policy) => (
-                  <Tooltip
-                    key={policy.id}
-                    label={`${policy.name} policy ran on this file`}
-                    withArrow
-                    position="top"
-                  >
-                    <span
-                      className="file-sidebar-policy-badge"
-                      style={{ color: policy.accentColor }}
-                    >
-                      <ShieldOutlinedIcon sx={{ fontSize: "0.7rem" }} />
-                    </span>
-                  </Tooltip>
-                ))}
-              </span>
-            )}
+            <PolicyBadges policies={policies} />
           </span>
           {folders.length > 0 && (
             <span className="file-sidebar-folder-tags" data-no-select>
@@ -395,7 +376,7 @@ export function FileItem({
           />
         </ActionIcon>
         {(onDelete ||
-          onSaveToCloud ||
+          (canSaveToCloud && onSaveToCloud) ||
           (hasVersionHistory && onVersionHistory)) && (
           <Menu position="bottom-end" withinPortal shadow="md" width={190}>
             <Menu.Target>
@@ -425,17 +406,10 @@ export function FileItem({
                   {t("fileSidebar.fileItem.versionHistory", "Version history")}
                 </Menu.Item>
               )}
-              {canSaveToCloud && onSaveToCloud && (
-                <Menu.Item
-                  leftSection={
-                    <CloudUploadOutlinedIcon sx={{ fontSize: 16 }} />
-                  }
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    onSaveToCloud(fileId);
-                  }}
-                >
-                  {isUploadedToCloud
+              {canSaveToCloud &&
+                onSaveToCloud &&
+                (() => {
+                  const uploadLabel = isUploadedToCloud
                     ? t(
                         "fileSidebar.fileItem.updateOnServer",
                         "Update on server",
@@ -443,21 +417,64 @@ export function FileItem({
                     : t(
                         "fileSidebar.fileItem.uploadToServer",
                         "Upload to server",
-                      )}
-                </Menu.Item>
-              )}
-              {onDelete && (
-                <Menu.Item
-                  color="red"
-                  leftSection={<DeleteOutlineIcon sx={{ fontSize: 16 }} />}
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    onDelete(fileId);
-                  }}
-                >
-                  {t("fileSidebar.fileItem.delete", "Delete")}
-                </Menu.Item>
-              )}
+                      );
+                  return (
+                    <Tooltip
+                      label={enforcingTooltip(uploadLabel)}
+                      disabled={!policyEnforcing}
+                      position="left"
+                      offset={6}
+                      withArrow
+                    >
+                      <div>
+                        <Menu.Item
+                          disabled={policyEnforcing}
+                          leftSection={
+                            <CloudUploadOutlinedIcon sx={{ fontSize: 16 }} />
+                          }
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onSaveToCloud(fileId);
+                          }}
+                        >
+                          {uploadLabel}
+                        </Menu.Item>
+                      </div>
+                    </Tooltip>
+                  );
+                })()}
+              {onDelete &&
+                (() => {
+                  const deleteLabel = t(
+                    "fileSidebar.fileItem.delete",
+                    "Delete",
+                  );
+                  return (
+                    <Tooltip
+                      label={enforcingTooltip(deleteLabel)}
+                      disabled={!policyEnforcing}
+                      position="left"
+                      offset={6}
+                      withArrow
+                    >
+                      <div>
+                        <Menu.Item
+                          disabled={policyEnforcing}
+                          color="red"
+                          leftSection={
+                            <DeleteOutlineIcon sx={{ fontSize: 16 }} />
+                          }
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onDelete(fileId);
+                          }}
+                        >
+                          {deleteLabel}
+                        </Menu.Item>
+                      </div>
+                    </Tooltip>
+                  );
+                })()}
             </Menu.Dropdown>
           </Menu>
         )}
diff --git a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
index a6b827bb1f..d912aace48 100644
--- a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
+++ b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
@@ -10,6 +10,8 @@ export interface HoverAction {
   label: string;
   onClick: (e: React.MouseEvent) => void;
   disabled?: boolean;
+  /** Overrides label in the tooltip — use for rich ReactNode content (e.g. enforcement messages). */
+  tooltip?: React.ReactNode;
   color?: string;
   hidden?: boolean;
   dataTour?: string;
@@ -58,18 +60,22 @@ const HoverActionMenu: React.FC<HoverActionMenuProps> = ({
       onClick={(e) => e.stopPropagation()}
     >
       {visibleActions.map((action) => (
-        <Tooltip key={action.id} label={action.label}>
-          <ActionIcon
-            size="md"
-            variant="tertiary"
-            disabled={action.disabled}
-            onClick={action.onClick}
-            aria-label={action.label}
-            style={{ color: action.color || "var(--text-secondary)" }}
-            data-tour={action.dataTour}
-          >
-            {action.icon}
-          </ActionIcon>
+        <Tooltip key={action.id} label={action.tooltip ?? action.label}>
+          {/* Wrapper keeps the tooltip working when the button is disabled
+              (disabled buttons don't emit the pointer events Tooltip needs). */}
+          <div style={{ display: "inline-flex", alignItems: "center" }}>
+            <ActionIcon
+              size="md"
+              variant="tertiary"
+              disabled={action.disabled}
+              onClick={action.onClick}
+              aria-label={action.label}
+              style={{ color: action.color || "var(--text-secondary)" }}
+              data-tour={action.dataTour}
+            >
+              {action.icon}
+            </ActionIcon>
+          </div>
         </Tooltip>
       ))}
     </div>
diff --git a/frontend/editor/src/core/components/shared/PolicyBadges.css b/frontend/editor/src/core/components/shared/PolicyBadges.css
new file mode 100644
index 0000000000..d193cc752e
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PolicyBadges.css
@@ -0,0 +1,62 @@
+/* Canonical policy badge styling — every per-file policy badge in the app
+ * (sidebar, thumbnails, files page, viewer indicator) uses these classes so
+ * colour and shape stay consistent. `color` is set inline to the policy's
+ * accent; the background tint follows it. */
+
+.policy-badges {
+  display: inline-flex;
+  align-items: center;
+  gap: 3px;
+  flex-shrink: 0;
+}
+
+.policy-badge {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 15px;
+  height: 15px;
+  border-radius: 4px;
+  color: var(--text-secondary);
+  background: color-mix(in srgb, currentColor 16%, transparent);
+  pointer-events: auto;
+}
+
+/* Larger variant for standalone indicators (e.g. the minimised viewer overlay). */
+.policy-badge--lg {
+  width: 28px;
+  height: 28px;
+  border-radius: 8px;
+  box-shadow: var(--shadow-md);
+}
+
+.policy-badge--enforcing svg {
+  animation: policy-badge-spin 1s linear infinite;
+}
+@keyframes policy-badge-spin {
+  from {
+    transform: rotate(0deg);
+  }
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.policy-badge--recent {
+  animation: policy-badge-pulse 4.5s ease-in-out forwards;
+}
+@keyframes policy-badge-pulse {
+  0%,
+  24%,
+  48% {
+    box-shadow: 0 0 0 0 transparent;
+  }
+  12%,
+  36% {
+    box-shadow: 0 0 5px 2px currentColor;
+  }
+  60%,
+  100% {
+    box-shadow: 0 0 0 0 transparent;
+  }
+}
diff --git a/frontend/editor/src/core/components/shared/PolicyBadges.tsx b/frontend/editor/src/core/components/shared/PolicyBadges.tsx
new file mode 100644
index 0000000000..f8661b9176
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PolicyBadges.tsx
@@ -0,0 +1,72 @@
+import { Tooltip } from "@mantine/core";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
+import AutorenewIcon from "@mui/icons-material/Autorenew";
+import { useTranslation } from "react-i18next";
+import "@app/components/shared/PolicyBadges.css";
+
+/** A policy that has run on this file, used for the activity badges. */
+export interface FileItemPolicyRef {
+  id: string;
+  name: string;
+  /** CSS colour for the badge (matches the policy's accent). */
+  accentColor: string;
+  /** True only just after the policy was applied — drives the one-off glow, so
+   *  it doesn't replay on every reload of an already-enforced file. */
+  recent: boolean;
+  /** True while the policy run is actively in-flight on this file. */
+  enforcing?: boolean;
+}
+
+const MAX_VISIBLE = 3;
+
+/**
+ * The canonical policy badge row: one accent-tinted shield per policy that has
+ * run on a file, spinning while a run is in flight, glowing briefly after it
+ * lands. Every surface that shows per-file policy badges (file sidebar, file
+ * editor thumbnails, files page) renders this so they stay identical.
+ */
+export function PolicyBadges({
+  policies,
+  className,
+}: {
+  policies: FileItemPolicyRef[];
+  /** Appended to the row for surface-specific layout (spacing only). */
+  className?: string;
+}) {
+  const { t } = useTranslation();
+  if (policies.length === 0) return null;
+  return (
+    <span
+      className={`policy-badges${className ? ` ${className}` : ""}`}
+      data-no-select
+    >
+      {policies.slice(0, MAX_VISIBLE).map((policy) => (
+        <Tooltip
+          key={policy.id}
+          label={
+            policy.enforcing
+              ? t("policy.badgeEnforcing", "{{name}} enforcing…", {
+                  name: policy.name,
+                })
+              : t("policy.badgeRan", "{{name}} policy ran on this file", {
+                  name: policy.name,
+                })
+          }
+          withArrow
+          position="top"
+        >
+          <span
+            className={`policy-badge${policy.enforcing ? " policy-badge--enforcing" : ""}${policy.recent && !policy.enforcing ? " policy-badge--recent" : ""}`}
+            style={{ color: policy.accentColor }}
+          >
+            {policy.enforcing ? (
+              <AutorenewIcon sx={{ fontSize: "0.7rem" }} />
+            ) : (
+              <ShieldOutlinedIcon sx={{ fontSize: "0.7rem" }} />
+            )}
+          </span>
+        </Tooltip>
+      ))}
+    </span>
+  );
+}
diff --git a/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx b/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
new file mode 100644
index 0000000000..5778d323aa
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
@@ -0,0 +1,7 @@
+export function PolicyEnforcingOverlay(_props: {
+  enforcing: boolean;
+  progress?: number;
+  zIndex?: number;
+}) {
+  return null;
+}
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
index 87e80a16c5..5cc1e6cabd 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
@@ -5,6 +5,7 @@ import React, {
   useRef,
   useSyncExternalStore,
 } from "react";
+import { Group, Loader, Progress, Stack, Text } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { SegmentedControl } from "@app/ui/SegmentedControl";
@@ -33,6 +34,11 @@ import { Tooltip } from "@app/components/shared/Tooltip";
 import LocalIcon from "@app/components/shared/LocalIcon";
 import ViewerShareButton from "@app/components/viewer/ViewerShareButton";
 import { useSharingEnabled } from "@app/hooks/useSharingEnabled";
+import { usePolicyFileBadges } from "@app/hooks/usePolicyFileBadges";
+import {
+  POLICY_IN_FLIGHT_STATUSES,
+  usePolicyRuns,
+} from "@app/components/policies/policyRunStore";
 import { downloadFileWithPolicy as downloadFile } from "@app/services/exportWithPolicy";
 import { enforceExportPolicies } from "@app/services/policyExport";
 import { downloadFile as downloadRaw } from "@app/services/downloadService";
@@ -46,6 +52,7 @@ import InsertDriveFileOutlinedIcon from "@mui/icons-material/InsertDriveFileOutl
 import FolderOutlinedIcon from "@mui/icons-material/FolderOutlined";
 import CloseIcon from "@mui/icons-material/Close";
 import PrintIcon from "@mui/icons-material/Print";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import "@app/components/shared/WorkbenchBar.css";
 
 const SECTION_ORDER: WorkbenchBarSection[] = ["top", "middle", "bottom"];
@@ -119,6 +126,60 @@ export default function WorkbenchBar({
   const { actions: fileActions } = useFileActions();
   const activeFiles = selectors.getFiles();
   const { activeFileId, setActiveFileId } = useViewer();
+  const policyFileBadges = usePolicyFileBadges();
+  // Block print/export while any file the export would touch is under active
+  // policy enforcement: the viewer exports its active file, every other view
+  // exports the selection (or all files when nothing is selected).
+  const exportTargetIds: string[] =
+    currentView === "viewer"
+      ? activeFileId
+        ? [activeFileId]
+        : []
+      : selectedFileIds.length > 0
+        ? selectedFileIds
+        : activeFiles.filter(isStirlingFile).map((f) => f.fileId);
+  const enforcingFileId = exportTargetIds.find((id) =>
+    (policyFileBadges.get(id) ?? []).some((p) => p.enforcing),
+  );
+  const policyEnforcing = enforcingFileId != null;
+  const policyRuns = usePolicyRuns();
+  const enforcingRun = policyEnforcing
+    ? policyRuns.find(
+        (r) =>
+          r.fileId === enforcingFileId &&
+          (POLICY_IN_FLIGHT_STATUSES as readonly string[]).includes(r.status),
+      )
+    : undefined;
+  const enforcingProgress =
+    enforcingRun?.currentStep != null && enforcingRun.stepCount
+      ? Math.round((enforcingRun.currentStep / enforcingRun.stepCount) * 100)
+      : undefined;
+  const makeEnforcingTooltip = (action: string): React.ReactNode => (
+    <Stack gap={6} py={2} w={200}>
+      <Group gap={6} wrap="nowrap">
+        <ShieldOutlinedIcon style={{ fontSize: 13 }} />
+        <Text size="xs" fw={600}>
+          {t(
+            "policy.blockingAction",
+            "{{action}} blocked while enforcing policy, please wait",
+            { action },
+          )}
+        </Text>
+      </Group>
+      {enforcingProgress != null ? (
+        <Progress
+          w="100%"
+          size="xs"
+          radius="xl"
+          value={enforcingProgress}
+          striped
+          animated
+        />
+      ) : (
+        <Loader size="xs" />
+      )}
+    </Stack>
+  );
   const pageEditorTotalPages = pageEditorFunctions?.totalPages ?? 0;
   const pageEditorSelectedCount =
     pageEditorFunctions?.selectedPageIds?.length ?? 0;
@@ -504,13 +565,18 @@ export default function WorkbenchBar({
               className="workbench-bar-action-icon"
               onClick={handlePrint}
               disabled={
-                totalItems === 0 || allButtonsDisabled || disableForFullscreen
+                totalItems === 0 ||
+                allButtonsDisabled ||
+                disableForFullscreen ||
+                policyEnforcing
               }
               aria-label={t("workbenchBar.print", "Print PDF")}
             >
               <PrintIcon sx={{ fontSize: "1rem" }} />
             </ActionIcon>,
-            t("workbenchBar.print", "Print PDF"),
+            policyEnforcing
+              ? makeEnforcingTooltip(t("workbenchBar.print", "Print PDF"))
+              : t("workbenchBar.print", "Print PDF"),
           )}
 
         {/* Download (file-level action — not relevant in custom views) */}
@@ -522,7 +588,10 @@ export default function WorkbenchBar({
               className="workbench-bar-action-icon"
               onClick={() => handleExportAll()}
               disabled={
-                disableForFullscreen || totalItems === 0 || allButtonsDisabled
+                disableForFullscreen ||
+                totalItems === 0 ||
+                allButtonsDisabled ||
+                policyEnforcing
               }
               aria-label={downloadTooltip}
             >
@@ -532,7 +601,9 @@ export default function WorkbenchBar({
                 height="1rem"
               />
             </ActionIcon>,
-            downloadTooltip,
+            policyEnforcing
+              ? makeEnforcingTooltip(downloadTooltip)
+              : downloadTooltip,
           )}
 
         {/* Save As */}
@@ -545,7 +616,10 @@ export default function WorkbenchBar({
               className="workbench-bar-action-icon"
               onClick={() => handleExportAll(true)}
               disabled={
-                disableForFullscreen || totalItems === 0 || allButtonsDisabled
+                disableForFullscreen ||
+                totalItems === 0 ||
+                allButtonsDisabled ||
+                policyEnforcing
               }
               aria-label={t("workbenchBar.saveAs", "Save As")}
             >
@@ -555,7 +629,9 @@ export default function WorkbenchBar({
                 height="1rem"
               />
             </ActionIcon>,
-            t("workbenchBar.saveAs", "Save As"),
+            policyEnforcing
+              ? makeEnforcingTooltip(t("workbenchBar.saveAs", "Save As"))
+              : t("workbenchBar.saveAs", "Save As"),
           )}
 
         {/* Separator: export group | close */}
diff --git a/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx b/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
index 555f93df9d..1e21637849 100644
--- a/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
+++ b/frontend/editor/src/core/components/viewer/EmbedPdfViewer.tsx
@@ -47,6 +47,7 @@ import { useWheelZoom } from "@app/hooks/useWheelZoom";
 import { useFormFill } from "@app/tools/formFill/FormFillContext";
 import { FormSaveBar } from "@app/tools/formFill/FormSaveBar";
 import { useViewerKeyCommand } from "@app/hooks/useViewerKeyCommand";
+import { usePolicyFileBadges } from "@app/hooks/usePolicyFileBadges";
 import { alert } from "@app/components/toast";
 
 // ─── Measure dictionary extraction ────────────────────────────────────────────
@@ -443,6 +444,15 @@ const EmbedPdfViewerContent = ({
 
   const viewerKeyCommand = useViewerKeyCommand();
 
+  const policyFileBadges = usePolicyFileBadges();
+  const policyEnforcing =
+    !!activeFileId &&
+    (policyFileBadges.get(activeFileId) ?? []).some((p) => p.enforcing);
+  // Use a ref so the keydown handler always reads the latest value without
+  // needing to be in the effect's dependency array.
+  const policyEnforcingRef = useRef(false);
+  policyEnforcingRef.current = policyEnforcing;
+
   // Handle keyboard shortcuts
   useEffect(() => {
     const handleKeyDown = (event: KeyboardEvent) => {
@@ -468,7 +478,9 @@ const EmbedPdfViewerContent = ({
               case "p":
               case "P":
                 event.preventDefault();
-                printActions.print();
+                if (!policyEnforcingRef.current) {
+                  printActions.print();
+                }
                 return;
               case "a":
               case "A":
@@ -1333,6 +1345,7 @@ const EmbedPdfViewerContent = ({
               file={currentFile ?? null}
               isFormFillToolActive={isFormFillToolActive}
               onApply={handleFormApply}
+              policyEnforcing={policyEnforcing}
             />
             <StampPlacementOverlay
               containerRef={pdfContainerRef}
diff --git a/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx b/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
index bb3f8aa909..f063cbffe2 100644
--- a/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
+++ b/frontend/editor/src/core/components/viewer/ViewerShareButton.tsx
@@ -1,9 +1,10 @@
 import { useState } from "react";
-import { Group, Modal, Stack, Text } from "@mantine/core";
+import { Group, Loader, Modal, Progress, Stack, Text } from "@mantine/core";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import ShareIcon from "@mui/icons-material/Share";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import ShareManagementModal from "@app/components/shared/ShareManagementModal";
@@ -15,6 +16,11 @@ import { alert } from "@app/components/toast";
 import { Z_INDEX_OVER_FILE_MANAGER_MODAL } from "@app/styles/zIndex";
 import type { StirlingFileStub } from "@app/types/fileContext";
 import type { FileId } from "@app/types/file";
+import { usePolicyFileBadges } from "@app/hooks/usePolicyFileBadges";
+import {
+  POLICY_IN_FLIGHT_STATUSES,
+  usePolicyRuns,
+} from "@app/components/policies/policyRunStore";
 
 interface ViewerShareButtonProps {
   disabled?: boolean;
@@ -48,8 +54,54 @@ export default function ViewerShareButton({
     ? stubs.find((s) => s.id === activeFileId)
     : undefined;
 
+  const policyFileBadges = usePolicyFileBadges();
+  const runs = usePolicyRuns();
+  const enforcing =
+    !!activeFileId &&
+    (policyFileBadges.get(activeFileId) ?? []).some((p) => p.enforcing);
+  const enforcingRun = enforcing
+    ? runs.find(
+        (r) =>
+          r.fileId === activeFileId &&
+          (POLICY_IN_FLIGHT_STATUSES as readonly string[]).includes(r.status),
+      )
+    : undefined;
+  const enforcingProgress =
+    enforcingRun?.currentStep != null && enforcingRun.stepCount
+      ? Math.round((enforcingRun.currentStep / enforcingRun.stepCount) * 100)
+      : undefined;
+
   const label = t("workbenchBar.share", "Share");
-  const isDisabled = Boolean(disabled) || !stub;
+  const isDisabled = Boolean(disabled) || !stub || enforcing;
+
+  const tooltipContent = enforcing ? (
+    <Stack gap={6} py={2} w={200}>
+      <Group gap={6} wrap="nowrap">
+        <ShieldOutlinedIcon style={{ fontSize: 13 }} />
+        <Text size="xs" fw={600}>
+          {t(
+            "policy.blockingAction",
+            "{{action}} blocked while enforcing policy, please wait",
+            { action: label },
+          )}
+        </Text>
+      </Group>
+      {enforcingProgress != null ? (
+        <Progress
+          w="100%"
+          size="xs"
+          radius="xl"
+          value={enforcingProgress}
+          striped
+          animated
+        />
+      ) : (
+        <Loader size="xs" />
+      )}
+    </Stack>
+  ) : (
+    label
+  );
 
   const openShare = (target: StirlingFileStub) => {
     setShareStub(target);
@@ -125,7 +177,7 @@ export default function ViewerShareButton({
   return (
     <>
       <Tooltip
-        content={label}
+        content={tooltipContent}
         position="bottom"
         offset={6}
         arrow
diff --git a/frontend/editor/src/core/contexts/FileContext.tsx b/frontend/editor/src/core/contexts/FileContext.tsx
index 0840d49a72..d0096d6806 100644
--- a/frontend/editor/src/core/contexts/FileContext.tsx
+++ b/frontend/editor/src/core/contexts/FileContext.tsx
@@ -244,6 +244,7 @@ function FileContextInner({
         /** Persist to IDB without dispatching to workspace state. */
         skipWorkspaceDispatch?: boolean;
         skipUploadTracking?: boolean;
+        derivedFromTool?: boolean;
       },
     ): Promise<StirlingFile[]> => {
       const stirlingFiles = await addFiles(
diff --git a/frontend/editor/src/core/contexts/file/fileActions.ts b/frontend/editor/src/core/contexts/file/fileActions.ts
index 749e820e41..86483baf32 100644
--- a/frontend/editor/src/core/contexts/file/fileActions.ts
+++ b/frontend/editor/src/core/contexts/file/fileActions.ts
@@ -254,6 +254,9 @@ interface AddFileOptions {
   ) => Promise<boolean>; // Optional callback to confirm extraction of large ZIP files
   allowDuplicates?: boolean;
   skipUploadTracking?: boolean;
+  /** When true, marks every added stub as derivedFromTool so the policy
+   *  auto-run skips it — used for policy outputs imported via addFiles. */
+  derivedFromTool?: boolean;
 }
 
 /**
@@ -368,6 +371,7 @@ export async function addFiles(
 
       // Create new filestub with minimal metadata; hydrate thumbnails/processedFile asynchronously
       const fileStub = createNewStirlingFileStub(file, fileId);
+      if (options.derivedFromTool) fileStub.derivedFromTool = true;
 
       // Early encryption detection for PDFs — set the flag before dispatch so the
       // viewer gate and modal queue pick it up immediately instead of after hydration
diff --git a/frontend/editor/src/core/hooks/usePolicyFileBadges.ts b/frontend/editor/src/core/hooks/usePolicyFileBadges.ts
index e3297f9bd0..8013edf0b9 100644
--- a/frontend/editor/src/core/hooks/usePolicyFileBadges.ts
+++ b/frontend/editor/src/core/hooks/usePolicyFileBadges.ts
@@ -1,4 +1,4 @@
-import type { FileItemPolicyRef } from "@app/components/shared/FileSidebarFileItem";
+import type { FileItemPolicyRef } from "@app/components/shared/PolicyBadges";
 
 /**
  * Policies that have run on each file, keyed by fileId — drives the shield
diff --git a/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx b/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
index da8cfc785a..48ded3045f 100644
--- a/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormSaveBar.tsx
@@ -28,12 +28,15 @@ interface FormSaveBarProps {
   isFormFillToolActive: boolean;
   /** Callback when form changes are applied (should reload PDF with filled values) */
   onApply?: (filledBlob: Blob) => Promise<void>;
+  /** Disable download while an ingestion-time policy run is in flight. */
+  policyEnforcing?: boolean;
 }
 
 export function FormSaveBar({
   file,
   isFormFillToolActive,
   onApply,
+  policyEnforcing = false,
 }: FormSaveBarProps) {
   const { t } = useTranslation();
   const { state, submitForm } = useFormFill();
@@ -181,7 +184,7 @@ export function FormSaveBar({
                     size="sm"
                     leftSection={<DownloadIcon sx={{ fontSize: 18 }} />}
                     loading={saving}
-                    disabled={applying}
+                    disabled={applying || policyEnforcing}
                     onClick={handleDownload}
                     style={{ flex: 1 }}
                   >
diff --git a/frontend/editor/src/proprietary/components/policies/policyRunStore.ts b/frontend/editor/src/proprietary/components/policies/policyRunStore.ts
index 45a8066bf0..9485df3a9e 100644
--- a/frontend/editor/src/proprietary/components/policies/policyRunStore.ts
+++ b/frontend/editor/src/proprietary/components/policies/policyRunStore.ts
@@ -49,6 +49,13 @@ export interface PolicyRunRecord {
   startedAt: number;
 }
 
+/** Statuses of a run that is still executing (not yet settled). */
+export const POLICY_IN_FLIGHT_STATUSES: readonly PolicyRunStatus[] = [
+  "PENDING",
+  "RUNNING",
+  "WAITING_FOR_INPUT",
+];
+
 interface RunState {
   runs: PolicyRunRecord[];
   dispatched: string[];
@@ -92,6 +99,10 @@ function read(): RunState {
 let state: RunState = read();
 const listeners = new Set<() => void>();
 
+function notifyListeners() {
+  for (const l of listeners) l();
+}
+
 function emit() {
   try {
     if (typeof localStorage !== "undefined") {
@@ -100,7 +111,18 @@ function emit() {
   } catch {
     // Best-effort persistence.
   }
-  for (const l of listeners) l();
+  notifyListeners();
+}
+
+// Sync in-memory state when another tab (or a test via page.evaluate + dispatchEvent)
+// writes to the same localStorage key.
+if (typeof window !== "undefined") {
+  window.addEventListener("storage", (e) => {
+    if (e.key === STORAGE_KEY) {
+      state = read();
+      notifyListeners();
+    }
+  });
 }
 
 function subscribe(listener: () => void) {
diff --git a/frontend/editor/src/proprietary/components/policies/policyStatus.ts b/frontend/editor/src/proprietary/components/policies/policyStatus.ts
index 1cf9e5eeb1..e45d280654 100644
--- a/frontend/editor/src/proprietary/components/policies/policyStatus.ts
+++ b/frontend/editor/src/proprietary/components/policies/policyStatus.ts
@@ -27,3 +27,17 @@ export const ROW_ACCENT: Record<string, IconBadgeAccent> = {
   routing: "amber",
   retention: "red",
 };
+
+/** Accent name → the CSS colour var the policy badges tint with. */
+const ACCENT_VAR: Record<string, string> = {
+  blue: "var(--color-blue)",
+  purple: "var(--color-purple)",
+  green: "var(--color-green)",
+  amber: "var(--color-amber)",
+  red: "var(--color-red)",
+};
+
+/** CSS colour var for a policy category's accent (blue for unknown categories). */
+export function policyAccentVar(categoryId: string): string {
+  return ACCENT_VAR[ROW_ACCENT[categoryId] ?? "blue"];
+}
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
index 6090557c70..249b56ea33 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
@@ -155,7 +155,13 @@ describe("auto-run import: new-version output delivery", () => {
     recordCompletedRun();
     await runImport();
 
-    expect(mocks.addFiles).toHaveBeenCalled();
+    // derivedFromTool must ride along so the auto-run never re-enforces this
+    // output, even after the dispatched list is wiped (fresh device / storage
+    // clear) — without it the output re-triggers the policy indefinitely.
+    expect(mocks.addFiles).toHaveBeenCalledWith(
+      expect.any(Array),
+      expect.objectContaining({ derivedFromTool: true }),
+    );
     expect(mocks.persistVersionedOutputs).not.toHaveBeenCalled();
     expect(mocks.consumeFiles).not.toHaveBeenCalled();
   });
@@ -182,7 +188,10 @@ describe("auto-run import: new-version output delivery", () => {
     });
 
     expect(getRun("srv-1")?.startedAt).toBe(1000);
-    expect(mocks.addFiles).toHaveBeenCalled();
+    expect(mocks.addFiles).toHaveBeenCalledWith(
+      expect.any(Array),
+      expect.objectContaining({ derivedFromTool: true }),
+    );
     expect(mocks.persistVersionedOutputs).not.toHaveBeenCalled();
   });
 });
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
index 188b404d23..9ecdf62525 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
@@ -309,7 +309,7 @@ export function usePolicyAutoRun(): void {
 interface ImportContext {
   addFiles: (
     files: File[],
-    options?: { skipUploadTracking?: boolean },
+    options?: { skipUploadTracking?: boolean; derivedFromTool?: boolean },
   ) => Promise<StirlingFile[]>;
   consumeFiles: (
     inputFileIds: FileId[],
@@ -498,9 +498,14 @@ async function importOutputs(
       parentStub,
       "automate",
     );
-    // Mark the outputs handled BEFORE adding them, so the auto-run never enforces
-    // the policy on its own output — that would version endlessly in a loop.
-    for (const s of stubs) markDispatched(run.categoryId, s.id);
+    // derivedFromTool is the durable cross-session guard; markDispatched is the
+    // belt-and-suspenders session guard. Both are needed: dispatched lives only
+    // in localStorage (wiped on clear / absent on a different device), while
+    // derivedFromTool is stamped on the stub itself.
+    for (const s of stubs) {
+      s.derivedFromTool = true;
+      markDispatched(run.categoryId, s.id);
+    }
     deliveredIds = stubs.map((s) => s.id as string);
     if (ctx.parentStub) {
       // Input is in the active workspace: version it there (workspace + storage).
@@ -516,9 +521,13 @@ async function importOutputs(
       ctx.bumpRevision();
     }
   } else {
-    const added = await ctx.addFiles(files, { skipUploadTracking: true });
-    // Same loop-guard for new-file output: the produced file is a new workspace
-    // file the auto-run would otherwise re-enforce indefinitely.
+    // derivedFromTool prevents the auto-run from ever re-enforcing this output,
+    // even if the dispatched list is cleared (localStorage wipe / different device).
+    const added = await ctx.addFiles(files, {
+      skipUploadTracking: true,
+      derivedFromTool: true,
+    });
+    // Belt-and-suspenders session guard on top of derivedFromTool.
     for (const f of added) markDispatched(run.categoryId, f.fileId);
     deliveredIds = added.map((f) => f.fileId as string);
   }
diff --git a/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx b/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
new file mode 100644
index 0000000000..973410aef3
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
@@ -0,0 +1,91 @@
+import {
+  Center,
+  Loader,
+  Overlay,
+  Progress,
+  Stack,
+  Text,
+  ThemeIcon,
+  Tooltip,
+} from "@mantine/core";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
+import CloseIcon from "@mui/icons-material/Close";
+import { useTranslation } from "react-i18next";
+
+interface PolicyEnforcingOverlayProps {
+  enforcing: boolean;
+  /** 0-100 progress when the run reports step counts; omit for indeterminate. */
+  progress?: number;
+  zIndex?: number;
+  /** When provided, an × button is shown and called on click. */
+  onDismiss?: () => void;
+}
+
+/**
+ * Frosted-glass enforcement overlay. Renders into its nearest positioned ancestor
+ * (position: relative) — works for both the full-screen viewer and thumbnail cards.
+ */
+export function PolicyEnforcingOverlay({
+  enforcing,
+  progress,
+  zIndex = 200,
+  onDismiss,
+}: PolicyEnforcingOverlayProps) {
+  const { t } = useTranslation();
+  if (!enforcing) return null;
+  return (
+    <Overlay
+      color="var(--color-bg)"
+      backgroundOpacity={0.9}
+      blur={4}
+      zIndex={zIndex}
+    >
+      {onDismiss && (
+        <Tooltip
+          label={t("policy.viewAnyway", "View file (policy still enforcing)")}
+          position="left"
+          withArrow
+        >
+          <ActionIcon
+            variant="tertiary"
+            accent="neutral"
+            size="sm"
+            onClick={onDismiss}
+            style={{
+              position: "absolute",
+              top: 12,
+              right: 12,
+              zIndex: zIndex + 1,
+            }}
+            aria-label={t("policy.dismiss", "Dismiss overlay")}
+          >
+            <CloseIcon style={{ fontSize: 16 }} />
+          </ActionIcon>
+        </Tooltip>
+      )}
+      <Center style={{ height: "100%" }}>
+        <Stack align="center" gap="md" w={220}>
+          <ThemeIcon size={48} radius="xl" variant="light" color="blue">
+            <ShieldOutlinedIcon style={{ fontSize: 26 }} />
+          </ThemeIcon>
+          <Text fw={600} size="sm">
+            {t("policy.enforcingTitle", "Enforcing policy…")}
+          </Text>
+          {progress != null ? (
+            <Progress
+              w="100%"
+              size="xs"
+              radius="xl"
+              value={progress}
+              striped
+              animated
+            />
+          ) : (
+            <Loader size="xs" />
+          )}
+        </Stack>
+      </Center>
+    </Overlay>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/viewer/PolicyEnforcementOverlay.tsx b/frontend/editor/src/proprietary/components/viewer/PolicyEnforcementOverlay.tsx
new file mode 100644
index 0000000000..53fb1a4733
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/viewer/PolicyEnforcementOverlay.tsx
@@ -0,0 +1,75 @@
+import { useState, useEffect, useRef } from "react";
+import { Tooltip } from "@mantine/core";
+import AutorenewIcon from "@mui/icons-material/Autorenew";
+import { useTranslation } from "react-i18next";
+import {
+  POLICY_IN_FLIGHT_STATUSES,
+  type PolicyRunRecord,
+} from "@app/components/policies/policyRunStore";
+import { policyAccentVar } from "@app/components/policies/policyStatus";
+import { PolicyEnforcingOverlay } from "@app/components/shared/PolicyEnforcingOverlay";
+import "@app/components/shared/PolicyBadges.css";
+
+interface Props {
+  runs: PolicyRunRecord[];
+}
+
+export function PolicyEnforcementOverlay({ runs }: Props) {
+  const { t } = useTranslation();
+  const [dismissed, setDismissed] = useState(false);
+  const prevRunId = useRef<string | undefined>(undefined);
+
+  const inFlight = runs.find(
+    (r) => POLICY_IN_FLIGHT_STATUSES.includes(r.status) || r.retrying,
+  );
+
+  // Reset dismissed when a new run starts (including retries, which replace the
+  // run record with a new runId even while inFlight stays truthy throughout).
+  useEffect(() => {
+    if (inFlight && inFlight.runId !== prevRunId.current) setDismissed(false);
+    prevRunId.current = inFlight?.runId;
+  }, [inFlight]);
+
+  if (!inFlight) return null;
+
+  const progress =
+    inFlight.currentStep != null && inFlight.stepCount
+      ? Math.round((inFlight.currentStep / inFlight.stepCount) * 100)
+      : undefined;
+
+  if (dismissed) {
+    // Overlay dismissed — collapsed to a corner badge (same design as the
+    // per-file policy badges, larger) so the user can read the PDF.
+    return (
+      <Tooltip
+        label={t("policy.enforcingTitle", "Enforcing policy…")}
+        position="left"
+        withArrow
+      >
+        <span
+          className="policy-badge policy-badge--lg policy-badge--enforcing"
+          style={{
+            position: "absolute",
+            top: 16,
+            // Clear of the top-right corner itself: preview mode renders its
+            // close button there, and the badge must never swallow its clicks.
+            right: 56,
+            zIndex: 1100,
+            color: policyAccentVar(inFlight.categoryId),
+          }}
+        >
+          <AutorenewIcon style={{ fontSize: 16 }} />
+        </span>
+      </Tooltip>
+    );
+  }
+
+  return (
+    <PolicyEnforcingOverlay
+      enforcing
+      zIndex={1100}
+      progress={progress}
+      onDismiss={() => setDismissed(true)}
+    />
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/viewer/Viewer.tsx b/frontend/editor/src/proprietary/components/viewer/Viewer.tsx
new file mode 100644
index 0000000000..e1d0cd96ab
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/viewer/Viewer.tsx
@@ -0,0 +1,59 @@
+import { Box } from "@mantine/core";
+import CoreViewer from "@core/components/viewer/Viewer";
+import type { ViewerProps } from "@core/components/viewer/Viewer";
+import type { EmbedPdfViewerProps } from "@core/components/viewer/EmbedPdfViewer";
+import { useViewer } from "@app/contexts/ViewerContext";
+import {
+  POLICY_IN_FLIGHT_STATUSES,
+  usePolicyRuns,
+  type PolicyRunRecord,
+} from "@app/components/policies/policyRunStore";
+import { PolicyEnforcementOverlay } from "@app/components/viewer/PolicyEnforcementOverlay";
+
+type SignatureOverlayPassThrough = Pick<
+  EmbedPdfViewerProps,
+  | "signaturePreviews"
+  | "signaturePreviewsReadOnly"
+  | "signaturePlacementMode"
+  | "signaturePlacementData"
+  | "signaturePlacementType"
+  | "onSignaturePreviewsChange"
+  | "signatureOverlayApiRef"
+>;
+
+const Viewer = (props: ViewerProps & SignatureOverlayPassThrough) => {
+  const { activeFileId } = useViewer();
+  const allRuns = usePolicyRuns();
+
+  const activeFileRuns = activeFileId
+    ? allRuns.filter(
+        (r: PolicyRunRecord) =>
+          r.fileId === activeFileId &&
+          (POLICY_IN_FLIGHT_STATUSES.includes(r.status) || r.retrying === true),
+      )
+    : [];
+
+  return (
+    // isolation: "isolate" keeps the overlay's z-index self-contained so it
+    // sits above EmbedPdfViewer's internal toolbar/sidebars regardless of
+    // their own z-index values.
+    <Box
+      data-testid="viewer-root"
+      data-file-id={activeFileId ?? ""}
+      style={{
+        position: "relative",
+        height: "100%",
+        isolation: "isolate",
+      }}
+    >
+      <CoreViewer {...props} />
+      {/* key resets dismissed state when the active file changes */}
+      <PolicyEnforcementOverlay
+        key={activeFileId ?? ""}
+        runs={activeFileRuns}
+      />
+    </Box>
+  );
+};
+
+export default Viewer;
diff --git a/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.test.ts b/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.test.ts
index db69bb77af..c5d8b9952b 100644
--- a/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.test.ts
+++ b/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.test.ts
@@ -112,3 +112,72 @@ describe("buildPolicyBadgeMap — badge follows the document onto derived files"
     expect((map.get("part") ?? [])[0].recent).toBe(false);
   });
 });
+
+describe("buildPolicyBadgeMap — enforcing spinner while a run is in flight", () => {
+  const enforcingOn = (
+    map: Map<string, { enforcing?: boolean }[]>,
+    id: string,
+  ) => (map.get(id) ?? []).some((b) => b.enforcing);
+
+  it("marks the input file enforcing while the run is RUNNING", () => {
+    const map = buildPolicyBadgeMap(
+      [run({ status: "RUNNING", outputFileIds: [] })],
+      [{ id: "in" }],
+      labels,
+      NOW,
+    );
+    expect(enforcingOn(map, "in")).toBe(true);
+  });
+
+  it("keeps enforcing after COMPLETED until the outputs are imported", () => {
+    // Status reaches COMPLETED before the async import lands — the spinner
+    // must survive that gap, then clear once imported.
+    const before = buildPolicyBadgeMap(
+      [run({ status: "COMPLETED" })],
+      [{ id: "in" }],
+      labels,
+      NOW,
+    );
+    expect(enforcingOn(before, "in")).toBe(true);
+
+    const after = buildPolicyBadgeMap(
+      [run({ status: "COMPLETED", imported: true })],
+      [{ id: "in" }],
+      labels,
+      NOW,
+    );
+    expect(enforcingOn(after, "in")).toBe(false);
+  });
+
+  it("clears enforcing when the run settles as FAILED or CANCELLED", () => {
+    for (const status of ["FAILED", "CANCELLED"] as const) {
+      const map = buildPolicyBadgeMap(
+        [run({ status, outputFileIds: [] })],
+        [{ id: "in" }],
+        labels,
+        NOW,
+      );
+      expect(enforcingOn(map, "in")).toBe(false);
+    }
+  });
+
+  it("keeps enforcing on a settled run that is auto-retrying", () => {
+    const map = buildPolicyBadgeMap(
+      [run({ status: "FAILED", retrying: true, outputFileIds: [] })],
+      [{ id: "in" }],
+      labels,
+      NOW,
+    );
+    expect(enforcingOn(map, "in")).toBe(true);
+  });
+
+  it("skips runs with no input fileId (server-reconciled orphans)", () => {
+    const map = buildPolicyBadgeMap(
+      [run({ status: "RUNNING", fileId: "", outputFileIds: [] })],
+      [{ id: "in" }],
+      labels,
+      NOW,
+    );
+    expect(enforcingOn(map, "in")).toBe(false);
+  });
+});
diff --git a/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.ts b/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.ts
index ad4c016895..40fcd0399e 100644
--- a/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.ts
+++ b/frontend/editor/src/proprietary/hooks/usePolicyFileBadges.ts
@@ -3,22 +3,14 @@ import { usePolicyRuns } from "@app/components/policies/policyRunStore";
 import type { PolicyRunRecord } from "@app/components/policies/policyRunStore";
 import { useAllFiles } from "@app/contexts/FileContext";
 import { loadPolicyCatalog } from "@app/services/policyCatalog";
-import { ROW_ACCENT } from "@app/components/policies/policyStatus";
-import type { FileItemPolicyRef } from "@app/components/shared/FileSidebarFileItem";
+import { policyAccentVar } from "@app/components/policies/policyStatus";
+import type { FileItemPolicyRef } from "@app/components/shared/PolicyBadges";
 
 /** How long after a run a badge counts as "recent" (drives the one-off glow).
- *  Covers the run + import delay; old/reloaded runs fall outside it, so the glow
- *  fires only just after a policy is applied, not on every page reload. */
-const RECENT_MS = 60_000;
-
-/** Policy accent name (ROW_ACCENT) → the CSS colour var the badge uses. */
-const ACCENT_VAR: Record<string, string> = {
-  blue: "var(--color-blue)",
-  purple: "var(--color-purple)",
-  green: "var(--color-green)",
-  amber: "var(--color-amber)",
-  red: "var(--color-red)",
-};
+ *  Measured from run start — must exceed the longest realistic policy wall-clock
+ *  time so the glow still fires after a slow run completes and imports. Old or
+ *  reloaded runs fall outside this window, suppressing the glow on page reload. */
+const RECENT_MS = 5 * 60 * 1000;
 
 /** Minimal provenance shape needed to resolve a file's inherited badges. */
 type LineageStub = {
@@ -71,7 +63,7 @@ export function buildPolicyBadgeMap(
         list.push({
           id: run.categoryId,
           name,
-          accentColor: ACCENT_VAR[ROW_ACCENT[run.categoryId] ?? "blue"],
+          accentColor: policyAccentVar(run.categoryId),
           recent,
         });
         directByFile.set(fileId, list);
@@ -107,6 +99,35 @@ export function buildPolicyBadgeMap(
     }
   }
 
+  // In-flight pass: add (or upgrade) a badge on the input file for any run that
+  // is currently being processed, so the sidebar shows a spinning indicator
+  // while the policy is actively enforcing — not just after it completes.
+  // Keep the spinner until `imported` is true: the status reaches COMPLETED
+  // before the output files are imported into the workspace, so gating on
+  // status alone would drop the badge during that async gap.
+  for (const run of runs) {
+    if (!run.fileId) continue;
+    const settled =
+      run.imported || run.status === "FAILED" || run.status === "CANCELLED";
+    if (settled && !run.retrying) continue;
+    const name = labelById.get(run.categoryId);
+    if (!name) continue;
+    const list = result.get(run.fileId) ?? [];
+    const existing = list.find((p) => p.id === run.categoryId);
+    if (existing) {
+      existing.enforcing = true;
+    } else {
+      list.push({
+        id: run.categoryId,
+        name,
+        accentColor: policyAccentVar(run.categoryId),
+        recent: false,
+        enforcing: true,
+      });
+      result.set(run.fileId, list);
+    }
+  }
+
   return result;
 }
 

From 514b020f747b420341740876800cfa3e25a947f1 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:42:44 +0100
Subject: [PATCH 30/35] Portal: real Free PDF Editors usage card (self-hosted)
 (#6919)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Replaces the **mocked** "Free PDF Editors" fleet card on the portal
Usage page with live figures. Cost stays a literal `$0`; any figure that
can't be computed renders **N/A** (never a misleading 0).

| Metric | Self-hosted source |
|---|---|
| **Editors deployed** | total users (`UserRepository.count()`) |
| **Active this month** | distinct `source=WEB` principals active in 30d
(excl. `UI_DATA` polling), clamped ≤ deployed |
| **PDFs edited** | cumulative `PDF_PROCESS` + `FILE_OPERATION` audit
events that are **free UI runs** |

## Why the counting approach

"Free operations = UI tool runs." Two dead ends first:
- **Billing/PAYG is the wrong source** — it *deliberately discards* free
ops (classified `BYPASSED`, no DB row); its tables only hold billable
(API/AI/automation).
- **Raw audit is also wrong** — a tool controller emits `PDF_PROCESS`
for UI **and** API/AI/automation calls, and billable traffic exists on
every tier.

So the count is **audit filtered to free UI runs**. Audit events gain a
`source` column, stamped from the always-on signal
`BillingCategoryClassifier.classify(...) == BYPASSED` (not API-key auth,
no `X-Stirling-Automation` header, not `/api/v1/ai/`) — zero
billing-module coupling. Captured on the request thread
(`AuditService.captureCurrentSource`), carried via MDC in
`ControllerAuditAspect` (same propagation as `requestId`), persisted by
`CustomAuditEventRepository`. The count filters `source = 'WEB'`.

## Endpoint

`GET /api/v1/usage/fleet-stats` — admin-gated, EE-only. Returns `null`
per field when EE auditing is off (→ N/A).

## Frontend

- New `portal/api/fleetStats.ts` → `apiClient.local` (this instance's
backend).
- `FreePdfEditorsCard` rewired to `useAsync(fetchFleetStats)`; preview
badge removed, `null`→"N/A", loading→"—".

## Tests

`:proprietary:build` green — `FleetUsageControllerTest` (4) and
`CustomAuditEventRepositoryTest` (+2 for source-from-MDC) pass; spotless
clean.

## Notes / follow-ups

- `deployed` currently counts all users incl. disabled — refine to
enabled-only later.
- **SaaS** (team-scoped endpoint + a `fleetStats.ts` override) is
deferred to a follow-up riding the portal-SaaS layering PR #6900.
- Depends on EE auditing running at `AuditLevel ≥ STANDARD` for the
audit-derived figures; otherwise they show N/A.
---
 .../audit/ControllerAuditAspect.java          |  10 ++
 .../config/CustomAuditEventRepository.java    |   3 +
 .../controller/api/FleetUsageController.java  |  71 ++++++++++++
 .../model/api/usage/FleetUsageStats.java      |   6 +
 .../model/security/PersistentAuditEvent.java  |  11 +-
 .../PersistentAuditEventRepository.java       |  17 +++
 .../database/repository/UserRepository.java   |   3 +
 .../proprietary/service/AuditService.java     |  34 ++++++
 .../CustomAuditEventRepositoryTest.java       |  49 ++++++++
 .../api/FleetUsageControllerTest.java         | 108 ++++++++++++++++++
 .../proprietary/service/AuditServiceTest.java |  56 +++++++++
 .../public/locales/en-US/translation.toml     |   1 -
 frontend/editor/src/portal/api/fleetStats.ts  |  24 ++++
 .../billing/FreePdfEditorsCard.stories.tsx    |   6 +-
 .../components/billing/FreePdfEditorsCard.tsx |  40 +++----
 15 files changed, 412 insertions(+), 27 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/controller/api/FleetUsageController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/usage/FleetUsageStats.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/controller/api/FleetUsageControllerTest.java
 create mode 100644 frontend/editor/src/portal/api/fleetStats.ts

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/audit/ControllerAuditAspect.java b/app/proprietary/src/main/java/stirling/software/proprietary/audit/ControllerAuditAspect.java
index 0d777d9481..c59c6f3721 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/audit/ControllerAuditAspect.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/audit/ControllerAuditAspect.java
@@ -130,6 +130,7 @@ public class ControllerAuditAspect {
 
         String previousPrincipal = MDC.get("auditPrincipal");
         String previousOrigin = MDC.get("auditOrigin");
+        String previousSource = MDC.get("auditSource");
         String previousIp = MDC.get("auditIp");
 
         // EARLY CAPTURE: Capture from SecurityContext on request thread, store in MDC for async
@@ -161,6 +162,14 @@ public class ControllerAuditAspect {
                 return joinPoint.proceed();
             }
 
+            // Stamp the free-UI source only for non-@Audited controller traffic — an actual
+            // tool / UI action. @Audited events (login, settings) return above without a source,
+            // so they never count as an "active editor" or a free UI run. The finally block
+            // restores auditSource, so a pooled thread can't leak a stale "WEB" into them.
+            if (previousSource == null) {
+                MDC.put("auditSource", auditService.captureCurrentSource());
+            }
+
             long start = System.currentTimeMillis();
 
             // Use auditService to create the base audit data
@@ -247,6 +256,7 @@ public class ControllerAuditAspect {
         } finally {
             restoreMdcValue("auditPrincipal", previousPrincipal);
             restoreMdcValue("auditOrigin", previousOrigin);
+            restoreMdcValue("auditSource", previousSource);
             restoreMdcValue("auditIp", previousIp);
         }
     }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
index bcb98aa04b..f83bf0afdc 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
@@ -60,6 +60,8 @@ public class CustomAuditEventRepository implements AuditEventRepository {
                 clean.put("requestId", rid);
             }
 
+            String source = MDC.get("auditSource");
+
             String auditEventData = mapper.writeValueAsString(clean);
             log.debug("AuditEvent data (JSON): {}", auditEventData);
 
@@ -67,6 +69,7 @@ public class CustomAuditEventRepository implements AuditEventRepository {
                     PersistentAuditEvent.builder()
                             .principal(safePrincipal(ev.getPrincipal()))
                             .type(ev.getType())
+                            .source(source)
                             .data(auditEventData)
                             .timestamp(ev.getTimestamp())
                             .build();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/FleetUsageController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/FleetUsageController.java
new file mode 100644
index 0000000000..57b74362ec
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/FleetUsageController.java
@@ -0,0 +1,71 @@
+package stirling.software.proprietary.controller.api;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.List;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.audit.AuditLevel;
+import stirling.software.proprietary.config.AuditConfigurationProperties;
+import stirling.software.proprietary.model.api.usage.FleetUsageStats;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+import stirling.software.proprietary.security.config.EnterpriseEndpoint;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+
+/**
+ * Admin endpoint exposing free-editor fleet usage for the portal Usage card. Audit-derived figures
+ * (active editors, PDFs processed) are null (rendered as "N/A") rather than a misleading 0 whenever
+ * the data can't exist: the events they count (PDF_PROCESS, FILE_OPERATION, HTTP_REQUEST) are all
+ * STANDARD level, so a gate on {@code isEnabled()} alone would still return 0 at level=OFF/BASIC —
+ * we gate on {@code isLevelEnabled(STANDARD)} instead.
+ *
+ * <p>Known limitation: on a login-disabled self-hosted instance every request is anonymous, so its
+ * audit origin is SYSTEM (not WEB) and it is excluded from these WEB-only counts — active/PDFs then
+ * read 0 despite real usage. Historical audit rows written before the {@code source} column existed
+ * carry {@code source=null}, so the cumulative "PDFs edited" figure effectively starts at deploy.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/usage")
+@PreAuthorize("hasRole('ADMIN')")
+@RequiredArgsConstructor
+@EnterpriseEndpoint
+public class FleetUsageController {
+
+    private final PersistentAuditEventRepository auditRepository;
+    private final UserRepository userRepository;
+    private final AuditConfigurationProperties auditConfig;
+
+    @GetMapping("/fleet-stats")
+    public FleetUsageStats fleetStats() {
+        // Exclude the reserved INTERNAL_API_USER row that InitialSecuritySetup creates on every
+        // install, so a fresh single-admin instance reads 1 editor, not 2.
+        Long deployed = userRepository.countByUsernameNot(Role.INTERNAL_API_USER.getRoleId());
+        // STANDARD is the level at which the counted events are recorded; below it the data
+        // can't exist, so report N/A instead of a 0 that would misrepresent an empty table.
+        boolean auditOn = auditConfig.isLevelEnabled(AuditLevel.STANDARD);
+        Instant since = Instant.now().minus(30, ChronoUnit.DAYS);
+        Long active =
+                auditOn
+                        ? auditRepository.countDistinctPrincipalsBySourceExcludingTypeAfter(
+                                "WEB", "UI_DATA", since)
+                        : null;
+        Long pdfs =
+                auditOn
+                        ? auditRepository.countByTypeInAndSourceAndTimestampAfter(
+                                List.of("PDF_PROCESS", "FILE_OPERATION"), "WEB", Instant.EPOCH)
+                        : null;
+        if (active != null && deployed != null && active > deployed) {
+            active = deployed; // active editors are a subset of those deployed
+        }
+        return new FleetUsageStats(deployed, active, pdfs);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/usage/FleetUsageStats.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/usage/FleetUsageStats.java
new file mode 100644
index 0000000000..0e554fb884
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/usage/FleetUsageStats.java
@@ -0,0 +1,6 @@
+package stirling.software.proprietary.model.api.usage;
+
+/**
+ * Free-editor fleet usage for the portal Usage card. Null fields render as "N/A" (uncomputable).
+ */
+public record FleetUsageStats(Long editorsDeployed, Long activeThisMonth, Long pdfsProcessed) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
index 5d90926076..ccaf337c0b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
@@ -18,7 +18,15 @@ import lombok.*;
                     columnList = "principal,type"),
             @jakarta.persistence.Index(
                     name = "idx_audit_type_timestamp",
-                    columnList = "type,timestamp")
+                    columnList = "type,timestamp"),
+            @jakarta.persistence.Index(
+                    name = "idx_audit_type_source_timestamp",
+                    columnList = "type,source,timestamp"),
+            // Leads with source (equality) for the active-editors query, which filters on
+            // source then a timestamp range and counts distinct principal.
+            @jakarta.persistence.Index(
+                    name = "idx_audit_source_timestamp_principal",
+                    columnList = "source,timestamp,principal")
         })
 @Data
 @Builder
@@ -32,6 +40,7 @@ public class PersistentAuditEvent {
 
     private String principal;
     private String type;
+    private String source;
 
     @Column(columnDefinition = "text")
     private String data; // JSON blob
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/repository/PersistentAuditEventRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/repository/PersistentAuditEventRepository.java
index 27bca098b3..7c0081dd7c 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/repository/PersistentAuditEventRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/repository/PersistentAuditEventRepository.java
@@ -259,4 +259,21 @@ public interface PersistentAuditEventRepository extends JpaRepository<Persistent
             "SELECT e FROM PersistentAuditEvent e WHERE e.type != :excludeType AND e.timestamp > :startDate")
     List<PersistentAuditEvent> findAllExceptTypeAndTimestampAfterForExport(
             @Param("excludeType") String excludeType, @Param("startDate") Instant startDate);
+
+    // Free-editor fleet usage: count genuine free-UI operations (source = "WEB") by type.
+    @Query(
+            "SELECT COUNT(e) FROM PersistentAuditEvent e "
+                    + "WHERE e.type IN :types AND e.source = :source AND e.timestamp > :since")
+    long countByTypeInAndSourceAndTimestampAfter(
+            @Param("types") List<String> types,
+            @Param("source") String source,
+            @Param("since") Instant since);
+
+    @Query(
+            "SELECT COUNT(DISTINCT e.principal) FROM PersistentAuditEvent e "
+                    + "WHERE e.source = :source AND e.type <> :excludeType AND e.timestamp > :since")
+    long countDistinctPrincipalsBySourceExcludingTypeAfter(
+            @Param("source") String source,
+            @Param("excludeType") String excludeType,
+            @Param("since") Instant since);
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
index 4e592e427a..acae6044de 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
@@ -49,6 +49,9 @@ public interface UserRepository extends JpaRepository<User, Long> {
 
     long countByTeam(Team team);
 
+    /** Count real users, excluding a reserved username such as the internal API user. */
+    long countByUsernameNot(String username);
+
     List<User> findAllByTeam(Team team);
 
     // OAuth grandfathering queries
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AuditService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AuditService.java
index d86ae644e1..a56ece5285 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/AuditService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AuditService.java
@@ -39,6 +39,7 @@ import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.RegexPatternUtils;
 import stirling.software.common.util.RequestUriUtils;
+import stirling.software.proprietary.accountlink.BillableOperationClassifier;
 import stirling.software.proprietary.audit.AuditEventType;
 import stirling.software.proprietary.audit.AuditLevel;
 import stirling.software.proprietary.audit.Audited;
@@ -847,6 +848,39 @@ public class AuditService {
         return origin;
     }
 
+    /**
+     * Refines {@link #determineOrigin()} into an audit {@code source} that isolates genuine
+     * free-editor UI runs from automation/AI traffic that also arrives over the web channel.
+     *
+     * <p>API and SYSTEM origins pass through unchanged. A WEB origin is demoted to "AUTOMATION" or
+     * "AI" when the request carries the automation marker or targets an AI surface; only a manual
+     * interactive tool call ({@code BYPASSED}) stays "WEB". A "WEB" source therefore counts as a
+     * free/BYPASSED UI run. The automation/AI resolution is delegated to {@link
+     * BillableOperationClassifier} so it can't drift from the billing gate's own signal.
+     *
+     * <p>IMPORTANT: like {@link #captureCurrentOrigin()} this must be called on the request thread
+     * before async execution, because it reads the current {@link HttpServletRequest}.
+     *
+     * @return "API", "SYSTEM", "AUTOMATION", "AI", or "WEB"
+     */
+    public String captureCurrentSource() {
+        String origin = determineOrigin();
+        if (!"WEB".equals(origin)) {
+            return origin;
+        }
+
+        HttpServletRequest req = getCurrentRequest();
+        if (req == null) {
+            return "WEB";
+        }
+        // apiKey=false: a WEB origin already means the request is not API-key authenticated.
+        return switch (BillableOperationClassifier.categorize(req, false)) {
+            case AUTOMATION -> "AUTOMATION";
+            case AI -> "AI";
+            default -> "WEB";
+        };
+    }
+
     /**
      * Determines the origin of the request: API (X-API-KEY), WEB (JWT), or SYSTEM (no auth).
      * IMPORTANT: This must be called in the request thread before async execution.
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/config/CustomAuditEventRepositoryTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/config/CustomAuditEventRepositoryTest.java
index 3bdde8ecab..6ba15b24aa 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/config/CustomAuditEventRepositoryTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/config/CustomAuditEventRepositoryTest.java
@@ -3,12 +3,61 @@ package stirling.software.proprietary.config;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 
+import java.time.Instant;
+import java.util.Map;
+
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.slf4j.MDC;
+import org.springframework.boot.actuate.audit.AuditEvent;
+
+import stirling.software.proprietary.model.security.PersistentAuditEvent;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+
+import tools.jackson.databind.json.JsonMapper;
 
 class CustomAuditEventRepositoryTest {
 
+    @AfterEach
+    void clearMdc() {
+        MDC.clear();
+    }
+
+    @Test
+    void sourceIsPopulatedFromMdcAuditSource() {
+        PersistentAuditEventRepository repo = mock(PersistentAuditEventRepository.class);
+        CustomAuditEventRepository writer =
+                new CustomAuditEventRepository(repo, JsonMapper.builder().build());
+
+        MDC.put("auditSource", "WEB");
+        writer.add(new AuditEvent(Instant.now(), "admin", "PDF_PROCESS", Map.of("k", "v")));
+
+        ArgumentCaptor<PersistentAuditEvent> captor =
+                ArgumentCaptor.forClass(PersistentAuditEvent.class);
+        verify(repo).save(captor.capture());
+        assertEquals("WEB", captor.getValue().getSource());
+    }
+
+    @Test
+    void sourceIsNullWhenMdcAbsent() {
+        PersistentAuditEventRepository repo = mock(PersistentAuditEventRepository.class);
+        CustomAuditEventRepository writer =
+                new CustomAuditEventRepository(repo, JsonMapper.builder().build());
+
+        writer.add(new AuditEvent(Instant.now(), "admin", "PDF_PROCESS", Map.of("k", "v")));
+
+        ArgumentCaptor<PersistentAuditEvent> captor =
+                ArgumentCaptor.forClass(PersistentAuditEvent.class);
+        verify(repo).save(captor.capture());
+        assertNull(captor.getValue().getSource());
+    }
+
     @Test
     void shortPrincipalPassesThroughUnchanged() {
         assertEquals(
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/FleetUsageControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/FleetUsageControllerTest.java
new file mode 100644
index 0000000000..11e168b8d1
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/FleetUsageControllerTest.java
@@ -0,0 +1,108 @@
+package stirling.software.proprietary.controller.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.time.Instant;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.audit.AuditLevel;
+import stirling.software.proprietary.config.AuditConfigurationProperties;
+import stirling.software.proprietary.model.api.usage.FleetUsageStats;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+
+@ExtendWith(MockitoExtension.class)
+class FleetUsageControllerTest {
+
+    @Mock private PersistentAuditEventRepository auditRepository;
+    @Mock private UserRepository userRepository;
+    @Mock private AuditConfigurationProperties auditConfig;
+
+    private FleetUsageController controller;
+
+    @BeforeEach
+    void setUp() {
+        controller = new FleetUsageController(auditRepository, userRepository, auditConfig);
+    }
+
+    @Test
+    @DisplayName("deployed reflects the user count, excluding the internal API user")
+    void deployedFromUserCount() {
+        when(userRepository.countByUsernameNot(anyString())).thenReturn(7L);
+        when(auditConfig.isLevelEnabled(AuditLevel.STANDARD)).thenReturn(false);
+
+        FleetUsageStats stats = controller.fleetStats();
+
+        assertThat(stats.editorsDeployed()).isEqualTo(7L);
+        verify(userRepository).countByUsernameNot(Role.INTERNAL_API_USER.getRoleId());
+    }
+
+    @Test
+    @DisplayName("audit-derived figures are null when auditing is below STANDARD")
+    void auditOffYieldsNulls() {
+        when(userRepository.countByUsernameNot(anyString())).thenReturn(3L);
+        // Covers both disabled and the enabled-but-level=OFF/BASIC misconfig: isLevelEnabled
+        // is false, so no events can exist and we must report N/A, not a 0 from an empty table.
+        when(auditConfig.isLevelEnabled(AuditLevel.STANDARD)).thenReturn(false);
+
+        FleetUsageStats stats = controller.fleetStats();
+
+        assertThat(stats.activeThisMonth()).isNull();
+        assertThat(stats.pdfsProcessed()).isNull();
+        verify(auditRepository, never())
+                .countDistinctPrincipalsBySourceExcludingTypeAfter(
+                        any(), any(), any(Instant.class));
+        verify(auditRepository, never())
+                .countByTypeInAndSourceAndTimestampAfter(anyList(), any(), any(Instant.class));
+    }
+
+    @Test
+    @DisplayName("audit-derived figures come from the repository when auditing is enabled")
+    void auditOnReadsRepository() {
+        when(userRepository.countByUsernameNot(anyString())).thenReturn(10L);
+        when(auditConfig.isLevelEnabled(AuditLevel.STANDARD)).thenReturn(true);
+        when(auditRepository.countDistinctPrincipalsBySourceExcludingTypeAfter(
+                        eq("WEB"), eq("UI_DATA"), any(Instant.class)))
+                .thenReturn(4L);
+        when(auditRepository.countByTypeInAndSourceAndTimestampAfter(
+                        anyList(), eq("WEB"), any(Instant.class)))
+                .thenReturn(1234L);
+
+        FleetUsageStats stats = controller.fleetStats();
+
+        assertThat(stats.editorsDeployed()).isEqualTo(10L);
+        assertThat(stats.activeThisMonth()).isEqualTo(4L);
+        assertThat(stats.pdfsProcessed()).isEqualTo(1234L);
+    }
+
+    @Test
+    @DisplayName("active editors are clamped to deployed (active is a subset)")
+    void activeClampedToDeployed() {
+        when(userRepository.countByUsernameNot(anyString())).thenReturn(2L);
+        when(auditConfig.isLevelEnabled(AuditLevel.STANDARD)).thenReturn(true);
+        when(auditRepository.countDistinctPrincipalsBySourceExcludingTypeAfter(
+                        eq("WEB"), eq("UI_DATA"), any(Instant.class)))
+                .thenReturn(9L);
+        when(auditRepository.countByTypeInAndSourceAndTimestampAfter(
+                        anyList(), eq("WEB"), any(Instant.class)))
+                .thenReturn(50L);
+
+        FleetUsageStats stats = controller.fleetStats();
+
+        assertThat(stats.activeThisMonth()).isEqualTo(2L);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AuditServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AuditServiceTest.java
index 321d0975d4..a90fde6b85 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/service/AuditServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AuditServiceTest.java
@@ -35,6 +35,7 @@ import jakarta.servlet.http.HttpServletResponse;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.service.InternalApiClient;
 import stirling.software.proprietary.audit.AuditEventType;
 import stirling.software.proprietary.audit.AuditLevel;
 import stirling.software.proprietary.audit.Audited;
@@ -83,6 +84,61 @@ class AuditServiceTest {
         RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(request));
     }
 
+    @Nested
+    @DisplayName("captureCurrentSource()")
+    class CaptureSource {
+
+        @Test
+        @DisplayName("a plain authenticated web tool call is WEB")
+        void plainWebIsWeb() {
+            authenticateAs("alice");
+            bindRequest(new MockHttpServletRequest("POST", "/api/v1/general/merge-pdfs"));
+
+            assertThat(service.captureCurrentSource()).isEqualTo("WEB");
+        }
+
+        @Test
+        @DisplayName("the automation marker header demotes WEB to AUTOMATION")
+        void automationHeaderIsAutomation() {
+            authenticateAs("alice");
+            MockHttpServletRequest req =
+                    new MockHttpServletRequest("POST", "/api/v1/general/merge");
+            req.addHeader(InternalApiClient.AUTOMATION_HEADER, "true");
+            bindRequest(req);
+
+            assertThat(service.captureCurrentSource()).isEqualTo("AUTOMATION");
+        }
+
+        @Test
+        @DisplayName("the AI surface demotes WEB to AI")
+        void aiSurfaceIsAi() {
+            authenticateAs("alice");
+            bindRequest(new MockHttpServletRequest("POST", "/api/v1/ai/tools/ask"));
+
+            assertThat(service.captureCurrentSource()).isEqualTo("AI");
+        }
+
+        @Test
+        @DisplayName("the AI surface is matched after stripping the deployment context path")
+        void aiSurfaceWithContextPathIsAi() {
+            authenticateAs("alice");
+            MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/ai/tools/ask");
+            req.setContextPath("/stirling");
+            req.setRequestURI("/stirling/api/v1/ai/tools/ask");
+            bindRequest(req);
+
+            assertThat(service.captureCurrentSource()).isEqualTo("AI");
+        }
+
+        @Test
+        @DisplayName("an unauthenticated request is SYSTEM, not WEB")
+        void anonymousIsSystem() {
+            bindRequest(new MockHttpServletRequest("POST", "/api/v1/general/merge-pdfs"));
+
+            assertThat(service.captureCurrentSource()).isEqualTo("SYSTEM");
+        }
+    }
+
     @Nested
     @DisplayName("audit() gating")
     class AuditGating {
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 233760298a..20fde0cc3f 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6281,7 +6281,6 @@ cost = "Cost"
 editorsDeployed = "Editors deployed"
 inviteTeammates = "Invite teammates"
 pdfsEdited = "PDFs edited"
-previewBadge = "Preview · sample data"
 subtitle = "Deploy anywhere, for your whole team."
 title = "Free PDF Editors"
 
diff --git a/frontend/editor/src/portal/api/fleetStats.ts b/frontend/editor/src/portal/api/fleetStats.ts
new file mode 100644
index 0000000000..b62526aacd
--- /dev/null
+++ b/frontend/editor/src/portal/api/fleetStats.ts
@@ -0,0 +1,24 @@
+import { apiClient } from "@portal/api/http";
+
+/**
+ * Free-editor fleet usage for the {@link FreePdfEditorsCard}.
+ *
+ * Self-hosted (this module) reads the local Stirling backend — the figures come
+ * from this instance's audit trail, filtered to free UI tool runs. A SaaS build
+ * shadows this module (src/saas/portal/api/fleetStats.ts) to read the
+ * team-scoped SaaS backend instead.
+ *
+ * Any field may be null when the backend can't compute it (e.g. EE auditing is
+ * disabled); the card renders null as "N/A" rather than a misleading 0.
+ */
+export interface FleetStats {
+  editorsDeployed: number | null;
+  activeThisMonth: number | null;
+  pdfsProcessed: number | null;
+}
+
+export function fetchFleetStats(signal?: AbortSignal): Promise<FleetStats> {
+  return apiClient.local.json<FleetStats>("/api/v1/usage/fleet-stats", {
+    signal,
+  });
+}
diff --git a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.stories.tsx b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.stories.tsx
index 442274431a..1b1a0f1d47 100644
--- a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.stories.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.stories.tsx
@@ -11,8 +11,8 @@ export default meta;
 type Story = StoryObj<typeof FreePdfEditorsCard>;
 
 /**
- * The team editor-fleet card. The metrics are SAMPLE data (flagged with the
- * Preview badge) until the fleet-telemetry endpoint lands in a follow-up PR;
- * "Invite teammates" is intentionally inert for now.
+ * The team editor-fleet card. Metrics come from GET /api/v1/usage/fleet-stats
+ * (audit-derived, free UI runs only); with no backend behind Storybook the
+ * fetch fails and the figures fall back to "N/A". Cost is always $0.
  */
 export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
index d06dfd23a6..76fa5a9109 100644
--- a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
@@ -1,26 +1,28 @@
 import { useNavigate } from "react-router-dom";
 import { useTranslation } from "react-i18next";
-import { Button, Card, MetricCard, MetricStrip, StatusBadge } from "@app/ui";
+import { Button, Card, MetricCard, MetricStrip } from "@app/ui";
 import GroupsIcon from "@mui/icons-material/GroupsRounded";
 import PersonAddIcon from "@mui/icons-material/PersonAddAltRounded";
+import { useAsync } from "@portal/hooks/useAsync";
+import { fetchFleetStats } from "@portal/api/fleetStats";
 
 /**
- * "Free PDF Editors" team-fleet card. The editors-deployed / active-this-month /
- * PDFs-edited figures come from a fleet-telemetry endpoint that does not exist
- * yet (tracked for a follow-up PR), so they are SAMPLE data — flagged with a
- * Preview badge — and "Invite teammates" is intentionally inert. The layout is
- * built so the page matches the marketing design; swap the constants for live
- * values when the endpoint lands.
+ * "Free PDF Editors" team-fleet card. Editors-deployed / active-this-month /
+ * PDFs-edited come from the instance's usage endpoint
+ * ({@code GET /api/v1/usage/fleet-stats}), derived from the audit trail filtered
+ * to free UI tool runs. A figure the backend can't compute (e.g. EE auditing is
+ * off) arrives as null and renders "N/A". Cost is always $0.
  */
-const SAMPLE = {
-  editorsDeployed: "6",
-  activeThisMonth: "4",
-  pdfsEdited: "1,240",
-};
+function fmtMetric(value: number | null | undefined, loading: boolean): string {
+  if (loading) return "—";
+  if (value == null) return "N/A";
+  return value.toLocaleString();
+}
 
 export function FreePdfEditorsCard() {
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const { data, loading } = useAsync((signal) => fetchFleetStats(signal), []);
   return (
     <Card padding="loose">
       <div className="portal-billing__fleet-row">
@@ -30,13 +32,7 @@ export function FreePdfEditorsCard() {
           </span>
           <div>
             <h3 className="portal-billing__section-title">
-              {t("portal.billing.freeEditors.title", "Free PDF Editors")}{" "}
-              <StatusBadge tone="warning" size="sm" showDot={false}>
-                {t(
-                  "portal.billing.freeEditors.previewBadge",
-                  "Preview · sample data",
-                )}
-              </StatusBadge>
+              {t("portal.billing.freeEditors.title", "Free PDF Editors")}
             </h3>
             <p className="portal-billing__section-sub">
               {t(
@@ -52,18 +48,18 @@ export function FreePdfEditorsCard() {
               "portal.billing.freeEditors.editorsDeployed",
               "Editors deployed",
             )}
-            value={SAMPLE.editorsDeployed}
+            value={fmtMetric(data?.editorsDeployed, loading)}
           />
           <MetricCard
             label={t(
               "portal.billing.freeEditors.activeThisMonth",
               "Active this month",
             )}
-            value={SAMPLE.activeThisMonth}
+            value={fmtMetric(data?.activeThisMonth, loading)}
           />
           <MetricCard
             label={t("portal.billing.freeEditors.pdfsEdited", "PDFs edited")}
-            value={SAMPLE.pdfsEdited}
+            value={fmtMetric(data?.pdfsProcessed, loading)}
           />
           <MetricCard
             label={t("portal.billing.freeEditors.cost", "Cost")}

From 1759e0bdd5d81deee86e229f617de9da82cc3a77 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 16:06:55 +0100
Subject: [PATCH 31/35] feat(portal): wire procurement "Schedule a call" to
 Calendly (#6920)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

The procurement flow's **Schedule a call** action (deal-status hero →
side modal) was a mock: a fake "SE" avatar and four hardcoded time-slot
buttons that just closed the dialog. This wires it up to the real
Calendly booking widget the admin provided.

## How

- **New `CalendlyInline` component**
(`portal/components/procurement/CalendlyInline.tsx`)
- Lazily loads `assets.calendly.com/assets/external/widget.js` via the
existing `@app/utils/scriptLoader` — only when the modal actually opens,
deduped across reopens.
- Calls `Calendly.initInlineWidget()` explicitly so it rebuilds on
reopen / theme change.
- Colours track the portal's light/dark theme (`useTheme`) via
Calendly's `background_color` / `text_color` / `primary_color` params,
mapped to the portal design tokens (surface / text-1 / primary), plus
`hide_event_type_details=1`.
- Graceful fallback to an "open in a new tab" link if the script fails
to load.
- Base URL overridable via `VITE_CALENDLY_URL` (defaults to the
group-discussion link).
- **`ScheduleCallModal`** now renders `<CalendlyInline />` instead of
the mock; copy moved into i18n (`portal.procurement.schedule.*`).
- `SideModal` gains a `wide` variant so the embed has room; removed the
now-dead `.portal-se*` / `.portal-slots*` CSS and `SLOTS` constant.

## Notes / follow-ups

- No app-level CSP blocks `calendly.com`, so the embed loads without
config changes.
- Verified with the portal typecheck (`tsc -p src/portal/tsconfig.json`)
and ESLint on the changed files; only pre-existing Storybook/msw dev-dep
type errors remain.


<img width="1160" height="642" alt="image"
src="https://github.com/user-attachments/assets/d9b5d92d-ea7e-4862-9f35-a71f65392a2c"
/>
<img width="3744" height="1990" alt="image"
src="https://github.com/user-attachments/assets/0b8002c6-dd3e-41e6-8e8b-6faf6090314c"
/>
<img width="2620" height="1928" alt="image"
src="https://github.com/user-attachments/assets/781b7a60-7065-4a7a-b9f7-1cdb0dece7b3"
/>
---
 frontend/editor/.env                          |   3 +
 .../public/locales/en-US/translation.toml     |   6 ++
 .../components/procurement/CalendlyInline.tsx | 100 ++++++++++++++++++
 .../procurement/DealStatusHero.stories.tsx    |   1 +
 .../components/procurement/DealStatusHero.tsx |  20 ++--
 .../procurement/ProcurementBanner.tsx         |   1 +
 .../procurement/ProcurementExtras.tsx         |  50 +++------
 .../procurement/ProcurementFlow.tsx           |   3 +
 .../src/portal/hooks/useLinkedAccountEmail.ts |  34 ++++++
 .../editor/src/portal/views/Procurement.css   |  60 +++--------
 10 files changed, 189 insertions(+), 89 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
 create mode 100644 frontend/editor/src/portal/hooks/useLinkedAccountEmail.ts

diff --git a/frontend/editor/.env b/frontend/editor/.env
index 961da5d840..264a01e952 100644
--- a/frontend/editor/.env
+++ b/frontend/editor/.env
@@ -26,3 +26,6 @@ VITE_STRIPE_PUBLISHABLE_KEY=pk_live_51Q56W2P9mY5IAnSnp3kcxG50uyFMLuhM4fFs774DAP3
 # PostHog analytics
 VITE_PUBLIC_POSTHOG_KEY=phc_VOdeYnlevc2T63m3myFGjeBlRcIusRgmhfx6XL5a1iz
 VITE_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
+
+# Calendly scheduling link (portal "Schedule a call")
+VITE_CALENDLY_URL=https://calendly.com/d/cm4p-zz5-yy8/stirling-pdf-15-minute-group-discussion
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 20fde0cc3f..d4d41a9257 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7660,6 +7660,12 @@ simulate = "Simulate payment received (demo)"
 title = "Subscription created"
 viewInvoice = "View & pay invoice"
 
+[portal.procurement.schedule]
+fallback = "Couldn't load the scheduler."
+fallbackLink = "Open scheduling in a new tab"
+subtitle = "Your solutions engineer will walk your team through the rollout. Pick a time that suits you."
+title = "Schedule a call"
+
 [portal.procurement.status]
 action = "Action needed"
 available = "Available"
diff --git a/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx b/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
new file mode 100644
index 0000000000..3cac3750fb
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
@@ -0,0 +1,100 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { loadScript } from "@app/utils/scriptLoader";
+
+/**
+ * Inline Calendly scheduler. Lazily loads Calendly's widget.js (only once the embed mounts, i.e. when
+ * the modal opens) and initialises an inline widget. Falls back to a plain "open in a new tab" link if
+ * the script can't load (offline, blocked, etc.).
+ */
+
+const CALENDLY_SCRIPT = "https://assets.calendly.com/assets/external/widget.js";
+
+// Base scheduling link; overridable per-environment without a code change.
+export const CALENDLY_URL: string =
+  import.meta.env.VITE_CALENDLY_URL ||
+  "https://calendly.com/d/cm4p-zz5-yy8/stirling-pdf-15-minute-group-discussion";
+
+// Calendly takes bare hex (no leading #). Its embed always renders form inputs on a white background
+// regardless of these params, so a dark background_color leaves light input text on white — unreadable.
+// We therefore keep the widget on one light, high-contrast palette in both portal themes; it reads as a
+// clean card inside the (possibly dark) modal. Only the accent tracks the brand primary.
+const WIDGET_COLORS = {
+  background: "ffffff",
+  text: "0f172a",
+  primary: "2383e2",
+} as const;
+
+interface CalendlyWindow extends Window {
+  Calendly?: {
+    initInlineWidget: (opts: {
+      url: string;
+      parentElement: HTMLElement;
+      prefill?: { name?: string; email?: string };
+    }) => void;
+  };
+}
+
+function buildUrl(base: string): string {
+  const sep = base.includes("?") ? "&" : "?";
+  return `${base}${sep}hide_event_type_details=1&background_color=${WIDGET_COLORS.background}&text_color=${WIDGET_COLORS.text}&primary_color=${WIDGET_COLORS.primary}`;
+}
+
+export function CalendlyInline({
+  url = CALENDLY_URL,
+  height = 760,
+  email,
+}: {
+  url?: string;
+  height?: number;
+  /** Prefills the booking form's email (the linked account's email). */
+  email?: string | null;
+}) {
+  const { t } = useTranslation();
+  const containerRef = useRef<HTMLDivElement>(null);
+  const [failed, setFailed] = useState(false);
+
+  const fullUrl = buildUrl(url);
+
+  useEffect(() => {
+    let cancelled = false;
+    setFailed(false);
+    loadScript({ src: CALENDLY_SCRIPT, id: "calendly-widget-script" })
+      .then(() => {
+        const el = containerRef.current;
+        const calendly = (window as CalendlyWindow).Calendly;
+        if (cancelled || !el || !calendly) return;
+        // Re-init explicitly (rather than relying on widget.js auto-scan) so the widget rebuilds on
+        // reopen and whenever the URL or prefill changes.
+        el.innerHTML = "";
+        calendly.initInlineWidget({
+          url: fullUrl,
+          parentElement: el,
+          prefill: email ? { email } : undefined,
+        });
+      })
+      .catch(() => !cancelled && setFailed(true));
+    return () => {
+      cancelled = true;
+    };
+  }, [fullUrl, email]);
+
+  if (failed) {
+    return (
+      <p className="portal-sidemodal__text">
+        {t("portal.procurement.schedule.fallback")}{" "}
+        <a href={url} target="_blank" rel="noopener noreferrer">
+          {t("portal.procurement.schedule.fallbackLink")}
+        </a>
+      </p>
+    );
+  }
+
+  return (
+    <div
+      ref={containerRef}
+      className="portal-calendly"
+      style={{ minWidth: 320, height }}
+    />
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
index dc4d7cb368..2192d3b2ec 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
@@ -18,6 +18,7 @@ const meta: Meta<typeof DealStatusHero> = {
   component: DealStatusHero,
   parameters: { layout: "padded" },
   args: {
+    canSchedule: true,
     onExpand: () => {},
     onKeyDocs: () => {},
     onInvite: () => {},
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
index 730fb768ec..56e9de6d70 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
@@ -14,6 +14,7 @@ import "@portal/views/Procurement.css";
 export function DealStatusHero({
   snapshot,
   busy = false,
+  canSchedule,
   onExpand,
   onKeyDocs,
   onInvite,
@@ -23,6 +24,9 @@ export function DealStatusHero({
 }: {
   snapshot: ProcurementSnapshot;
   busy?: boolean;
+  /** Booking a call runs through the linked account (its email prefills Calendly), so the
+   * "Schedule a call" action only appears when the org has linked its account. */
+  canSchedule: boolean;
   onExpand: () => void;
   onKeyDocs: () => void;
   onInvite: () => void;
@@ -103,13 +107,15 @@ export function DealStatusHero({
               {t("portal.procurement.hero.inviteTeammates")}
             </button>
           )}
-          <button
-            type="button"
-            className="portal-hero__chip portal-hero__chip--action"
-            onClick={onSchedule}
-          >
-            {t("portal.procurement.hero.scheduleCall")}
-          </button>
+          {canSchedule && (
+            <button
+              type="button"
+              className="portal-hero__chip portal-hero__chip--action"
+              onClick={onSchedule}
+            >
+              {t("portal.procurement.hero.scheduleCall")}
+            </button>
+          )}
         </div>
       </div>
 
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx b/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
index fffc2479be..902bb14c0d 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementBanner.tsx
@@ -20,6 +20,7 @@ export function ControlledDealStatusHero({
     <DealStatusHero
       snapshot={controller.data}
       busy={controller.busy}
+      canSchedule={controller.isLinked}
       onExpand={() => controller.setOpen(true)}
       onKeyDocs={() => controller.setExtra("docs")}
       onInvite={() => setActiveView("users")}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
index d1f13ca0ee..3046e895f2 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementExtras.tsx
@@ -3,13 +3,15 @@ import { createPortal } from "react-dom";
 import { useTranslation } from "react-i18next";
 import { Button } from "@app/ui";
 import type { ProcurementSnapshot } from "@portal/api/procurement";
+import { CalendlyInline } from "@portal/components/procurement/CalendlyInline";
 import { useFocusTrap } from "@portal/components/procurement/ProcurementModal";
 import "@portal/views/Procurement.css";
 
 /**
  * Small centred dialogs that hang off the deal-status hero's quick actions — Key documents, Schedule
- * a call, and trial management. Content is mocked for the pilot (static demo data); the shells and
- * wiring are real so the hero behaves like the marketing prototype.
+ * a call, and trial management. Schedule a call embeds the live Calendly scheduler; Key documents is
+ * still mocked for the pilot (static demo data). The shells and wiring are real so the hero behaves
+ * like the marketing prototype.
  */
 
 function SideModal({
@@ -19,6 +21,7 @@ function SideModal({
   subtitle,
   children,
   footer,
+  wide = false,
 }: {
   open: boolean;
   onClose: () => void;
@@ -26,6 +29,7 @@ function SideModal({
   subtitle?: string;
   children: React.ReactNode;
   footer?: React.ReactNode;
+  wide?: boolean;
 }) {
   const { t } = useTranslation();
   const trapRef = useFocusTrap(open);
@@ -45,7 +49,7 @@ function SideModal({
     >
       <div
         ref={trapRef}
-        className="portal-sidemodal__panel"
+        className={`portal-sidemodal__panel${wide ? " portal-sidemodal__panel--wide" : ""}`}
         role="dialog"
         aria-modal="true"
         tabIndex={-1}
@@ -182,50 +186,26 @@ export function KeyDocumentsModal({
 }
 
 // ── Schedule a call ──────────────────────────────────────────────────────────
-const SLOTS = [
-  "Tomorrow · 10:00",
-  "Tomorrow · 15:30",
-  "Thursday · 11:00",
-  "Friday · 09:30",
-];
-
 export function ScheduleCallModal({
   open,
   onClose,
+  email,
 }: {
   open: boolean;
   onClose: () => void;
+  /** Linked account's email; prefills the Calendly booking form. */
+  email?: string | null;
 }) {
+  const { t } = useTranslation();
   return (
     <SideModal
       open={open}
       onClose={onClose}
-      title="Schedule a call"
-      subtitle="Your solutions engineer will walk your team through the rollout."
+      title={t("portal.procurement.schedule.title")}
+      subtitle={t("portal.procurement.schedule.subtitle")}
+      wide
     >
-      <div className="portal-se">
-        <span className="portal-se__avatar" aria-hidden>
-          SE
-        </span>
-        <div>
-          <div className="portal-se__name">Your solutions engineer</div>
-          <div className="portal-se__role">
-            Dedicated to your evaluation and rollout
-          </div>
-        </div>
-      </div>
-      <div className="portal-slots">
-        {SLOTS.map((s) => (
-          <button
-            key={s}
-            type="button"
-            className="portal-slots__slot"
-            onClick={onClose}
-          >
-            {s}
-          </button>
-        ))}
-      </div>
+      <CalendlyInline email={email} />
     </SideModal>
   );
 }
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
index 011902c35d..9ba3ebeef2 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
@@ -1,6 +1,7 @@
 import { useTranslation } from "react-i18next";
 import { Banner, Button, EmptyState, Skeleton } from "@app/ui";
 import { useUI } from "@portal/contexts/UIContext";
+import { useLinkedAccountEmail } from "@portal/hooks/useLinkedAccountEmail";
 import { JOURNEY } from "@portal/api/procurement";
 import { ProcurementAgreement } from "@portal/components/procurement/ProcurementAgreement";
 import {
@@ -32,6 +33,7 @@ export function ProcurementFlow({
 }) {
   const { t } = useTranslation();
   const { openLinkModal } = useUI();
+  const scheduleEmail = useLinkedAccountEmail();
   const {
     isLinked,
     loading,
@@ -159,6 +161,7 @@ export function ProcurementFlow({
       <ScheduleCallModal
         open={extra === "schedule"}
         onClose={() => setExtra(null)}
+        email={scheduleEmail}
       />
       {data && (
         <TrialManageModal
diff --git a/frontend/editor/src/portal/hooks/useLinkedAccountEmail.ts b/frontend/editor/src/portal/hooks/useLinkedAccountEmail.ts
new file mode 100644
index 0000000000..9ec193e844
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useLinkedAccountEmail.ts
@@ -0,0 +1,34 @@
+import { useEffect, useState } from "react";
+import { ensureSaasSupabase } from "@portal/auth/saasSupabase";
+
+/**
+ * The email of the linked SaaS account, read from the in-app SaaS Supabase
+ * session (the same session the account-link flow establishes). Null when there
+ * is no SaaS session — not linked, SaaS Supabase unconfigured, or the attended
+ * session has expired — in which case callers treat it as "prefill unavailable"
+ * and degrade gracefully.
+ *
+ * Deliberately does NOT depend on LinkContext: the SaaS flavor has no
+ * LinkProvider (see usePortalLinked's SaaS shadow), and this hook is reached from
+ * shared procurement code compiled into every flavor.
+ */
+export function useLinkedAccountEmail(): string | null {
+  const [email, setEmail] = useState<string | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    const supabase = ensureSaasSupabase();
+    if (!supabase) {
+      setEmail(null);
+      return;
+    }
+    void supabase.auth.getSession().then(({ data }) => {
+      if (!cancelled) setEmail(data.session?.user?.email ?? null);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return email;
+}
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index 8294709e5d..0f827f9146 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -1243,6 +1243,8 @@
   backdrop-filter: blur(4px);
   -webkit-backdrop-filter: blur(4px);
   animation: portal-procmodal-fade 0.15s ease-out;
+  /* Portaled to <body>, outside .portal-scope, so set the portal UI font explicitly. */
+  font-family: var(--font-sans);
 }
 .portal-sidemodal__panel {
   position: relative;
@@ -1256,6 +1258,11 @@
   max-height: 86vh;
   overflow-y: auto;
 }
+/* Wide enough for Calendly's two-pane layout (its single-column layout below ~680px inner width is
+   tall and scrolls); paired with the embed's taller fixed height so the time view needs no scroll. */
+.portal-sidemodal__panel--wide {
+  max-width: 52rem;
+}
 .portal-sidemodal__header {
   margin-bottom: 1rem;
   padding-right: 2rem;
@@ -1355,53 +1362,12 @@
   color: var(--color-text-5);
 }
 
-/* Solutions-engineer + time slots (Schedule a call). */
-.portal-se {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  margin-bottom: 1rem;
-}
-.portal-se__avatar {
-  width: 2.4rem;
-  height: 2.4rem;
-  border-radius: 999px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  font-size: 0.75rem;
-  font-weight: 700;
-  color: var(--color-primary, #2383e2);
-  background: var(--color-primary-light, #eaf2fb);
-  flex-shrink: 0;
-}
-.portal-se__name {
-  font-size: 0.875rem;
-  font-weight: 650;
-  color: var(--color-text-1);
-}
-.portal-se__role {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-.portal-slots {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 0.5rem;
-}
-.portal-slots__slot {
-  padding: 0.6rem 0.75rem;
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-2);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: 9px;
-  cursor: pointer;
-}
-.portal-slots__slot:hover {
-  border-color: var(--color-primary, #2383e2);
-  color: var(--color-primary, #2383e2);
+/* Calendly scheduler embed (Schedule a call). The widget is always light (Calendly renders inputs on
+   white), so give it a white surface — it reads as a clean card even inside the dark-mode modal. */
+.portal-calendly {
+  border-radius: 10px;
+  overflow: hidden;
+  background: #ffffff;
 }
 
 /* ── Agreement (security) step ────────────────────────────────────────────── */

From d6061eb0aa2fa55b6247f523a013ff16ce92d11a Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 8 Jul 2026 16:23:04 +0100
Subject: [PATCH 32/35] Support tool selection in Pipelines page in Portal
 (#6905)

# Description of Changes

Redesigned the Portal Pipelines page so pipelines are created and edited
on their own dedicated builder page, replacing the previous modal
composer and inline detail card.

## Screenshots

### Pipelines list
The redesigned list with summary KPIs; each row opens that pipeline's
own page.

![Pipelines
list](https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/pr-6905-screenshots/screenshots/01-pipelines-list.png)

### Pipeline builder
The dedicated create page: pipeline settings (sources, trigger, output)
above, operations and per-tool settings below.

![Pipeline
builder](https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/pr-6905-screenshots/screenshots/02-builder-new.png)

### Tool picker
Type-to-filter, category-grouped picker for adding an operation to the
pipeline.

![Tool
picker](https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/pr-6905-screenshots/screenshots/03-tool-picker.png)

### Editing a pipeline
An existing pipeline in the builder: reorderable steps, per-tool
settings, and run/delete actions.

![Editing a
pipeline](https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/pr-6905-screenshots/screenshots/04-builder-edit.png)
---
 .../public/locales/en-US/translation.toml     |  38 +-
 .../hooks/tools/redact/useRedactOperation.ts  |   2 +
 .../hooks/tools/shared/toolApiMapping.test.ts |   9 +
 .../core/hooks/tools/shared/toolApiMapping.ts |  11 +
 .../hooks/tools/shared/toolAutomation.test.ts | 215 +++++
 .../core/hooks/tools/shared/toolAutomation.ts | 260 ++++++
 .../hooks/tools/shared/toolOperationTypes.ts  |  71 +-
 .../hooks/tools/split/useSplitOperation.ts    |   2 +
 frontend/editor/src/portal/ViewRouter.tsx     |   9 +
 .../src/portal/components/PortalChrome.tsx    |  10 +-
 .../components/pipelines/PipelineComposer.tsx | 477 ----------
 .../pipelines/PipelineDetailCard.tsx          | 215 -----
 .../pipelines/PipelineStepSettings.tsx        |  59 ++
 .../components/pipelines/PipelinesTable.tsx   |  26 +-
 .../components/pipelines/ToolPicker.tsx       |  99 ++
 .../src/portal/views/PipelineBuilder.css      | 394 ++++++++
 .../src/portal/views/PipelineBuilder.test.tsx | 222 +++++
 .../src/portal/views/PipelineBuilder.tsx      | 865 ++++++++++++++++++
 .../editor/src/portal/views/Pipelines.css     | 196 +---
 .../src/portal/views/Pipelines.test.tsx       | 220 +----
 .../editor/src/portal/views/Pipelines.tsx     | 164 +---
 frontend/editor/src/portal/views/Sources.tsx  |  15 +-
 22 files changed, 2297 insertions(+), 1282 deletions(-)
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
 delete mode 100644 frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
 delete mode 100644 frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
 create mode 100644 frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
 create mode 100644 frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
 create mode 100644 frontend/editor/src/portal/views/PipelineBuilder.css
 create mode 100644 frontend/editor/src/portal/views/PipelineBuilder.test.tsx
 create mode 100644 frontend/editor/src/portal/views/PipelineBuilder.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index d4d41a9257..5a27ded6ee 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7237,18 +7237,39 @@ title = "Pipelines"
 [portal.pipelines.actions]
 newPipeline = "New pipeline"
 
+[portal.pipelines.builder]
+addStep = "Add tool"
+back = "Back to pipelines"
+discard = "Discard changes"
+enabled = "Enabled"
+keepEditing = "Keep editing"
+needsUpload = "Needs an uploaded file"
+noToolMatches = "No tools match your search."
+pipelineSettings = "Pipeline settings"
+searchTools = "Search tools"
+selectToolBody = "Add a tool to build your pipeline."
+selectToolTitle = "No tools yet"
+toolSettings = "Tool settings"
+unknownStep = "Unrecognized operation, kept as-is."
+unsavedBody = "You have unsaved changes. Save them before leaving, or discard them?"
+unsavedTitle = "Unsaved changes"
+uploadUnsupported = "Uploaded files aren't supported in pipelines yet, so these steps can't be saved: {{tools}}."
+usesDefaults = "Runs with default settings"
+
 [portal.pipelines.composer]
+addTool = "Add tool"
 cancel = "Cancel"
-chainEmpty = "Add operations from the palette below."
+chainEmpty = "Add a tool to start building your pipeline."
 create = "Create pipeline"
 directory = "Output folder"
 directoryHelp = "Absolute path on the server. Must be within the configured allowed folders."
-editTitle = "Edit pipeline"
+editingUnsupported = "Displaying these tool params for editing is not supported yet."
 moveDown = "Move down"
 moveUp = "Move up"
 name = "Name"
 namePlaceholder = "e.g. Redaction sweep"
 noSources = "No sources connected yet. The pipeline can still run on files supplied to it directly."
+noToolSettings = "This tool has no configurable settings."
 operations_one = "Operation ({{count}})"
 operations_other = "Operations ({{count}})"
 output = "Output"
@@ -7257,8 +7278,6 @@ save = "Save changes"
 scheduleEvery = "Run every"
 sources = "Sources"
 sourcesLoading = "Loading sources..."
-subtitle = "Pick the sources it runs over, chain the operations, then choose when it runs and where output goes."
-title = "New pipeline"
 trigger = "Trigger"
 triggerManual = "Manual only"
 
@@ -7274,18 +7293,8 @@ confirm = "Delete"
 title = "Delete pipeline?"
 
 [portal.pipelines.detail]
-closeAriaLabel = "Close detail"
 delete = "Delete pipeline"
-edit = "Edit"
-noSources = "No sources. Files are supplied directly to each run."
-noSteps = "No operations configured."
-output = "Output"
-pause = "Pause"
-resume = "Resume"
 run = "Run now"
-sources = "Sources"
-steps = "Operations"
-subtitle = "{{trigger}} · {{status}}"
 
 [portal.pipelines.empty]
 action = "Create a pipeline"
@@ -7307,6 +7316,7 @@ completed_other = "All {{count}} runs completed."
 empty = "Nothing to run: the sources had no documents to process."
 failed = "Run failed: {{error}}"
 running = "Run started; still in progress."
+timeout = "Run is taking longer than expected; it may still finish in the background."
 
 [portal.pipelines.status]
 active = "Active"
diff --git a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
index d93e3953c9..82d45e9e55 100644
--- a/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/redact/useRedactOperation.ts
@@ -71,6 +71,8 @@ export const redactOperationConfig = defineSingleFileTool({
   operationType: "redact",
   endpoint: (parameters: RedactParameters) =>
     parameters.mode === "automatic" ? AUTO_ENDPOINT : null,
+  // Routing set: `mode` is frontend-only, so a stored step matches by this rather than by replay.
+  endpoints: [AUTO_ENDPOINT],
   defaultParameters,
 });
 
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
index 6ed02a49ae..ba8c0bc2be 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.test.ts
@@ -1,9 +1,18 @@
 import { describe, expect, test } from "vitest";
 import {
+  isToolEndpoint,
   objectToFormData,
   type ToolApiParams,
 } from "@app/hooks/tools/shared/toolApiMapping";
 
+describe("isToolEndpoint", () => {
+  test("accepts a generated endpoint and rejects an unknown path", () => {
+    expect(isToolEndpoint("/api/v1/misc/compress-pdf")).toBe(true);
+    expect(isToolEndpoint("/api/v1/misc/not-a-real-tool")).toBe(false);
+    expect(isToolEndpoint("")).toBe(false);
+  });
+});
+
 describe("objectToFormData", () => {
   test("serializes primitive fields to string form values", () => {
     const request: ToolApiParams["/api/v1/misc/compress-pdf"] = {
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
index 760df9ce5e..9c6f5d9e4b 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolApiMapping.ts
@@ -1,4 +1,5 @@
 import {
+  TOOL_ENDPOINTS,
   type ToolApiParams,
   type ToolApiRequest,
   type ToolEndpoint,
@@ -6,6 +7,16 @@ import {
 
 export type { ToolApiParams, ToolApiRequest, ToolEndpoint };
 
+const TOOL_ENDPOINT_SET: ReadonlySet<string> = new Set(TOOL_ENDPOINTS);
+
+/**
+ * Runtime check that a string is one of the generated tool endpoints, so callers can narrow an
+ * arbitrary endpoint path to {@link ToolEndpoint} against the real supported set rather than casting.
+ */
+export function isToolEndpoint(value: string): value is ToolEndpoint {
+  return TOOL_ENDPOINT_SET.has(value);
+}
+
 /**
  * Mapping for tools that take only a file and have no request parameters (their
  * generated model is `Record<string, never>`). Both directions are empty; the
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
new file mode 100644
index 0000000000..03b85798d8
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
@@ -0,0 +1,215 @@
+import { describe, expect, test } from "vitest";
+import {
+  ToolCategoryId,
+  SubcategoryId,
+  type ToolRegistry,
+  type ToolRegistryEntry,
+} from "@app/data/toolsTaxonomy";
+import { type ToolId } from "@app/types/toolId";
+import {
+  asRegistryConfig,
+  ToolType,
+} from "@app/hooks/tools/shared/toolOperationTypes";
+import {
+  deserializeToolStep,
+  getExecutableTools,
+  serializeToolStep,
+  stepRequiresUpload,
+  type WorkingToolStep,
+} from "@app/hooks/tools/shared/toolAutomation";
+import { compressOperationConfig } from "@app/hooks/tools/compress/useCompressOperation";
+import { defaultParameters as compressDefaults } from "@app/hooks/tools/compress/useCompressParameters";
+import { splitOperationConfig } from "@app/hooks/tools/split/useSplitOperation";
+import { SPLIT_METHODS } from "@app/constants/splitConstants";
+import { redactOperationConfig } from "@app/hooks/tools/redact/useRedactOperation";
+
+function entry(over: Partial<ToolRegistryEntry>): ToolRegistryEntry {
+  return {
+    icon: null,
+    name: "",
+    component: null,
+    description: "",
+    categoryId: ToolCategoryId.RECOMMENDED_TOOLS,
+    subcategoryId: SubcategoryId.GENERAL,
+    automationSettings: null,
+    ...over,
+  };
+}
+
+const NoopSettings = () => null;
+
+// A migrated, param-less config (mappers present, no settings UI) -> "noSettings".
+const repairConfig = asRegistryConfig({
+  toolType: ToolType.singleFile,
+  operationType: "repair",
+  endpoint: "/api/v1/misc/repair",
+  defaultParameters: {},
+  buildFormData: () => new FormData(),
+  toApiParams: () => ({}),
+  fromApiParams: () => ({}),
+});
+
+// A config with no mappers (not migrated) -> "unsupported".
+const changeMetadataConfig = asRegistryConfig({
+  toolType: ToolType.singleFile,
+  operationType: "changeMetadata",
+  endpoint: "/api/v1/misc/update-metadata",
+  defaultParameters: {},
+  buildFormData: () => new FormData(),
+});
+
+const registry: Partial<ToolRegistry> = {
+  compress: entry({
+    name: "Compress",
+    automationSettings: NoopSettings,
+    operationConfig: asRegistryConfig(compressOperationConfig),
+  }),
+  repair: entry({ name: "Repair", operationConfig: repairConfig }),
+  changeMetadata: entry({
+    name: "Change metadata",
+    automationSettings: NoopSettings,
+    operationConfig: changeMetadataConfig,
+  }),
+  // Excluded: automation explicitly off.
+  sign: entry({
+    name: "Sign",
+    supportsAutomate: false,
+    operationConfig: repairConfig,
+  }),
+  // Excluded: no operationConfig at all.
+  extractPages: entry({ name: "Extract pages" }),
+};
+
+// Separate registry so these don't change the getExecutableTools expectations above.
+const dynamicRegistry: Partial<ToolRegistry> = {
+  split: entry({
+    name: "Split",
+    automationSettings: NoopSettings,
+    operationConfig: asRegistryConfig(splitOperationConfig),
+  }),
+  redact: entry({
+    name: "Redact",
+    automationSettings: NoopSettings,
+    operationConfig: asRegistryConfig(redactOperationConfig),
+  }),
+};
+
+describe("getExecutableTools", () => {
+  test("lists automatable tools with a resolvable endpoint, classified by support", () => {
+    const tools = getExecutableTools(registry);
+    expect(tools.map((t) => t.toolId)).toEqual([
+      "changeMetadata",
+      "compress",
+      "repair",
+    ]);
+    expect(Object.fromEntries(tools.map((t) => [t.toolId, t.support]))).toEqual(
+      {
+        compress: "editable",
+        repair: "noSettings",
+        changeMetadata: "unsupported",
+      },
+    );
+  });
+});
+
+describe("serialize/deserialize round-trip", () => {
+  test("compress maps UI params to the backend body and back", () => {
+    const step: WorkingToolStep = {
+      toolId: "compress" as ToolId,
+      operation: "/api/v1/misc/compress-pdf",
+      params: {
+        ...compressDefaults,
+        compressionLevel: 7,
+        compressionMethod: "filesize",
+        fileSizeValue: "2",
+        fileSizeUnit: "MB",
+      },
+      support: "editable",
+    };
+
+    const api = serializeToolStep(step, registry);
+    expect(api.operation).toBe("/api/v1/misc/compress-pdf");
+    expect(api.parameters).toMatchObject({
+      optimizeLevel: 7,
+      expectedOutputSize: "2MB",
+    });
+
+    const back = deserializeToolStep(api, registry);
+    expect(back.toolId).toBe("compress");
+    expect(back.params).toMatchObject({
+      compressionLevel: 7,
+      compressionMethod: "filesize",
+      fileSizeValue: "2",
+      fileSizeUnit: "MB",
+    });
+  });
+
+  test("an unknown endpoint is preserved as an unmapped step", () => {
+    const step = deserializeToolStep(
+      { operation: "/api/v1/unknown/thing", parameters: { keep: true } },
+      registry,
+    );
+    expect(step.toolId).toBeNull();
+    expect(step.support).toBe("unknown");
+    expect(serializeToolStep(step, registry)).toEqual({
+      operation: "/api/v1/unknown/thing",
+      parameters: { keep: true },
+    });
+  });
+
+  test("a dynamic-endpoint tool (split by chapters) round-trips as an editable step", () => {
+    const step: WorkingToolStep = {
+      toolId: "split" as ToolId,
+      operation: "/api/v1/general/split-pdf-by-chapters",
+      params: { method: SPLIT_METHODS.BY_CHAPTERS, bookmarkLevel: "2" },
+      support: "editable",
+    };
+
+    const api = serializeToolStep(step, dynamicRegistry);
+    expect(api.operation).toBe("/api/v1/general/split-pdf-by-chapters");
+    expect(api.parameters).toMatchObject({ bookmarkLevel: 2 });
+
+    // No `method` in the stored body, so this only matches via the declared endpoint set.
+    const back = deserializeToolStep(api, dynamicRegistry);
+    expect(back.toolId).toBe("split");
+    expect(back.support).toBe("editable");
+    expect(back.operation).toBe("/api/v1/general/split-pdf-by-chapters");
+    expect(back.params).toMatchObject({ method: SPLIT_METHODS.BY_CHAPTERS });
+  });
+
+  test("a dynamic-endpoint tool whose routing field is dropped (redact) stays editable", () => {
+    const step: WorkingToolStep = {
+      toolId: "redact" as ToolId,
+      operation: "/api/v1/security/auto-redact",
+      params: { mode: "automatic", wordsToRedact: ["secret"] },
+      support: "editable",
+    };
+
+    const api = serializeToolStep(step, dynamicRegistry);
+    expect(api.operation).toBe("/api/v1/security/auto-redact");
+    expect(api.parameters).not.toHaveProperty("mode");
+
+    // No `mode` in the body, so it only matches via the declared set (replay would yield null).
+    const back = deserializeToolStep(api, dynamicRegistry);
+    expect(back.toolId).toBe("redact");
+    expect(back.support).toBe("editable");
+    expect(back.operation).toBe("/api/v1/security/auto-redact");
+    expect(back.params).toMatchObject({ mode: "automatic" });
+  });
+});
+
+describe("stepRequiresUpload", () => {
+  const step = (params: Record<string, unknown>): WorkingToolStep => ({
+    toolId: "compress" as ToolId,
+    operation: "/api/v1/misc/compress-pdf",
+    params,
+    support: "editable",
+  });
+
+  test("detects a File (or list of Files) among the parameters", () => {
+    const image = new File(["x"], "logo.png", { type: "image/png" });
+    expect(stepRequiresUpload(step({ level: 5 }))).toBe(false);
+    expect(stepRequiresUpload(step({ watermarkImage: image }))).toBe(true);
+    expect(stepRequiresUpload(step({ attachments: [image] }))).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
new file mode 100644
index 0000000000..d567a1dad1
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
@@ -0,0 +1,260 @@
+/**
+ * Registry-level automation logic: which tools can be run as a backend operation step, how much
+ * of their parameters can be edited in a UI, and conversion between a tool's frontend parameter
+ * shape and the backend step contract (endpoint + backend parameters).
+ *
+ * This is core behaviour shared by every surface that composes or replays tool operations against
+ * the backend engine (portal pipelines today; backend-executed automations and AI plans later),
+ * so the "is this tool usable, and how" decision lives with the tools rather than in any one
+ * feature. It builds on each tool's `operationConfig` mappers (`toApiParams` / `fromApiParams`),
+ * keeping the frontend<->backend parameter mapping single-sourced in the tools.
+ */
+
+import { type ReactNode } from "react";
+import {
+  getToolSupportsAutomate,
+  type SubcategoryId,
+  type ToolRegistry,
+  type ToolRegistryEntry,
+} from "@app/data/toolsTaxonomy";
+import { type ToolId } from "@app/types/toolId";
+import {
+  isToolEndpoint,
+  type ToolEndpoint,
+} from "@app/hooks/tools/shared/toolApiMapping";
+import {
+  type ErasedToolParams,
+  type RegistryToolOperationConfig,
+} from "@app/hooks/tools/shared/toolOperationTypes";
+
+/**
+ * How much of a tool's parameters a UI can edit when composing a backend step:
+ * - `editable`: has both mappers and a settings UI -> render the settings UI.
+ * - `noSettings`: migrated to the mapper seam but has no parameters to configure.
+ * - `unsupported`: not migrated to the mapper seam -> parameters can't be mapped for editing yet;
+ *   the step runs with the backend's defaults.
+ */
+export type ToolStepSupport = "editable" | "noSettings" | "unsupported";
+
+/** A tool that can be added to a backend operation chain, with its editing support. */
+export interface ExecutableTool {
+  toolId: ToolId;
+  name: string;
+  icon: ReactNode;
+  /** Subcategory the tool belongs to, so a picker can group tools without re-reading the registry. */
+  subcategoryId: SubcategoryId;
+  /** Endpoint resolved from default parameters, for display/inclusion. The stored step's endpoint is re-resolved from the configured parameters at serialization time. */
+  endpoint: ToolEndpoint;
+  support: ToolStepSupport;
+}
+
+/**
+ * The backend step contract: an endpoint path plus its backend-shaped parameters. `operation` is a
+ * plain string, not a {@link ToolEndpoint}, because this is the raw backend boundary (it mirrors
+ * the stored policy step) and a pipeline may reference endpoints the frontend does not model.
+ */
+export interface ToolApiStep {
+  operation: string;
+  parameters: Record<string, unknown>;
+}
+
+/** A step being edited in a UI that maps to a known tool: parameters are in the tool's frontend shape. */
+export interface KnownToolStep {
+  toolId: ToolId;
+  operation: ToolEndpoint;
+  params: ErasedToolParams;
+  support: ToolStepSupport;
+}
+
+/** A stored step whose endpoint maps to no known tool: preserved verbatim, not editable. */
+export interface UnknownToolStep {
+  toolId: null;
+  operation: string;
+  params: ErasedToolParams;
+  support: "unknown";
+}
+
+/** A step being edited in a UI, discriminated by whether its endpoint maps to a known tool. */
+export type WorkingToolStep = KnownToolStep | UnknownToolStep;
+
+/**
+ * Resolve a tool's endpoint from parameters. Static endpoints ignore params; dynamic ones may
+ * return undefined if the params don't determine one. The result is validated against the generated
+ * endpoint set (via {@link isToolEndpoint}) rather than cast, so a config endpoint that is not a
+ * known {@link ToolEndpoint} (e.g. a custom tool's arbitrary string) resolves to undefined.
+ */
+function resolveEndpoint(
+  config: RegistryToolOperationConfig | undefined,
+  params: ErasedToolParams,
+): ToolEndpoint | undefined {
+  const endpoint = config?.endpoint;
+  if (typeof endpoint === "string") {
+    return isToolEndpoint(endpoint) ? endpoint : undefined;
+  }
+  if (typeof endpoint === "function") {
+    const resolved = safeCall(endpoint, params);
+    return typeof resolved === "string" && isToolEndpoint(resolved)
+      ? resolved
+      : undefined;
+  }
+  return undefined;
+}
+
+/** Invoke a dynamic-endpoint function defensively; a throw means the params don't determine one. */
+function safeCall(
+  fn: (params: ErasedToolParams) => string | null | undefined,
+  params: ErasedToolParams,
+): string | null | undefined {
+  try {
+    return fn(params);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Classify how much of a tool's parameters a UI can edit when composing a step. */
+export function classifyToolStepSupport(
+  entry: ToolRegistryEntry,
+): ToolStepSupport {
+  const config = entry.operationConfig;
+  const hasMappers = Boolean(config?.toApiParams && config?.fromApiParams);
+  if (!hasMappers) return "unsupported";
+  return entry.automationSettings ? "editable" : "noSettings";
+}
+
+function isFileValue(value: unknown): boolean {
+  if (typeof File === "undefined") return false;
+  if (value instanceof File) return true;
+  return Array.isArray(value) && value.some((item) => item instanceof File);
+}
+
+/**
+ * True if any of a step's parameters is an uploaded file (or list of files). Such a step cannot be
+ * saved into a stored pipeline yet: the file bytes are not persisted with the policy, so a later
+ * (e.g. scheduled) run would have nothing to send for that named file field.
+ */
+export function stepRequiresUpload(step: WorkingToolStep): boolean {
+  return Object.values(step.params).some(isFileValue);
+}
+
+/**
+ * The tools that can be run as a backend operation step, sorted by name. Includes only automatable
+ * tools whose endpoint resolves from defaults (so they can become a backend step); this drops
+ * tools with no operationConfig and tools whose endpoint needs runtime input (e.g. convert).
+ */
+export function getExecutableTools(
+  registry: Partial<ToolRegistry>,
+): ExecutableTool[] {
+  const tools: ExecutableTool[] = [];
+  for (const [id, entry] of Object.entries(registry)) {
+    if (!entry || !getToolSupportsAutomate(entry)) continue;
+    const config = entry.operationConfig;
+    if (!config) continue;
+    const endpoint = resolveEndpoint(config, config.defaultParameters ?? {});
+    if (!endpoint) continue;
+    tools.push({
+      toolId: id as ToolId,
+      name: entry.name,
+      icon: entry.icon,
+      subcategoryId: entry.subcategoryId,
+      endpoint,
+      support: classifyToolStepSupport(entry),
+    });
+  }
+  return tools.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** A fresh working step for a tool just added to a chain, seeded with its default parameters. */
+export function newWorkingToolStep(
+  tool: ExecutableTool,
+  registry: Partial<ToolRegistry>,
+): KnownToolStep {
+  const config = registry[tool.toolId]?.operationConfig;
+  return {
+    toolId: tool.toolId,
+    operation: tool.endpoint,
+    params: { ...(config?.defaultParameters ?? {}) },
+    support: tool.support,
+  };
+}
+
+/** Serialize a working step into the backend step contract (endpoint + backend parameters). */
+export function serializeToolStep(
+  step: WorkingToolStep,
+  registry: Partial<ToolRegistry>,
+): ToolApiStep {
+  const config =
+    step.toolId !== null ? registry[step.toolId]?.operationConfig : undefined;
+  if (!config) {
+    // Unmapped step (unknown endpoint on edit): round-trip it unchanged.
+    return { operation: step.operation, parameters: step.params };
+  }
+  const merged = { ...(config.defaultParameters ?? {}), ...step.params };
+  const operation = resolveEndpoint(config, merged) ?? step.operation;
+  const parameters = config.toApiParams
+    ? (config.toApiParams(merged) as Record<string, unknown>)
+    : {};
+  return { operation, parameters };
+}
+
+/**
+ * Find the registry tool for a stored step's endpoint: exact match for static endpoints, else
+ * membership in a dynamic tool's declared `endpoints` set (replaying its function can't recover a
+ * frontend-only routing field). Replay is only the fallback when no set is declared.
+ */
+function findToolByEndpoint(
+  step: ToolApiStep,
+  registry: Partial<ToolRegistry>,
+): [ToolId, ToolRegistryEntry] | undefined {
+  let dynamic: [ToolId, ToolRegistryEntry] | undefined;
+  for (const [id, entry] of Object.entries(registry)) {
+    const endpoint = entry?.operationConfig?.endpoint;
+    if (typeof endpoint === "string") {
+      if (endpoint === step.operation) return [id as ToolId, entry];
+    } else if (typeof endpoint === "function" && !dynamic) {
+      const declared = entry?.operationConfig?.endpoints;
+      const matched = declared
+        ? declared.some((e) => e === step.operation)
+        : safeCall(endpoint, step.parameters) === step.operation;
+      if (matched) dynamic = [id as ToolId, entry];
+    }
+  }
+  return dynamic;
+}
+
+/** A stored step kept verbatim because its endpoint maps to no known tool. */
+function unmappedStep(step: ToolApiStep): UnknownToolStep {
+  return {
+    toolId: null,
+    operation: step.operation,
+    params: { ...step.parameters },
+    support: "unknown",
+  };
+}
+
+/**
+ * Rehydrate a stored backend step into a working step for editing: map the endpoint back to a tool
+ * and its backend parameters back to the frontend shape via `fromApiParams`. Steps whose endpoint
+ * maps to no known tool are kept as an unmapped, non-editable working step (parameters preserved).
+ */
+export function deserializeToolStep(
+  step: ToolApiStep,
+  registry: Partial<ToolRegistry>,
+): WorkingToolStep {
+  const match = findToolByEndpoint(step, registry);
+  if (!match) return unmappedStep(step);
+  const [toolId, entry] = match;
+  const config = entry.operationConfig;
+  const params: ErasedToolParams = config?.fromApiParams
+    ? {
+        ...(config.defaultParameters ?? {}),
+        ...config.fromApiParams(step.parameters as never),
+      }
+    : { ...(config?.defaultParameters ?? {}) };
+  // Validate against the generated endpoint set instead of casting the matched string.
+  const operation =
+    resolveEndpoint(config, params) ??
+    (isToolEndpoint(step.operation) ? step.operation : undefined);
+  if (operation === undefined) return unmappedStep(step);
+  return { toolId, operation, params, support: classifyToolStepSupport(entry) };
+}
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
index 8a895a78da..321443f463 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolOperationTypes.ts
@@ -101,9 +101,9 @@ interface BaseToolOperationConfig<TParams, TEndpoint extends ToolEndpoint> {
   consumesAllInputs?: boolean;
 }
 
-export interface SingleFileToolOperationConfig<
+interface SingleFileToolBody<
   TParams,
-  TEndpoint extends ToolEndpoint = ToolEndpoint,
+  TEndpoint extends ToolEndpoint,
 > extends BaseToolOperationConfig<TParams, TEndpoint> {
   /** This tool processes one file at a time. */
   toolType: ToolType.singleFile;
@@ -111,18 +111,19 @@ export interface SingleFileToolOperationConfig<
   /** Builds FormData for API request. */
   buildFormData: (params: TParams, file: File) => FormData;
 
-  /**
-   * API endpoint for the operation, or a function for dynamic routing. `null`
-   * when the operation has no backend endpoint (see {@link ToolOperationEndpoint}).
-   */
-  endpoint: TEndpoint | null | ((params: TParams) => TEndpoint | null);
-
   customProcessor?: undefined;
 }
 
-export interface MultiFileToolOperationConfig<
+/** Single-file tool config; see {@link EndpointBinding} for the endpoint/endpoints rule. */
+export type SingleFileToolOperationConfig<
   TParams,
   TEndpoint extends ToolEndpoint = ToolEndpoint,
+> = SingleFileToolBody<TParams, TEndpoint> &
+  EndpointBinding<TParams, TEndpoint>;
+
+interface MultiFileToolBody<
+  TParams,
+  TEndpoint extends ToolEndpoint,
 > extends BaseToolOperationConfig<TParams, TEndpoint> {
   /** This tool processes multiple files at once. */
   toolType: ToolType.multiFile;
@@ -133,15 +134,15 @@ export interface MultiFileToolOperationConfig<
   /** Builds FormData for API request. */
   buildFormData: (params: TParams, files: File[]) => FormData;
 
-  /**
-   * API endpoint for the operation, or a function for dynamic routing. `null`
-   * when the operation has no backend endpoint (see {@link ToolOperationEndpoint}).
-   */
-  endpoint: TEndpoint | null | ((params: TParams) => TEndpoint | null);
-
   customProcessor?: undefined;
 }
 
+/** Multi-file counterpart of {@link SingleFileToolOperationConfig}. */
+export type MultiFileToolOperationConfig<
+  TParams,
+  TEndpoint extends ToolEndpoint = ToolEndpoint,
+> = MultiFileToolBody<TParams, TEndpoint> & EndpointBinding<TParams, TEndpoint>;
+
 export interface CustomToolOperationConfig<
   TParams,
 > extends BaseToolOperationConfig<TParams, ToolEndpoint> {
@@ -157,6 +158,9 @@ export interface CustomToolOperationConfig<
    */
   endpoint?: string | ((params: TParams) => string | undefined);
 
+  /** `never` so `endpoints` stays readable across the union; custom tools declare no set. */
+  endpoints?: never;
+
   /**
    * Custom processing logic that completely bypasses standard file processing.
    * This tool handles all API calls, response processing, and file creation.
@@ -180,6 +184,23 @@ export type ToolOperationConfig<
   | MultiFileToolOperationConfig<TParams, TEndpoint>
   | CustomToolOperationConfig<TParams>;
 
+/**
+ * A static `endpoint` declares no set; a dynamic (function) `endpoint` must declare its full
+ * `endpoints` set, which is how findToolByEndpoint maps a stored step back to its tool when the
+ * endpoint-selecting parameter is frontend-only.
+ */
+type EndpointBinding<TParams, TEndpoint extends ToolEndpoint> =
+  | { endpoint: TEndpoint | null; endpoints?: never }
+  | {
+      endpoint: (params: TParams) => TEndpoint | null;
+      endpoints: readonly TEndpoint[];
+    };
+
+/** Union-distributing Omit, so stripping a key from a discriminated config keeps its branches. */
+type DistributiveOmit<T, K extends PropertyKey> = T extends unknown
+  ? Omit<T, K>
+  : never;
+
 /**
  * Define a single-file tool's operation config. Infers the endpoint literal from
  * `endpoint` and binds toApiParams/fromApiParams to that endpoint's request
@@ -189,9 +210,15 @@ export function defineSingleFileTool<
   TParams,
   const TEndpoint extends ToolEndpoint,
 >(
-  config: Omit<SingleFileToolOperationConfig<TParams, TEndpoint>, "toolType">,
+  config: DistributiveOmit<
+    SingleFileToolOperationConfig<TParams, TEndpoint>,
+    "toolType"
+  >,
 ): SingleFileToolOperationConfig<TParams, TEndpoint> {
-  return { ...config, toolType: ToolType.singleFile };
+  return {
+    ...config,
+    toolType: ToolType.singleFile,
+  } as SingleFileToolOperationConfig<TParams, TEndpoint>;
 }
 
 /** Multi-file counterpart of {@link defineSingleFileTool}. */
@@ -199,9 +226,15 @@ export function defineMultiFileTool<
   TParams,
   const TEndpoint extends ToolEndpoint,
 >(
-  config: Omit<MultiFileToolOperationConfig<TParams, TEndpoint>, "toolType">,
+  config: DistributiveOmit<
+    MultiFileToolOperationConfig<TParams, TEndpoint>,
+    "toolType"
+  >,
 ): MultiFileToolOperationConfig<TParams, TEndpoint> {
-  return { ...config, toolType: ToolType.multiFile };
+  return {
+    ...config,
+    toolType: ToolType.multiFile,
+  } as MultiFileToolOperationConfig<TParams, TEndpoint>;
 }
 
 /**
diff --git a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
index fad5b1f04e..af14ca2045 100644
--- a/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/split/useSplitOperation.ts
@@ -177,6 +177,8 @@ export const splitOperationConfig = defineSingleFileTool({
   fromApiParams: splitFromApiParams,
   operationType: "split",
   endpoint: getSplitEndpoint,
+  // Full routing set: a stored step maps back to Split though its `method` selector is frontend-only.
+  endpoints: Array.from(new Set(Object.values(SPLIT_ENDPOINTS))),
   defaultParameters,
 });
 
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 62502e6c67..c93d7b28bd 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -3,6 +3,7 @@ import { Home } from "@portal/views/Home";
 import { Users } from "@portal/views/Users";
 import { Documents } from "@portal/views/Documents";
 import { Pipelines } from "@portal/views/Pipelines";
+import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 import { Sources } from "@portal/views/Sources";
 import { AgentBuilder } from "@portal/views/AgentBuilder";
 import { Policies } from "@portal/views/Policies";
@@ -26,6 +27,14 @@ export function ViewRouter() {
       <Route index element={<Home />} />
       <Route path={rel(VIEW_PATHS.users)} element={<Users />} />
       <Route path={rel(VIEW_PATHS.pipelines)} element={<Pipelines />} />
+      <Route
+        path={`${rel(VIEW_PATHS.pipelines)}/new`}
+        element={<PipelineBuilder />}
+      />
+      <Route
+        path={`${rel(VIEW_PATHS.pipelines)}/:id`}
+        element={<PipelineBuilder />}
+      />
       <Route path={rel(VIEW_PATHS.sources)} element={<Sources />} />
       <Route
         path={rel(VIEW_PATHS["agent-builder"])}
diff --git a/frontend/editor/src/portal/components/PortalChrome.tsx b/frontend/editor/src/portal/components/PortalChrome.tsx
index 9e2ed8d359..2066e740d8 100644
--- a/frontend/editor/src/portal/components/PortalChrome.tsx
+++ b/frontend/editor/src/portal/components/PortalChrome.tsx
@@ -1,5 +1,6 @@
 import { useEffect } from "react";
 import { useLocation } from "react-router-dom";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 import { ErrorBoundary } from "@portal/components/ErrorBoundary";
 import { useUI } from "@portal/contexts/UIContext";
 import { AppShell } from "@portal/components/AppShell";
@@ -72,9 +73,12 @@ export function PortalChrome() {
   return (
     <>
       <GlobalShortcuts />
-      <AppShell>
-        <RoutedContent />
-      </AppShell>
+      {/* The pipeline builder reads the tool registry to list and configure operations. */}
+      <ToolRegistryProvider>
+        <AppShell>
+          <RoutedContent />
+        </AppShell>
+      </ToolRegistryProvider>
       <AssistantButton />
       <AssistantPanel />
       <SearchModal />
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx b/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
deleted file mode 100644
index fe0546a606..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineComposer.tsx
+++ /dev/null
@@ -1,477 +0,0 @@
-import { useEffect, useMemo, useState } from "react";
-import { useTranslation } from "react-i18next";
-import {
-  ActionIcon,
-  Banner,
-  Button,
-  Checkbox,
-  Chip,
-  FormField,
-  Input,
-  Modal,
-  RadioGroup,
-  Select,
-} from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  fetchTriggers,
-  savePipeline,
-  type OutputSpec,
-  type PipelineStep,
-  type Policy,
-  type TriggerConfig,
-  type TriggerInfo,
-} from "@portal/api/pipelines";
-import { fetchSources, type SourceView } from "@portal/api/sources";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  PIPELINE_OPERATIONS,
-  humanizeOperation,
-} from "@portal/components/pipelines/pipelineOperations";
-import "@portal/views/Pipelines.css";
-
-type OutputMode = "inline" | "folder";
-type ScheduleUnit = "MINUTES" | "HOURS" | "DAYS";
-
-const SCHEDULE_UNITS: ScheduleUnit[] = ["MINUTES", "HOURS", "DAYS"];
-/** Empty trigger type = manual-only (no automatic trigger). */
-const MANUAL = "";
-
-interface PipelineComposerProps {
-  open: boolean;
-  onClose: () => void;
-  /** Called after a pipeline is created or updated so the page can refetch. */
-  onSaved: () => void;
-  /** When set, the composer edits this existing policy instead of creating one. */
-  pipeline?: Policy;
-}
-
-/**
- * A policy's trigger parsed into the composer's fields: which trigger type (empty
- * = manual), and the schedule interval when it's a schedule trigger.
- */
-function parseTrigger(trigger: TriggerConfig | null): {
-  triggerType: string;
-  count: string;
-  unit: ScheduleUnit;
-} {
-  if (!trigger) return { triggerType: MANUAL, count: "1", unit: "HOURS" };
-  if (trigger.type === "schedule") {
-    const schedule = trigger.options?.schedule as
-      | { type?: string; count?: number; unit?: ScheduleUnit }
-      | undefined;
-    if (schedule?.type === "every") {
-      return {
-        triggerType: "schedule",
-        count: String(schedule.count ?? 1),
-        unit: schedule.unit ?? "HOURS",
-      };
-    }
-    // Non-interval schedules (daily/weekly/monthly) aren't editable here; show
-    // the schedule choice with defaults the user can re-set.
-    return { triggerType: "schedule", count: "1", unit: "HOURS" };
-  }
-  return { triggerType: trigger.type, count: "1", unit: "HOURS" };
-}
-
-/** Output sink fields parsed from a policy's output for editing. */
-function parseOutput(output: OutputSpec | undefined): {
-  mode: OutputMode;
-  directory: string;
-} {
-  if (output?.type === "folder") {
-    return {
-      mode: "folder",
-      directory: String(output.options?.directory ?? ""),
-    };
-  }
-  return { mode: "inline", directory: "" };
-}
-
-/**
- * Compose a pipeline (a backend policy): name it, pick the sources it pulls from
- * and how it's triggered, chain operations, and choose where output goes. On submit
- * a blank id creates and a set id updates, matching the backend's POST contract.
- * Per-operation parameter editing is out of scope here; operations are chained with
- * their defaults.
- */
-export function PipelineComposer({
-  open,
-  onClose,
-  onSaved,
-  pipeline,
-}: PipelineComposerProps) {
-  const { t } = useTranslation();
-  const isEdit = pipeline !== undefined;
-
-  const sourcesState = useAsync<SourceView[]>(
-    async () => (open ? (await fetchSources()).sources : []),
-    [open],
-  );
-  const availableSources = sourcesState.data ?? [];
-
-  // The triggers the backend supports, with their source-type compatibility, so
-  // the UI offers them (and pairs them with sources) without hard-coding the set.
-  const triggersState = useAsync<TriggerInfo[]>(
-    async () => (open ? await fetchTriggers() : []),
-    [open],
-  );
-  const triggers = useMemo(
-    () => triggersState.data ?? [],
-    [triggersState.data],
-  );
-
-  const [name, setName] = useState("");
-  const [sourceIds, setSourceIds] = useState<string[]>([]);
-  const [steps, setSteps] = useState<PipelineStep[]>([]);
-  const [triggerType, setTriggerType] = useState<string>(MANUAL);
-  const [scheduleCount, setScheduleCount] = useState("1");
-  const [scheduleUnit, setScheduleUnit] = useState<ScheduleUnit>("HOURS");
-  const [outputMode, setOutputMode] = useState<OutputMode>("inline");
-  const [outputDirectory, setOutputDirectory] = useState("");
-  const [submitting, setSubmitting] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  // Re-seed the form whenever the composer opens (or its target changes) so editing
-  // prefills the current config and a reopened create starts clean.
-  useEffect(() => {
-    if (!open) return;
-    const trigger = parseTrigger(pipeline?.trigger ?? null);
-    const output = parseOutput(pipeline?.output);
-    setName(pipeline?.name ?? "");
-    setSourceIds(pipeline?.sourceIds ?? []);
-    setSteps(pipeline?.steps ?? []);
-    setTriggerType(trigger.triggerType);
-    setScheduleCount(trigger.count);
-    setScheduleUnit(trigger.unit);
-    setOutputMode(output.mode);
-    setOutputDirectory(output.directory);
-    setSubmitting(false);
-    setError(null);
-  }, [open, pipeline]);
-
-  // Types of the currently-selected sources, for trigger compatibility.
-  const selectedSourceTypes = useMemo(
-    () =>
-      new Set(
-        availableSources
-          .filter((s) => sourceIds.includes(s.id))
-          .map((s) => s.type),
-      ),
-    [availableSources, sourceIds],
-  );
-
-  const triggerAvailable = useMemo(
-    () => (trigger: TriggerInfo) =>
-      !trigger.requiresSource ||
-      trigger.supportedSourceTypes.some((type) =>
-        selectedSourceTypes.has(type),
-      ),
-    [selectedSourceTypes],
-  );
-
-  // A source-requiring trigger stops being valid the moment its compatible source
-  // is deselected; fall back to manual so we never submit an impossible trigger.
-  useEffect(() => {
-    if (triggerType === MANUAL) return;
-    const selected = triggers.find((trigger) => trigger.type === triggerType);
-    if (selected && !triggerAvailable(selected)) setTriggerType(MANUAL);
-  }, [triggerType, triggers, triggerAvailable]);
-
-  function toggleSource(id: string, checked: boolean) {
-    setSourceIds((ids) =>
-      checked ? [...ids, id] : ids.filter((existing) => existing !== id),
-    );
-  }
-
-  function addStep(operation: string, parameters: Record<string, unknown>) {
-    setSteps((current) => [
-      ...current,
-      { operation, parameters: { ...parameters } },
-    ]);
-  }
-
-  function removeStep(index: number) {
-    setSteps((current) => current.filter((_, i) => i !== index));
-  }
-
-  function moveStep(index: number, delta: number) {
-    setSteps((current) => {
-      const next = [...current];
-      const target = index + delta;
-      if (target < 0 || target >= next.length) return current;
-      [next[index], next[target]] = [next[target], next[index]];
-      return next;
-    });
-  }
-
-  const scheduleCountValid =
-    triggerType !== "schedule" || Number(scheduleCount) > 0;
-  const outputValid = outputMode !== "folder" || outputDirectory.trim() !== "";
-  const canSave =
-    name.trim() !== "" && scheduleCountValid && outputValid && !submitting;
-
-  const triggerOptions = [
-    { value: MANUAL, label: t("portal.pipelines.composer.triggerManual") },
-    ...triggers.map((trigger) => ({
-      value: trigger.type,
-      label: t(`portal.pipelines.trigger.${trigger.type}`, {
-        defaultValue: trigger.type,
-      }),
-      disabled: !triggerAvailable(trigger),
-    })),
-  ];
-
-  function buildTrigger(): TriggerConfig | null {
-    if (triggerType === MANUAL) return null;
-    if (triggerType === "schedule") {
-      return {
-        type: "schedule",
-        options: {
-          schedule: {
-            type: "every",
-            count: Number(scheduleCount),
-            unit: scheduleUnit,
-          },
-        },
-      };
-    }
-    return { type: triggerType, options: {} };
-  }
-
-  async function submit() {
-    if (!canSave) return;
-    setSubmitting(true);
-    setError(null);
-    const output: OutputSpec =
-      outputMode === "folder"
-        ? { type: "folder", options: { directory: outputDirectory.trim() } }
-        : { type: "inline", options: {} };
-    const policy: Policy = {
-      id: pipeline?.id,
-      name: name.trim(),
-      enabled: pipeline?.enabled ?? true,
-      trigger: buildTrigger(),
-      sourceIds,
-      steps,
-      output,
-    };
-    try {
-      await savePipeline(policy);
-      onSaved();
-      onClose();
-    } catch (e) {
-      setError(errorMessage(e));
-    } finally {
-      setSubmitting(false);
-    }
-  }
-
-  return (
-    <Modal
-      open={open}
-      onClose={onClose}
-      width="lg"
-      title={
-        isEdit
-          ? t("portal.pipelines.composer.editTitle")
-          : t("portal.pipelines.composer.title")
-      }
-      subtitle={t("portal.pipelines.composer.subtitle")}
-      footer={
-        <div className="portal-pipelines__composer-footer">
-          <Button
-            variant="tertiary"
-            size="sm"
-            disabled={submitting}
-            onClick={onClose}
-          >
-            {t("portal.pipelines.composer.cancel")}
-          </Button>
-          <Button
-            size="sm"
-            onClick={submit}
-            loading={submitting}
-            disabled={!canSave}
-          >
-            {isEdit
-              ? t("portal.pipelines.composer.save")
-              : t("portal.pipelines.composer.create")}
-          </Button>
-        </div>
-      }
-    >
-      <div className="portal-pipelines__composer">
-        <FormField label={t("portal.pipelines.composer.name")} required>
-          <Input
-            value={name}
-            placeholder={t("portal.pipelines.composer.namePlaceholder")}
-            onChange={(e) => setName(e.target.value)}
-          />
-        </FormField>
-
-        {/* Sources */}
-        <div className="portal-pipelines__composer-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.composer.sources")}
-          </span>
-          {sourcesState.loading ? (
-            <p className="portal-pipelines__muted">
-              {t("portal.pipelines.composer.sourcesLoading")}
-            </p>
-          ) : availableSources.length === 0 ? (
-            <p className="portal-pipelines__muted">
-              {t("portal.pipelines.composer.noSources")}
-            </p>
-          ) : (
-            <div className="portal-pipelines__source-list">
-              {availableSources.map((source) => (
-                <Checkbox
-                  key={source.id}
-                  checked={sourceIds.includes(source.id)}
-                  onChange={(e) => toggleSource(source.id, e.target.checked)}
-                  label={source.name}
-                />
-              ))}
-            </div>
-          )}
-
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.composer.trigger")}
-          </span>
-          <RadioGroup<string>
-            name="pipeline-trigger"
-            value={triggerType}
-            onChange={setTriggerType}
-            direction="horizontal"
-            options={triggerOptions}
-          />
-          {triggerType === "schedule" && (
-            <div className="portal-pipelines__schedule">
-              <span className="portal-pipelines__muted">
-                {t("portal.pipelines.composer.scheduleEvery")}
-              </span>
-              <Input
-                inputSize="sm"
-                type="number"
-                min={1}
-                value={scheduleCount}
-                invalid={!scheduleCountValid}
-                onChange={(e) => setScheduleCount(e.target.value)}
-                className="portal-pipelines__schedule-count"
-              />
-              <Select
-                inputSize="sm"
-                value={scheduleUnit}
-                onChange={(value) =>
-                  setScheduleUnit((value ?? "") as ScheduleUnit)
-                }
-                options={SCHEDULE_UNITS.map((unit) => ({
-                  value: unit,
-                  label: t(
-                    `portal.pipelines.composer.unit.${unit.toLowerCase()}`,
-                  ),
-                }))}
-              />
-            </div>
-          )}
-        </div>
-
-        {/* Operations */}
-        <div className="portal-pipelines__composer-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.composer.operations", { count: steps.length })}
-          </span>
-          {steps.length === 0 ? (
-            <p className="portal-pipelines__muted">
-              {t("portal.pipelines.composer.chainEmpty")}
-            </p>
-          ) : (
-            <ol className="portal-pipelines__chain">
-              {steps.map((step, i) => (
-                <li
-                  key={`${step.operation}-${i}`}
-                  className="portal-pipelines__chain-row"
-                >
-                  <span className="portal-pipelines__chain-index">{i + 1}</span>
-                  <span className="portal-pipelines__chain-op">
-                    {humanizeOperation(step.operation)}
-                  </span>
-                  <div className="portal-pipelines__chain-actions">
-                    <ActionIcon
-                      type="button"
-                      aria-label={t("portal.pipelines.composer.moveUp")}
-                      disabled={i === 0}
-                      onClick={() => moveStep(i, -1)}
-                    >
-                      ↑
-                    </ActionIcon>
-                    <ActionIcon
-                      type="button"
-                      aria-label={t("portal.pipelines.composer.moveDown")}
-                      disabled={i === steps.length - 1}
-                      onClick={() => moveStep(i, 1)}
-                    >
-                      ↓
-                    </ActionIcon>
-                    <ActionIcon
-                      type="button"
-                      aria-label={t("portal.pipelines.composer.removeStep")}
-                      onClick={() => removeStep(i)}
-                    >
-                      ×
-                    </ActionIcon>
-                  </div>
-                </li>
-              ))}
-            </ol>
-          )}
-          <div className="portal-pipelines__op-palette">
-            {PIPELINE_OPERATIONS.map((op) => (
-              <Chip
-                key={op.operation}
-                accent="default"
-                size="sm"
-                onClick={() => addStep(op.operation, op.parameters)}
-              >
-                {`+ ${humanizeOperation(op.operation)}`}
-              </Chip>
-            ))}
-          </div>
-        </div>
-
-        {/* Output */}
-        <div className="portal-pipelines__composer-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.composer.output")}
-          </span>
-          <RadioGroup<OutputMode>
-            name="pipeline-output"
-            value={outputMode}
-            onChange={setOutputMode}
-            direction="horizontal"
-            options={[
-              { value: "inline", label: t("portal.pipelines.output.inline") },
-              { value: "folder", label: t("portal.pipelines.output.folder") },
-            ]}
-          />
-          {outputMode === "folder" && (
-            <FormField
-              label={t("portal.pipelines.composer.directory")}
-              helperText={t("portal.pipelines.composer.directoryHelp")}
-              required
-            >
-              <Input
-                value={outputDirectory}
-                placeholder="/data/processed"
-                onChange={(e) => setOutputDirectory(e.target.value)}
-              />
-            </FormField>
-          )}
-        </div>
-
-        {error && <Banner tone="danger" description={error} />}
-      </div>
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx b/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
deleted file mode 100644
index ea72ddfc53..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineDetailCard.tsx
+++ /dev/null
@@ -1,215 +0,0 @@
-import { useEffect, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { ActionIcon, Banner, Button, Chip } from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  fetchRun,
-  triggerPipeline,
-  type PipelineView,
-  type PolicyRunView,
-} from "@portal/api/pipelines";
-import { humanizeOperation } from "@portal/components/pipelines/pipelineOperations";
-import "@portal/views/Pipelines.css";
-
-const TERMINAL_STATUSES = new Set(["COMPLETED", "FAILED", "CANCELLED"]);
-const POLL_INTERVAL_MS = 1500;
-const POLL_ATTEMPTS = 60;
-
-type RunResult = { tone: "success" | "danger" | "info"; text: string };
-
-interface PipelineDetailCardProps {
-  pipeline: PipelineView;
-  onClose: () => void;
-  onEdit: (pipeline: PipelineView) => void;
-  onTogglePause: (pipeline: PipelineView) => void;
-  onDelete: (pipeline: PipelineView) => void;
-  /** Disables the actions while a page-level mutation is in flight. */
-  busy?: boolean;
-}
-
-const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-
-/** Expanded detail for the selected pipeline row, with run/edit/pause/delete actions. */
-export function PipelineDetailCard({
-  pipeline,
-  onClose,
-  onEdit,
-  onTogglePause,
-  onDelete,
-  busy = false,
-}: PipelineDetailCardProps) {
-  const { t } = useTranslation();
-  const paused = pipeline.status === "paused";
-
-  const [running, setRunning] = useState(false);
-  const [runResult, setRunResult] = useState<RunResult | null>(null);
-  const mounted = useRef(true);
-  useEffect(() => {
-    mounted.current = true;
-    return () => {
-      mounted.current = false;
-    };
-  }, []);
-
-  // Poll a run until it reaches a terminal state (or we give up), so a failure
-  // during execution surfaces with its error message rather than silently.
-  async function awaitRun(runId: string): Promise<PolicyRunView | null> {
-    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt++) {
-      if (!mounted.current) return null;
-      const view = await fetchRun(runId);
-      if (TERMINAL_STATUSES.has(view.status)) return view;
-      await sleep(POLL_INTERVAL_MS);
-    }
-    return null;
-  }
-
-  async function handleRun() {
-    if (running || busy) return;
-    setRunning(true);
-    setRunResult(null);
-    try {
-      const runIds = await triggerPipeline(pipeline.id);
-      if (runIds.length === 0) {
-        if (mounted.current)
-          setRunResult({ tone: "info", text: t("portal.pipelines.run.empty") });
-        return;
-      }
-      const finals = await Promise.all(runIds.map((id) => awaitRun(id)));
-      if (!mounted.current) return;
-      const failed = finals.find((r) => r?.status === "FAILED");
-      if (failed) {
-        setRunResult({
-          tone: "danger",
-          text: t("portal.pipelines.run.failed", { error: failed.error ?? "" }),
-        });
-      } else if (finals.every((r) => r?.status === "COMPLETED")) {
-        setRunResult({
-          tone: "success",
-          text: t("portal.pipelines.run.completed", { count: finals.length }),
-        });
-      } else {
-        // Still running when we stopped polling, or cancelled.
-        setRunResult({ tone: "info", text: t("portal.pipelines.run.running") });
-      }
-    } catch (e) {
-      if (mounted.current)
-        setRunResult({ tone: "danger", text: errorMessage(e) });
-    } finally {
-      if (mounted.current) setRunning(false);
-    }
-  }
-
-  return (
-    <section className="portal-pipelines__expanded">
-      <header className="portal-pipelines__expanded-head">
-        <span className="portal-pipelines__pipe-dot" aria-hidden>
-          ⛓
-        </span>
-        <div>
-          <h2 className="portal-pipelines__expanded-title">{pipeline.name}</h2>
-          <span className="portal-pipelines__expanded-sub">
-            {t("portal.pipelines.detail.subtitle", {
-              trigger: t(`portal.pipelines.trigger.${pipeline.trigger}`, {
-                defaultValue: pipeline.trigger,
-              }),
-              status: t(`portal.pipelines.status.${pipeline.status}`),
-            })}
-          </span>
-        </div>
-        <ActionIcon
-          type="button"
-          className="portal-pipelines__expanded-close"
-          onClick={onClose}
-          aria-label={t("portal.pipelines.detail.closeAriaLabel")}
-        >
-          ×
-        </ActionIcon>
-      </header>
-
-      <div className="portal-pipelines__detail">
-        <div className="portal-pipelines__detail-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.detail.steps")}
-          </span>
-          {pipeline.steps.length === 0 ? (
-            <p className="portal-pipelines__muted">
-              {t("portal.pipelines.detail.noSteps")}
-            </p>
-          ) : (
-            <div className="portal-pipelines__chips">
-              {pipeline.steps.map((step, i) => (
-                <Chip key={`${step}-${i}`} size="sm">
-                  {`${i + 1}. ${humanizeOperation(step)}`}
-                </Chip>
-              ))}
-            </div>
-          )}
-        </div>
-
-        <div className="portal-pipelines__detail-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.detail.sources")}
-          </span>
-          {pipeline.sources.length === 0 ? (
-            <p className="portal-pipelines__muted">
-              {t("portal.pipelines.detail.noSources")}
-            </p>
-          ) : (
-            <div className="portal-pipelines__chips">
-              {pipeline.sources.map((source) => (
-                <Chip key={source.id} accent="neutral" size="sm">
-                  {source.name}
-                </Chip>
-              ))}
-            </div>
-          )}
-        </div>
-
-        <div className="portal-pipelines__detail-section">
-          <span className="portal-pipelines__detail-heading">
-            {t("portal.pipelines.detail.output")}
-          </span>
-          <Chip accent="premium" size="sm">
-            {t(`portal.pipelines.output.${pipeline.output}`, {
-              defaultValue: pipeline.output,
-            })}
-          </Chip>
-        </div>
-      </div>
-
-      {runResult && (
-        <Banner tone={runResult.tone} description={runResult.text} />
-      )}
-
-      <div className="portal-pipelines__detail-actions">
-        <Button loading={running} disabled={busy} onClick={handleRun}>
-          {t("portal.pipelines.detail.run")}
-        </Button>
-        <Button
-          variant="secondary"
-          disabled={busy || running}
-          onClick={() => onEdit(pipeline)}
-        >
-          {t("portal.pipelines.detail.edit")}
-        </Button>
-        <Button
-          variant="secondary"
-          disabled={busy || running}
-          onClick={() => onTogglePause(pipeline)}
-        >
-          {paused
-            ? t("portal.pipelines.detail.resume")
-            : t("portal.pipelines.detail.pause")}
-        </Button>
-        <Button
-          accent="danger"
-          variant="secondary"
-          disabled={busy || running}
-          onClick={() => onDelete(pipeline)}
-        >
-          {t("portal.pipelines.detail.delete")}
-        </Button>
-      </div>
-    </section>
-  );
-}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
new file mode 100644
index 0000000000..fe2ee9dd2a
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
@@ -0,0 +1,59 @@
+import { Suspense } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner } from "@app/ui";
+import { type ToolRegistry } from "@app/data/toolsTaxonomy";
+import { type ErasedToolParams } from "@app/hooks/tools/shared/toolOperationTypes";
+import { type WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
+
+interface PipelineStepSettingsProps {
+  step: WorkingToolStep;
+  registry: Partial<ToolRegistry>;
+  onChange: (params: ErasedToolParams) => void;
+}
+
+/**
+ * Renders the parameter editor for one pipeline step, chosen by the tool's capability:
+ * the tool's own settings UI when editable, an explanatory note when it has no parameters,
+ * or a "not supported yet" fallback for tools not yet migrated to the mapper seam.
+ */
+export function PipelineStepSettings({
+  step,
+  registry,
+  onChange,
+}: PipelineStepSettingsProps) {
+  const { t } = useTranslation();
+
+  if (step.support === "noSettings") {
+    return (
+      <Banner
+        tone="info"
+        description={t("portal.pipelines.composer.noToolSettings")}
+      />
+    );
+  }
+
+  const entry = step.toolId ? registry[step.toolId] : undefined;
+  const Settings =
+    step.support === "editable" ? entry?.automationSettings : null;
+
+  if (!Settings) {
+    return (
+      <Banner
+        tone="warning"
+        description={t("portal.pipelines.composer.editingUnsupported")}
+      />
+    );
+  }
+
+  return (
+    <Suspense fallback={null}>
+      <Settings
+        parameters={step.params}
+        onParameterChange={(key, value) =>
+          onChange({ ...step.params, [key]: value })
+        }
+        disabled={false}
+      />
+    </Suspense>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
index d2fda82fdc..42550e28a4 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
@@ -1,5 +1,6 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
+import ChevronRightRoundedIcon from "@mui/icons-material/ChevronRightRounded";
 import {
   Chip,
   StatusBadge,
@@ -16,16 +17,11 @@ const STATUS_TONE: Record<PipelineStatus, StatusTone> = {
 
 interface PipelinesTableProps {
   pipelines: PipelineView[];
-  /** Id of the row whose detail panel is open, drives the caret state. */
-  expandedId: string | null;
+  /** A row opens that pipeline's own page. */
   onRowClick: (pipeline: PipelineView) => void;
 }
 
-export function PipelinesTable({
-  pipelines,
-  expandedId,
-  onRowClick,
-}: PipelinesTableProps) {
+export function PipelinesTable({ pipelines, onRowClick }: PipelinesTableProps) {
   const { t } = useTranslation();
   const columns = useMemo<TableColumn<PipelineView>[]>(
     () => [
@@ -90,24 +86,18 @@ export function PipelinesTable({
         ),
       },
       {
-        key: "expand",
+        key: "open",
         header: "",
         align: "right",
         width: "2.5rem",
-        render: (p) => (
-          <span
-            className={
-              "portal-pipelines__caret" +
-              (expandedId === p.id ? " is-open" : "")
-            }
-            aria-hidden
-          >
-            ▸
+        render: () => (
+          <span className="portal-pipelines__caret" aria-hidden>
+            <ChevronRightRoundedIcon style={{ fontSize: "1.25rem" }} />
           </span>
         ),
       },
     ],
-    [expandedId, t],
+    [t],
   );
 
   return (
diff --git a/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
new file mode 100644
index 0000000000..e031854ec1
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
@@ -0,0 +1,99 @@
+import { useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import {
+  getSubcategoryLabel,
+  SUBCATEGORY_ORDER,
+  type SubcategoryId,
+} from "@app/data/toolsTaxonomy";
+import { type ExecutableTool } from "@app/hooks/tools/shared/toolAutomation";
+
+interface ToolPickerProps {
+  tools: ExecutableTool[];
+  onPick: (tool: ExecutableTool) => void;
+  onClose: () => void;
+}
+
+/**
+ * Type-to-filter, category-grouped tool picker for adding a step to a pipeline. Replaces the flat
+ * wall of tool pills so the list stays usable as the tool count grows.
+ */
+export function ToolPicker({ tools, onPick, onClose }: ToolPickerProps) {
+  const { t } = useTranslation();
+  const [query, setQuery] = useState("");
+
+  const groups = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    const matched = q
+      ? tools.filter((tool) => tool.name.toLowerCase().includes(q))
+      : tools;
+    const byCategory = new Map<SubcategoryId, ExecutableTool[]>();
+    for (const tool of matched) {
+      const list = byCategory.get(tool.subcategoryId) ?? [];
+      list.push(tool);
+      byCategory.set(tool.subcategoryId, list);
+    }
+    return SUBCATEGORY_ORDER.filter((id) => byCategory.has(id)).map((id) => ({
+      id,
+      label: getSubcategoryLabel(t, id),
+      tools: byCategory.get(id) ?? [],
+    }));
+  }, [tools, query, t]);
+
+  return (
+    <div
+      className="portal-pipelines__picker"
+      role="dialog"
+      aria-label={t("portal.pipelines.builder.addStep")}
+    >
+      <div className="portal-pipelines__picker-search">
+        <input
+          autoFocus
+          value={query}
+          placeholder={t("portal.pipelines.builder.searchTools")}
+          onChange={(e) => setQuery(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === "Escape") onClose();
+          }}
+        />
+      </div>
+      <div className="portal-pipelines__picker-list">
+        {groups.length === 0 ? (
+          <p className="portal-pipelines__picker-empty">
+            {t("portal.pipelines.builder.noToolMatches")}
+          </p>
+        ) : (
+          groups.map((group) => (
+            <div key={group.id} className="portal-pipelines__picker-group">
+              <div className="portal-pipelines__picker-group-label">
+                {group.label}
+              </div>
+              {group.tools.map((tool) => (
+                <Button
+                  key={tool.toolId}
+                  variant="quiet"
+                  justify="start"
+                  fullWidth
+                  className="portal-pipelines__picker-item"
+                  onClick={() => onPick(tool)}
+                  leftSection={
+                    <span
+                      className="portal-pipelines__picker-icon"
+                      aria-hidden="true"
+                    >
+                      {tool.icon}
+                    </span>
+                  }
+                >
+                  <span className="portal-pipelines__picker-name">
+                    {tool.name}
+                  </span>
+                </Button>
+              ))}
+            </div>
+          ))
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
new file mode 100644
index 0000000000..cef65d6e75
--- /dev/null
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -0,0 +1,394 @@
+.portal-builder {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+  padding: 1.5rem;
+  max-width: 84rem;
+  margin: 0 auto;
+}
+
+.portal-builder__loading {
+  display: flex;
+  justify-content: center;
+  padding: 4rem 0;
+}
+
+/* Header */
+.portal-builder__head {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  padding-bottom: 1rem;
+  border-bottom: 1px solid var(--color-border-light);
+}
+
+.portal-builder__back {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  border: none;
+  background: none;
+  padding: 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  cursor: pointer;
+  white-space: nowrap;
+}
+
+.portal-builder__back:hover {
+  color: var(--color-text-1);
+}
+
+.portal-builder__head-main {
+  flex: 1;
+  min-width: 12rem;
+}
+
+.portal-builder__head-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+/* Two-pane layout */
+.portal-builder__grid {
+  display: grid;
+  grid-template-columns: 1.4fr 1fr;
+  gap: 1.25rem;
+  align-items: start;
+}
+
+@media (max-width: 60rem) {
+  .portal-builder__grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+.portal-builder__flow {
+  display: flex;
+  flex-direction: column;
+  gap: 0.625rem;
+}
+
+.portal-builder__section-label {
+  font-size: 0.6875rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--color-text-5);
+  font-weight: 600;
+}
+
+.portal-builder__empty {
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  margin: 0;
+  padding: 0.5rem 0;
+}
+
+/* Step cards */
+.portal-builder__steps {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.portal-builder__step {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-lg);
+  padding: 0.5rem 0.625rem;
+  transition:
+    border-color var(--motion-fast),
+    background var(--motion-fast);
+}
+
+.portal-builder__step--active {
+  border-color: var(--color-blue);
+  background: var(--color-blue-light);
+}
+
+.portal-builder__step-main {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  border: none;
+  background: none;
+  padding: 0.25rem;
+  text-align: left;
+  cursor: pointer;
+  color: inherit;
+}
+
+.portal-builder__step-index {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.375rem;
+  height: 1.375rem;
+  flex-shrink: 0;
+  border-radius: 50%;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  background: var(--color-blue-light);
+  color: var(--color-blue);
+}
+
+.portal-builder__step--active .portal-builder__step-index {
+  background: var(--color-blue);
+  color: #fff;
+}
+
+.portal-builder__step-text {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.portal-builder__step-name {
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--color-text-1);
+}
+
+.portal-builder__step-note {
+  font-size: 0.6875rem;
+  color: var(--color-text-4);
+}
+
+.portal-builder__step-actions {
+  display: flex;
+  gap: 0.25rem;
+}
+
+.portal-builder__step-actions button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.5rem;
+  height: 1.5rem;
+  padding: 0;
+  border-radius: var(--radius-md);
+  border: 1px solid var(--color-border);
+  background: var(--color-surface);
+  color: var(--color-text-3);
+  cursor: pointer;
+  transition:
+    background var(--motion-fast),
+    color var(--motion-fast);
+}
+
+.portal-builder__step-actions button:hover:not(:disabled) {
+  background: var(--color-bg-hover);
+  color: var(--color-text-1);
+}
+
+.portal-builder__step-actions button:disabled {
+  opacity: 0.4;
+  cursor: default;
+}
+
+.portal-builder__add-step {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.375rem;
+  width: 100%;
+  padding: 0.625rem;
+  border: 1px dashed var(--color-border);
+  border-radius: var(--radius-lg);
+  background: none;
+  color: var(--color-text-3);
+  font-size: 0.8125rem;
+  cursor: pointer;
+  transition:
+    border-color var(--motion-fast),
+    color var(--motion-fast);
+}
+
+.portal-builder__add-step:hover {
+  border-color: var(--color-blue);
+  color: var(--color-blue);
+}
+
+/* Pipeline settings (above the operation list) */
+.portal-builder__settings {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  background: var(--color-bg-subtle);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-lg);
+  padding: 1.125rem;
+}
+
+.portal-builder__settings-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr));
+  gap: 1.25rem;
+}
+
+.portal-builder__settings-col {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+/* Inspector: heading sits outside the card so it aligns with the operations heading. */
+.portal-builder__inspector-col {
+  position: sticky;
+  top: 1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.625rem;
+}
+
+.portal-builder__inspector {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-sm);
+  padding: 1.125rem;
+}
+
+/* Tool picker */
+.portal-pipelines__picker {
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  background: var(--color-surface);
+  overflow: hidden;
+}
+
+.portal-pipelines__picker-search {
+  display: flex;
+  align-items: center;
+  padding: 0.5rem 0.75rem;
+  border-bottom: 1px solid var(--color-border-light);
+}
+
+.portal-pipelines__picker-search input {
+  flex: 1;
+  border: none;
+  background: none;
+  padding: 0;
+  font-size: 0.875rem;
+  color: var(--color-text-1);
+  outline: none;
+}
+
+.portal-pipelines__picker-list {
+  max-height: 20rem;
+  overflow-y: auto;
+  padding: 0.25rem 0;
+}
+
+.portal-pipelines__picker-group-label {
+  padding: 0.5rem 0.75rem 0.25rem;
+  font-size: 0.6875rem;
+  color: var(--color-text-5);
+}
+
+.portal-pipelines__picker-item {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  width: 100%;
+  border: none;
+  background: none;
+  padding: 0.4375rem 0.75rem;
+  text-align: left;
+  cursor: pointer;
+  color: var(--color-text-1);
+  transition: background var(--motion-fast);
+}
+
+.portal-pipelines__picker-item:hover {
+  background: var(--color-bg-hover);
+}
+
+.portal-pipelines__picker-icon {
+  display: inline-flex;
+  align-items: center;
+  color: var(--color-text-3);
+  font-size: 1.125rem;
+}
+
+.portal-pipelines__picker-name {
+  font-size: 0.8125rem;
+}
+
+.portal-pipelines__picker-empty {
+  padding: 1rem 0.75rem;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  margin: 0;
+}
+
+/* The back link, step row, add-step affordance, tool-picker item and step
+   actions are the shared Button/ActionIcon carrying bespoke styling. Re-assert
+   their original look over the design-system button base (which otherwise
+   imposes a fixed height, its own padding/border and accent text colour). */
+.portal-builder__back.sui-btn {
+  height: auto;
+  min-height: 0;
+  padding: 0;
+  font-weight: 400;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+}
+
+.portal-builder__back.sui-btn:hover {
+  color: var(--color-text-1);
+}
+
+.portal-builder__step-main.sui-btn {
+  flex: 1;
+  height: auto;
+  min-height: 0;
+  padding: 0.25rem;
+  font-weight: 400;
+  color: inherit;
+}
+
+.portal-builder__add-step.sui-btn {
+  height: auto;
+  min-height: 0;
+  padding: 0.625rem;
+  border: 1px dashed var(--color-border);
+  background: none;
+  font-weight: 400;
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+}
+
+.portal-builder__add-step.sui-btn:hover {
+  border-color: var(--color-blue);
+  color: var(--color-blue);
+}
+
+.portal-pipelines__picker-item.sui-btn {
+  height: auto;
+  min-height: 0;
+  padding: 0.4375rem 0.75rem;
+  font-weight: 400;
+  color: var(--color-text-1);
+}
+
+.portal-pipelines__picker-item.sui-btn:hover {
+  background: var(--color-bg-hover);
+}
+
+.portal-builder__step-actions .sui-ai {
+  width: 1.5rem;
+  height: 1.5rem;
+  min-width: 1.5rem;
+  min-height: 1.5rem;
+}
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
new file mode 100644
index 0000000000..97ee9362d4
--- /dev/null
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -0,0 +1,222 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { MemoryRouter, Route, Routes } from "react-router-dom";
+import type { Policy } from "@portal/api/pipelines";
+import type { ToolRegistryCatalog } from "@app/contexts/ToolRegistryContext";
+import type { ToolRegistryEntry } from "@app/data/toolsTaxonomy";
+import { PipelineBuilder } from "@portal/views/PipelineBuilder";
+
+const render = (
+  ui: Parameters<typeof baseRender>[0],
+  options?: Parameters<typeof baseRender>[1],
+) => baseRender(ui, { wrapper: MantineProvider, ...options });
+
+// Deterministic i18n: keys returned verbatim.
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchPipeline = vi.fn();
+const fetchTriggers = vi.fn();
+const savePipeline = vi.fn();
+const deletePipeline = vi.fn();
+const triggerPipeline = vi.fn();
+const fetchRun = vi.fn();
+vi.mock("@portal/api/pipelines", () => ({
+  fetchPipeline: (id: string) => fetchPipeline(id),
+  fetchTriggers: () => fetchTriggers(),
+  savePipeline: (policy: unknown) => savePipeline(policy),
+  deletePipeline: (id: string) => deletePipeline(id),
+  triggerPipeline: (id: string) => triggerPipeline(id),
+  fetchRun: (runId: string) => fetchRun(runId),
+}));
+
+const fetchSources = vi.fn();
+vi.mock("@portal/api/sources", () => ({
+  fetchSources: () => fetchSources(),
+}));
+
+// One editable tool, Compress, so the picker and step settings have something to render.
+vi.mock("@app/contexts/ToolRegistryContext", () => {
+  const compress = {
+    name: "Compress",
+    icon: null,
+    component: null,
+    description: "",
+    categoryId: "recommendedTools",
+    subcategoryId: "general",
+    automationSettings: (props: {
+      onParameterChange: (key: string, value: unknown) => void;
+    }) => (
+      <button
+        type="button"
+        onClick={() =>
+          props.onParameterChange(
+            "watermarkImage",
+            new File(["x"], "logo.png", { type: "image/png" }),
+          )
+        }
+      >
+        upload logo
+      </button>
+    ),
+    operationConfig: {
+      operationType: "compress",
+      toolType: 0,
+      endpoint: "/api/v1/misc/compress-pdf",
+      defaultParameters: {},
+      buildFormData: () => new FormData(),
+      toApiParams: (params: Record<string, unknown>) => ({ ...params }),
+      fromApiParams: (params: Record<string, unknown>) => ({ ...params }),
+    },
+  } as unknown as ToolRegistryEntry;
+  const allTools = { compress } as unknown as ToolRegistryCatalog["allTools"];
+  const catalog: ToolRegistryCatalog = {
+    regularTools: allTools,
+    superTools: allTools,
+    linkTools: allTools,
+    allTools,
+    getToolById: () => null,
+  };
+  return { useToolRegistry: () => catalog };
+});
+
+const POLICY: Policy = {
+  id: "plc-1",
+  name: "Existing pipeline",
+  enabled: true,
+  trigger: null,
+  sourceIds: [],
+  steps: [],
+  output: { type: "inline", options: {} },
+};
+
+function renderBuilder(initial: string) {
+  return render(
+    <MemoryRouter initialEntries={[initial]}>
+      <Routes>
+        <Route path="/portal/pipelines/new" element={<PipelineBuilder />} />
+        <Route path="/portal/pipelines/:id" element={<PipelineBuilder />} />
+        <Route path="/portal/pipelines" element={<div>pipelines list</div>} />
+      </Routes>
+    </MemoryRouter>,
+  );
+}
+
+describe("PipelineBuilder", () => {
+  beforeEach(() => {
+    fetchPipeline.mockReset();
+    fetchTriggers.mockReset();
+    savePipeline.mockReset();
+    deletePipeline.mockReset();
+    triggerPipeline.mockReset();
+    fetchRun.mockReset();
+    fetchSources.mockReset();
+    fetchPipeline.mockResolvedValue(POLICY);
+    fetchTriggers.mockResolvedValue([]);
+    fetchSources.mockResolvedValue({ kpis: [], sources: [] });
+    savePipeline.mockResolvedValue({});
+    deletePipeline.mockResolvedValue(undefined);
+    triggerPipeline.mockResolvedValue(["run-1"]);
+    fetchRun.mockResolvedValue({ status: "COMPLETED" });
+  });
+
+  it("builds a new pipeline: name it, add a tool, and save", async () => {
+    renderBuilder("/portal/pipelines/new");
+
+    // The name field is the only textbox before the picker opens.
+    fireEvent.change(await screen.findByRole("textbox"), {
+      target: { value: "Nightly compress" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /addTool/ }));
+    fireEvent.click(await screen.findByText("Compress"));
+
+    fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
+
+    await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
+    expect(savePipeline).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "Nightly compress",
+        trigger: null,
+        steps: [
+          expect.objectContaining({ operation: "/api/v1/misc/compress-pdf" }),
+        ],
+      }),
+    );
+    expect(await screen.findByText("pipelines list")).toBeInTheDocument();
+  });
+
+  it("runs an existing pipeline and reports success", async () => {
+    renderBuilder("/portal/pipelines/plc-1");
+
+    fireEvent.click(await screen.findByText("portal.pipelines.detail.run"));
+
+    await waitFor(() => expect(triggerPipeline).toHaveBeenCalledWith("plc-1"));
+    expect(
+      await screen.findByText("portal.pipelines.run.completed"),
+    ).toBeInTheDocument();
+  });
+
+  it("blocks saving a step that needs an uploaded file", async () => {
+    renderBuilder("/portal/pipelines/new");
+
+    fireEvent.change(await screen.findByRole("textbox"), {
+      target: { value: "Watermarked" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: /addTool/ }));
+    fireEvent.click(await screen.findByText("Compress"));
+    // The tool's settings upload a file, which a stored pipeline can't persist yet.
+    fireEvent.click(await screen.findByText("upload logo"));
+
+    expect(
+      await screen.findByText("portal.pipelines.builder.uploadUnsupported"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.pipelines.composer.create").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("deletes an existing pipeline after confirmation", async () => {
+    renderBuilder("/portal/pipelines/plc-1");
+
+    fireEvent.click(await screen.findByText("portal.pipelines.detail.delete"));
+    fireEvent.click(await screen.findByText("portal.pipelines.delete.confirm"));
+
+    await waitFor(() => expect(deletePipeline).toHaveBeenCalledWith("plc-1"));
+    expect(await screen.findByText("pipelines list")).toBeInTheDocument();
+  });
+
+  it("prompts to save or discard when leaving with unsaved edits", async () => {
+    renderBuilder("/portal/pipelines/new");
+
+    fireEvent.change(await screen.findByRole("textbox"), {
+      target: { value: "Draft" },
+    });
+    fireEvent.click(screen.getByText("portal.pipelines.composer.cancel"));
+
+    expect(
+      await screen.findByText("portal.pipelines.builder.unsavedTitle"),
+    ).toBeInTheDocument();
+    fireEvent.click(screen.getByText("portal.pipelines.builder.discard"));
+    expect(await screen.findByText("pipelines list")).toBeInTheDocument();
+  });
+
+  it("leaves immediately when there are no unsaved edits", async () => {
+    renderBuilder("/portal/pipelines/new");
+
+    await screen.findByRole("textbox");
+    fireEvent.click(screen.getByText("portal.pipelines.composer.cancel"));
+
+    expect(await screen.findByText("pipelines list")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
new file mode 100644
index 0000000000..cbd4ba4b45
--- /dev/null
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -0,0 +1,865 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { useNavigate, useParams } from "react-router-dom";
+import { useTranslation } from "react-i18next";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import KeyboardArrowUpRoundedIcon from "@mui/icons-material/KeyboardArrowUpRounded";
+import KeyboardArrowDownRoundedIcon from "@mui/icons-material/KeyboardArrowDownRounded";
+import DeleteOutlineRoundedIcon from "@mui/icons-material/DeleteOutlineRounded";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import PlayArrowRoundedIcon from "@mui/icons-material/PlayArrowRounded";
+import {
+  ActionIcon,
+  Banner,
+  Button,
+  Checkbox,
+  EmptyState,
+  FormField,
+  Input,
+  Modal,
+  RadioGroup,
+  Select,
+  Spinner,
+} from "@app/ui";
+import { useToolRegistry } from "@app/contexts/ToolRegistryContext";
+import { type ErasedToolParams } from "@app/hooks/tools/shared/toolOperationTypes";
+import {
+  deserializeToolStep,
+  getExecutableTools,
+  newWorkingToolStep,
+  serializeToolStep,
+  stepRequiresUpload,
+  type ExecutableTool,
+  type WorkingToolStep,
+} from "@app/hooks/tools/shared/toolAutomation";
+import { errorMessage } from "@portal/api/http";
+import {
+  deletePipeline,
+  fetchPipeline,
+  fetchRun,
+  fetchTriggers,
+  savePipeline,
+  triggerPipeline,
+  type OutputSpec,
+  type Policy,
+  type PolicyRunView,
+  type TriggerConfig,
+  type TriggerInfo,
+} from "@portal/api/pipelines";
+import { fetchSources, type SourceView } from "@portal/api/sources";
+import { useAsync } from "@portal/hooks/useAsync";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+import { humanizeOperation } from "@portal/components/pipelines/pipelineOperations";
+import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
+import { ToolPicker } from "@portal/components/pipelines/ToolPicker";
+import "@portal/views/PipelineBuilder.css";
+
+type OutputMode = "inline" | "folder";
+type ScheduleUnit = "MINUTES" | "HOURS" | "DAYS";
+
+const SCHEDULE_UNITS: ScheduleUnit[] = ["MINUTES", "HOURS", "DAYS"];
+/** Empty trigger type = manual-only (no automatic trigger). */
+const MANUAL = "";
+
+const TERMINAL_STATUSES = new Set(["COMPLETED", "FAILED", "CANCELLED"]);
+const POLL_INTERVAL_MS = 1500;
+const POLL_ATTEMPTS = 60;
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+type RunResult = {
+  tone: "success" | "danger" | "info" | "warning";
+  text: string;
+};
+
+function parseTrigger(trigger: TriggerConfig | null): {
+  triggerType: string;
+  count: string;
+  unit: ScheduleUnit;
+} {
+  if (!trigger) return { triggerType: MANUAL, count: "1", unit: "HOURS" };
+  if (trigger.type === "schedule") {
+    const schedule = trigger.options?.schedule as
+      | { type?: string; count?: number; unit?: ScheduleUnit }
+      | undefined;
+    if (schedule?.type === "every") {
+      return {
+        triggerType: "schedule",
+        count: String(schedule.count ?? 1),
+        unit: schedule.unit ?? "HOURS",
+      };
+    }
+    return { triggerType: "schedule", count: "1", unit: "HOURS" };
+  }
+  return { triggerType: trigger.type, count: "1", unit: "HOURS" };
+}
+
+function parseOutput(output: OutputSpec | undefined): {
+  mode: OutputMode;
+  directory: string;
+} {
+  if (output?.type === "folder") {
+    return {
+      mode: "folder",
+      directory: String(output.options?.directory ?? ""),
+    };
+  }
+  return { mode: "inline", directory: "" };
+}
+
+/**
+ * Full-page pipeline builder (route: /pipelines/new and /pipelines/:id). Pipeline-level settings
+ * (sources, trigger, output) sit above the operation list; the operation list and the selected
+ * tool's settings sit side by side below. For an existing pipeline the header also runs and
+ * deletes it. Replaces the former modal composer and the list's inline detail card.
+ */
+export function PipelineBuilder() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const { id } = useParams();
+  const isEdit = Boolean(id);
+  const { allTools } = useToolRegistry();
+  const executableTools = useMemo(
+    () => getExecutableTools(allTools),
+    [allTools],
+  );
+
+  const policyState = useAsync<Policy | null>(
+    async () => (id ? await fetchPipeline(id) : null),
+    [id],
+  );
+  const sourcesState = useAsync<SourceView[]>(
+    async () => (await fetchSources()).sources,
+    [],
+  );
+  const triggersState = useAsync<TriggerInfo[]>(
+    async () => await fetchTriggers(),
+    [],
+  );
+  const availableSources = sourcesState.data ?? [];
+  const triggers = useMemo(
+    () => triggersState.data ?? [],
+    [triggersState.data],
+  );
+
+  const [name, setName] = useState("");
+  const [enabled, setEnabled] = useState(true);
+  const [sourceIds, setSourceIds] = useState<string[]>([]);
+  const [steps, setSteps] = useState<WorkingToolStep[]>([]);
+  const [selectedIndex, setSelectedIndex] = useState<number | null>(null);
+  const [pickerOpen, setPickerOpen] = useState(false);
+  const [triggerType, setTriggerType] = useState<string>(MANUAL);
+  const [scheduleCount, setScheduleCount] = useState("1");
+  const [scheduleUnit, setScheduleUnit] = useState<ScheduleUnit>("HOURS");
+  const [outputMode, setOutputMode] = useState<OutputMode>("inline");
+  const [outputDirectory, setOutputDirectory] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [seeded, setSeeded] = useState(false);
+  const [running, setRunning] = useState(false);
+  const [runResult, setRunResult] = useState<RunResult | null>(null);
+  const [pendingDelete, setPendingDelete] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [pendingNav, setPendingNav] = useState<string | null>(null);
+
+  const mounted = useRef(true);
+  useEffect(() => {
+    mounted.current = true;
+    return () => {
+      mounted.current = false;
+    };
+  }, []);
+
+  // Seed the form once: immediately for a new pipeline, or after the policy loads for an edit.
+  useEffect(() => {
+    if (seeded) return;
+    if (isEdit && !policyState.data) return;
+    const policy = policyState.data ?? undefined;
+    const trigger = parseTrigger(policy?.trigger ?? null);
+    const output = parseOutput(policy?.output);
+    setName(policy?.name ?? "");
+    setEnabled(policy?.enabled ?? true);
+    setSourceIds(policy?.sourceIds ?? []);
+    setSteps(
+      (policy?.steps ?? []).map((step) => deserializeToolStep(step, allTools)),
+    );
+    setTriggerType(trigger.triggerType);
+    setScheduleCount(trigger.count);
+    setScheduleUnit(trigger.unit);
+    setOutputMode(output.mode);
+    setOutputDirectory(output.directory);
+    setSeeded(true);
+  }, [isEdit, policyState.data, allTools, seeded]);
+
+  // Keep one tool's settings open: auto-select the first step whenever a pipeline has steps but
+  // nothing is selected (initial load, or after the selected step is removed).
+  useEffect(() => {
+    if (seeded && selectedIndex === null && steps.length > 0) {
+      setSelectedIndex(0);
+    }
+  }, [seeded, selectedIndex, steps.length]);
+
+  const selectedSourceTypes = useMemo(
+    () =>
+      new Set(
+        availableSources
+          .filter((s) => sourceIds.includes(s.id))
+          .map((s) => s.type),
+      ),
+    [availableSources, sourceIds],
+  );
+
+  const triggerAvailable = useMemo(
+    () => (trigger: TriggerInfo) =>
+      !trigger.requiresSource ||
+      trigger.supportedSourceTypes.some((type) =>
+        selectedSourceTypes.has(type),
+      ),
+    [selectedSourceTypes],
+  );
+
+  useEffect(() => {
+    if (triggerType === MANUAL) return;
+    const selected = triggers.find((trigger) => trigger.type === triggerType);
+    if (selected && !triggerAvailable(selected)) setTriggerType(MANUAL);
+  }, [triggerType, triggers, triggerAvailable]);
+
+  function toggleSource(sourceId: string, checked: boolean) {
+    setSourceIds((ids) =>
+      checked
+        ? [...ids, sourceId]
+        : ids.filter((existing) => existing !== sourceId),
+    );
+  }
+
+  function addStep(tool: ExecutableTool) {
+    setSteps((current) => {
+      const next = [...current, newWorkingToolStep(tool, allTools)];
+      setSelectedIndex(next.length - 1);
+      return next;
+    });
+    setPickerOpen(false);
+  }
+
+  function removeStep(index: number) {
+    setSelectedIndex(null);
+    setSteps((current) => current.filter((_, i) => i !== index));
+  }
+
+  function moveStep(index: number, delta: number) {
+    setSteps((current) => {
+      const target = index + delta;
+      if (target < 0 || target >= current.length) return current;
+      const next = [...current];
+      [next[index], next[target]] = [next[target], next[index]];
+      return next;
+    });
+    setSelectedIndex((cur) => (cur === index ? index + delta : cur));
+  }
+
+  function updateStepParams(index: number, params: ErasedToolParams) {
+    setSteps((current) =>
+      current.map((step, i) =>
+        i === index && step.toolId !== null ? { ...step, params } : step,
+      ),
+    );
+  }
+
+  function stepLabel(step: WorkingToolStep): string {
+    const entry = step.toolId ? allTools[step.toolId] : undefined;
+    return entry?.name ?? humanizeOperation(step.operation);
+  }
+
+  // Steps whose params carry an uploaded file can't be saved: the bytes aren't persisted with the
+  // policy, so a later run would send null for that field (see stepRequiresUpload).
+  const uploadStepLabels = steps.filter(stepRequiresUpload).map(stepLabel);
+  const hasUploadSteps = uploadStepLabels.length > 0;
+
+  // Track unsaved edits: snapshot the form and compare against the state captured just after
+  // seeding, so leaving the builder can prompt to save or discard.
+  const snapshot = JSON.stringify({
+    name: name.trim(),
+    enabled,
+    sourceIds: [...sourceIds].sort(),
+    steps: steps.map((step) => serializeToolStep(step, allTools)),
+    uploads: steps.map(stepRequiresUpload),
+    triggerType,
+    scheduleCount,
+    scheduleUnit,
+    outputMode,
+    outputDirectory,
+  });
+  const baseline = useRef<string | null>(null);
+  useEffect(() => {
+    if (seeded && baseline.current === null) baseline.current = snapshot;
+  }, [seeded, snapshot]);
+  const dirty = baseline.current !== null && baseline.current !== snapshot;
+
+  const scheduleCountValid =
+    triggerType !== "schedule" || Number(scheduleCount) > 0;
+  const outputValid = outputMode !== "folder" || outputDirectory.trim() !== "";
+  const canSave =
+    name.trim() !== "" &&
+    scheduleCountValid &&
+    outputValid &&
+    !hasUploadSteps &&
+    !submitting;
+
+  const triggerOptions = [
+    { value: MANUAL, label: t("portal.pipelines.composer.triggerManual") },
+    ...triggers.map((trigger) => ({
+      value: trigger.type,
+      label: t(`portal.pipelines.trigger.${trigger.type}`, {
+        defaultValue: trigger.type,
+      }),
+      disabled: !triggerAvailable(trigger),
+    })),
+  ];
+
+  function buildTrigger(): TriggerConfig | null {
+    if (triggerType === MANUAL) return null;
+    if (triggerType === "schedule") {
+      return {
+        type: "schedule",
+        options: {
+          schedule: {
+            type: "every",
+            count: Number(scheduleCount),
+            unit: scheduleUnit,
+          },
+        },
+      };
+    }
+    return { type: triggerType, options: {} };
+  }
+
+  const listPath = toPortalPath(VIEW_PATHS.pipelines);
+  const sourcesPath = `${toPortalPath(VIEW_PATHS.sources)}?new=1`;
+
+  function close() {
+    navigate(listPath);
+  }
+
+  // Leave the builder, but prompt first if there are unsaved edits (see the unsaved-changes modal).
+  function attemptLeave(destination: string) {
+    if (dirty) setPendingNav(destination);
+    else navigate(destination);
+  }
+
+  // Jump to the Sources page with its create wizard open, for when the source you want to run
+  // this pipeline over doesn't exist yet.
+  function goToSources() {
+    attemptLeave(sourcesPath);
+  }
+
+  async function save(destination: string) {
+    if (!canSave) return;
+    setSubmitting(true);
+    setError(null);
+    const output: OutputSpec =
+      outputMode === "folder"
+        ? { type: "folder", options: { directory: outputDirectory.trim() } }
+        : { type: "inline", options: {} };
+    const policy: Policy = {
+      id: policyState.data?.id ?? undefined,
+      name: name.trim(),
+      enabled,
+      trigger: buildTrigger(),
+      sourceIds,
+      steps: steps.map((step) => serializeToolStep(step, allTools)),
+      output,
+    };
+    try {
+      await savePipeline(policy);
+      navigate(destination);
+    } catch (e) {
+      setError(errorMessage(e));
+      setSubmitting(false);
+    }
+  }
+
+  // Poll a run until it reaches a terminal state (or we give up), so a failure surfaces.
+  async function awaitRun(runId: string): Promise<PolicyRunView | null> {
+    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt++) {
+      if (!mounted.current) return null;
+      const view = await fetchRun(runId);
+      if (TERMINAL_STATUSES.has(view.status)) return view;
+      await sleep(POLL_INTERVAL_MS);
+    }
+    return null;
+  }
+
+  async function handleRun() {
+    if (running || !id) return;
+    setRunning(true);
+    setRunResult(null);
+    try {
+      const runIds = await triggerPipeline(id);
+      if (runIds.length === 0) {
+        if (mounted.current)
+          setRunResult({ tone: "info", text: t("portal.pipelines.run.empty") });
+        return;
+      }
+      const finals = await Promise.all(runIds.map((runId) => awaitRun(runId)));
+      if (!mounted.current) return;
+      const failed = finals.find((r) => r?.status === "FAILED");
+      if (failed) {
+        setRunResult({
+          tone: "danger",
+          text: t("portal.pipelines.run.failed", { error: failed.error ?? "" }),
+        });
+      } else if (finals.some((r) => r === null)) {
+        // Gave up polling before a terminal status; the run may still finish server-side.
+        setRunResult({
+          tone: "warning",
+          text: t("portal.pipelines.run.timeout"),
+        });
+      } else if (finals.every((r) => r?.status === "COMPLETED")) {
+        setRunResult({
+          tone: "success",
+          text: t("portal.pipelines.run.completed", { count: finals.length }),
+        });
+      } else {
+        setRunResult({ tone: "info", text: t("portal.pipelines.run.running") });
+      }
+    } catch (e) {
+      if (mounted.current)
+        setRunResult({ tone: "danger", text: errorMessage(e) });
+    } finally {
+      if (mounted.current) setRunning(false);
+    }
+  }
+
+  async function confirmDelete() {
+    if (!id || deleting) return;
+    setDeleting(true);
+    try {
+      await deletePipeline(id);
+      close();
+    } catch (e) {
+      setError(errorMessage(e));
+      setDeleting(false);
+      setPendingDelete(false);
+    }
+  }
+
+  if (isEdit && !seeded) {
+    return (
+      <div className="portal-builder__loading">
+        <Spinner />
+      </div>
+    );
+  }
+
+  const selectedStep =
+    selectedIndex !== null ? (steps[selectedIndex] ?? null) : null;
+
+  return (
+    <div className="portal-builder">
+      <header className="portal-builder__head">
+        <Button
+          variant="quiet"
+          size="sm"
+          className="portal-builder__back"
+          onClick={() => attemptLeave(listPath)}
+          aria-label={t("portal.pipelines.builder.back")}
+          leftSection={
+            <ArrowBackRoundedIcon style={{ fontSize: "1.125rem" }} />
+          }
+        >
+          {t("portal.pipelines.title")}
+        </Button>
+        <div className="portal-builder__head-main">
+          <Input
+            value={name}
+            placeholder={t("portal.pipelines.composer.namePlaceholder")}
+            aria-label={t("portal.pipelines.composer.name")}
+            onChange={(e) => setName(e.target.value)}
+          />
+        </div>
+        <div className="portal-builder__head-actions">
+          <Checkbox
+            checked={enabled}
+            onChange={(e) => setEnabled(e.target.checked)}
+            label={t("portal.pipelines.builder.enabled")}
+          />
+          {isEdit && (
+            <>
+              <Button
+                variant="secondary"
+                size="sm"
+                loading={running}
+                onClick={handleRun}
+                leftSection={
+                  <PlayArrowRoundedIcon style={{ fontSize: "1.125rem" }} />
+                }
+              >
+                {t("portal.pipelines.detail.run")}
+              </Button>
+              <Button
+                variant="secondary"
+                size="sm"
+                accent="danger"
+                onClick={() => setPendingDelete(true)}
+                leftSection={
+                  <DeleteOutlineRoundedIcon style={{ fontSize: "1.125rem" }} />
+                }
+              >
+                {t("portal.pipelines.detail.delete")}
+              </Button>
+            </>
+          )}
+          <Button
+            variant="tertiary"
+            size="sm"
+            onClick={() => attemptLeave(listPath)}
+            disabled={submitting}
+          >
+            {t("portal.pipelines.composer.cancel")}
+          </Button>
+          <Button
+            size="sm"
+            onClick={() => save(listPath)}
+            loading={submitting}
+            disabled={!canSave}
+          >
+            {isEdit
+              ? t("portal.pipelines.composer.save")
+              : t("portal.pipelines.composer.create")}
+          </Button>
+        </div>
+      </header>
+
+      {error && <Banner tone="danger" description={error} />}
+      {runResult && (
+        <Banner tone={runResult.tone} description={runResult.text} />
+      )}
+      {hasUploadSteps && (
+        <Banner
+          tone="warning"
+          description={t("portal.pipelines.builder.uploadUnsupported", {
+            tools: uploadStepLabels.join(", "),
+          })}
+        />
+      )}
+
+      {/* Pipeline-level settings, above the operation list. */}
+      <section className="portal-builder__settings">
+        <div className="portal-builder__section-label">
+          {t("portal.pipelines.builder.pipelineSettings")}
+        </div>
+        <div className="portal-builder__settings-grid">
+          <div className="portal-builder__settings-col">
+            <span className="portal-pipelines__detail-heading">
+              {t("portal.pipelines.composer.sources")}
+            </span>
+            {sourcesState.loading ? (
+              <p className="portal-pipelines__muted">
+                {t("portal.pipelines.composer.sourcesLoading")}
+              </p>
+            ) : availableSources.length === 0 ? (
+              <p className="portal-pipelines__muted">
+                {t("portal.pipelines.composer.noSources")}
+              </p>
+            ) : (
+              <div className="portal-pipelines__source-list">
+                {availableSources.map((source) => (
+                  <Checkbox
+                    key={source.id}
+                    checked={sourceIds.includes(source.id)}
+                    onChange={(e) => toggleSource(source.id, e.target.checked)}
+                    label={source.name}
+                  />
+                ))}
+              </div>
+            )}
+            <Button
+              variant="tertiary"
+              size="sm"
+              onClick={goToSources}
+              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+            >
+              {t("portal.sources.actions.connectSource")}
+            </Button>
+          </div>
+
+          <div className="portal-builder__settings-col">
+            <span className="portal-pipelines__detail-heading">
+              {t("portal.pipelines.composer.trigger")}
+            </span>
+            <RadioGroup<string>
+              name="pipeline-trigger"
+              value={triggerType}
+              onChange={setTriggerType}
+              options={triggerOptions}
+            />
+            {triggerType === "schedule" && (
+              <div className="portal-pipelines__schedule">
+                <span className="portal-pipelines__muted">
+                  {t("portal.pipelines.composer.scheduleEvery")}
+                </span>
+                <Input
+                  inputSize="sm"
+                  type="number"
+                  min={1}
+                  value={scheduleCount}
+                  invalid={!scheduleCountValid}
+                  onChange={(e) => setScheduleCount(e.target.value)}
+                  className="portal-pipelines__schedule-count"
+                />
+                <Select
+                  inputSize="sm"
+                  value={scheduleUnit}
+                  onChange={(value) =>
+                    value && setScheduleUnit(value as ScheduleUnit)
+                  }
+                  options={SCHEDULE_UNITS.map((unit) => ({
+                    value: unit,
+                    label: t(
+                      `portal.pipelines.composer.unit.${unit.toLowerCase()}`,
+                    ),
+                  }))}
+                />
+              </div>
+            )}
+          </div>
+
+          <div className="portal-builder__settings-col">
+            <span className="portal-pipelines__detail-heading">
+              {t("portal.pipelines.composer.output")}
+            </span>
+            <RadioGroup<OutputMode>
+              name="pipeline-output"
+              value={outputMode}
+              onChange={setOutputMode}
+              options={[
+                { value: "inline", label: t("portal.pipelines.output.inline") },
+                { value: "folder", label: t("portal.pipelines.output.folder") },
+              ]}
+            />
+            {outputMode === "folder" && (
+              <FormField
+                label={t("portal.pipelines.composer.directory")}
+                helperText={t("portal.pipelines.composer.directoryHelp")}
+                required
+              >
+                <Input
+                  value={outputDirectory}
+                  placeholder="/data/processed"
+                  onChange={(e) => setOutputDirectory(e.target.value)}
+                />
+              </FormField>
+            )}
+          </div>
+        </div>
+      </section>
+
+      <div className="portal-builder__grid">
+        <section className="portal-builder__flow">
+          <div className="portal-builder__section-label">
+            {t("portal.pipelines.composer.operations", { count: steps.length })}
+          </div>
+
+          {steps.length === 0 && !pickerOpen && (
+            <p className="portal-builder__empty">
+              {t("portal.pipelines.composer.chainEmpty")}
+            </p>
+          )}
+
+          <ol className="portal-builder__steps">
+            {steps.map((step, i) => (
+              <li key={`${step.operation}-${i}`}>
+                <div
+                  className={
+                    "portal-builder__step" +
+                    (selectedIndex === i ? " portal-builder__step--active" : "")
+                  }
+                >
+                  <Button
+                    variant="quiet"
+                    justify="start"
+                    className="portal-builder__step-main"
+                    onClick={() => setSelectedIndex(i)}
+                    leftSection={
+                      <span className="portal-builder__step-index">
+                        {i + 1}
+                      </span>
+                    }
+                  >
+                    <span className="portal-builder__step-text">
+                      <span className="portal-builder__step-name">
+                        {stepLabel(step)}
+                      </span>
+                      {stepRequiresUpload(step) ? (
+                        <span className="portal-builder__step-note">
+                          {t("portal.pipelines.builder.needsUpload")}
+                        </span>
+                      ) : step.support === "unsupported" ? (
+                        <span className="portal-builder__step-note">
+                          {t("portal.pipelines.builder.usesDefaults")}
+                        </span>
+                      ) : step.support === "unknown" ? (
+                        <span className="portal-builder__step-note">
+                          {t("portal.pipelines.builder.unknownStep")}
+                        </span>
+                      ) : null}
+                    </span>
+                  </Button>
+                  <div className="portal-builder__step-actions">
+                    <ActionIcon
+                      variant="tertiary"
+                      aria-label={t("portal.pipelines.composer.moveUp")}
+                      disabled={i === 0}
+                      onClick={() => moveStep(i, -1)}
+                    >
+                      <KeyboardArrowUpRoundedIcon
+                        style={{ fontSize: "1.125rem" }}
+                      />
+                    </ActionIcon>
+                    <ActionIcon
+                      variant="tertiary"
+                      aria-label={t("portal.pipelines.composer.moveDown")}
+                      disabled={i === steps.length - 1}
+                      onClick={() => moveStep(i, 1)}
+                    >
+                      <KeyboardArrowDownRoundedIcon
+                        style={{ fontSize: "1.125rem" }}
+                      />
+                    </ActionIcon>
+                    <ActionIcon
+                      variant="tertiary"
+                      aria-label={t("portal.pipelines.composer.removeStep")}
+                      onClick={() => removeStep(i)}
+                    >
+                      <DeleteOutlineRoundedIcon
+                        style={{ fontSize: "1.125rem" }}
+                      />
+                    </ActionIcon>
+                  </div>
+                </div>
+              </li>
+            ))}
+          </ol>
+
+          {pickerOpen ? (
+            <ToolPicker
+              tools={executableTools}
+              onPick={addStep}
+              onClose={() => setPickerOpen(false)}
+            />
+          ) : (
+            <Button
+              variant="quiet"
+              fullWidth
+              className="portal-builder__add-step"
+              onClick={() => setPickerOpen(true)}
+              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+            >
+              {t("portal.pipelines.composer.addTool")}
+            </Button>
+          )}
+        </section>
+
+        <aside className="portal-builder__inspector-col">
+          <div className="portal-builder__section-label">
+            {selectedStep
+              ? stepLabel(selectedStep)
+              : t("portal.pipelines.builder.toolSettings")}
+          </div>
+          <div className="portal-builder__inspector">
+            {selectedStep ? (
+              <PipelineStepSettings
+                step={selectedStep}
+                registry={allTools}
+                onChange={(params) =>
+                  selectedIndex !== null &&
+                  updateStepParams(selectedIndex, params)
+                }
+              />
+            ) : (
+              <EmptyState
+                title={t("portal.pipelines.builder.selectToolTitle")}
+                description={t("portal.pipelines.builder.selectToolBody")}
+              />
+            )}
+          </div>
+        </aside>
+      </div>
+
+      <Modal
+        open={pendingDelete}
+        onClose={() => !deleting && setPendingDelete(false)}
+        width="sm"
+        title={t("portal.pipelines.delete.title")}
+        footer={
+          <div className="portal-pipelines__composer-footer">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={deleting}
+              onClick={() => setPendingDelete(false)}
+            >
+              {t("portal.pipelines.delete.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              accent="danger"
+              loading={deleting}
+              onClick={confirmDelete}
+            >
+              {t("portal.pipelines.delete.confirm")}
+            </Button>
+          </div>
+        }
+      >
+        <p>{t("portal.pipelines.delete.body", { name: name || "" })}</p>
+      </Modal>
+
+      <Modal
+        open={pendingNav !== null}
+        onClose={() => !submitting && setPendingNav(null)}
+        width="sm"
+        title={t("portal.pipelines.builder.unsavedTitle")}
+        footer={
+          <div className="portal-pipelines__composer-footer">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={submitting}
+              onClick={() => setPendingNav(null)}
+            >
+              {t("portal.pipelines.builder.keepEditing")}
+            </Button>
+            <div style={{ display: "flex", gap: "0.5rem" }}>
+              <Button
+                variant="secondary"
+                size="sm"
+                accent="danger"
+                disabled={submitting}
+                onClick={() => {
+                  const target = pendingNav;
+                  setPendingNav(null);
+                  if (target) navigate(target);
+                }}
+              >
+                {t("portal.pipelines.builder.discard")}
+              </Button>
+              <Button
+                size="sm"
+                loading={submitting}
+                disabled={!canSave}
+                onClick={() => {
+                  const target = pendingNav;
+                  setPendingNav(null);
+                  if (target) void save(target);
+                }}
+              >
+                {t("portal.pipelines.composer.save")}
+              </Button>
+            </div>
+          </div>
+        }
+      >
+        <p>{t("portal.pipelines.builder.unsavedBody")}</p>
+      </Modal>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/views/Pipelines.css b/frontend/editor/src/portal/views/Pipelines.css
index c61f6bcafe..7cd241074d 100644
--- a/frontend/editor/src/portal/views/Pipelines.css
+++ b/frontend/editor/src/portal/views/Pipelines.css
@@ -81,104 +81,6 @@
   color: var(--color-blue);
 }
 
-/* Expanded detail panel */
-.portal-pipelines__expanded {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
-  padding: 1.25rem;
-  animation: portal-pipelines-reveal var(--motion-fast) ease-out;
-}
-
-@keyframes portal-pipelines-reveal {
-  from {
-    opacity: 0;
-    transform: translateY(-0.25rem);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.portal-pipelines__expanded-head {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding-bottom: 0.875rem;
-  margin-bottom: 1rem;
-  border-bottom: 1px solid var(--color-border-light);
-}
-
-.portal-pipelines__expanded-title {
-  margin: 0;
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-pipelines__expanded-sub {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-pipelines__expanded-close {
-  margin-left: auto;
-  width: 1.75rem;
-  height: 1.75rem;
-  border-radius: var(--radius-md);
-  border: 1px solid var(--color-border);
-  background: var(--color-surface);
-  color: var(--color-text-4);
-  font-size: 1.125rem;
-  line-height: 1;
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-
-.portal-pipelines__expanded-close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-}
-
-/* Detail body */
-.portal-pipelines__detail {
-  display: flex;
-  flex-direction: column;
-  gap: 1.125rem;
-}
-
-.portal-pipelines__detail-section {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-pipelines__detail-heading {
-  font-size: 0.6875rem;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  color: var(--color-text-5);
-  font-weight: 600;
-}
-
-.portal-pipelines__chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.375rem;
-}
-
-.portal-pipelines__detail-actions {
-  display: flex;
-  gap: 0.5rem;
-  padding-top: 0.875rem;
-  margin-top: 1rem;
-  border-top: 1px solid var(--color-border-light);
-}
-
 /* Table skeleton */
 .portal-pipelines__table-skeleton {
   display: flex;
@@ -186,20 +88,13 @@
   gap: 0.5rem;
 }
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Composer                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-pipelines__composer {
-  display: flex;
-  flex-direction: column;
-  gap: 1.25rem;
-}
-
-.portal-pipelines__composer-section {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
+/* Shared with the pipeline builder page. */
+.portal-pipelines__detail-heading {
+  font-size: 0.6875rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--color-text-5);
+  font-weight: 600;
 }
 
 .portal-pipelines__composer-footer {
@@ -221,83 +116,6 @@
   border-radius: var(--radius-md);
 }
 
-/* Operation chain */
-.portal-pipelines__chain {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.375rem;
-}
-
-.portal-pipelines__chain-row {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-  padding: 0.4375rem 0.625rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-}
-
-.portal-pipelines__chain-index {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.25rem;
-  height: 1.25rem;
-  flex-shrink: 0;
-  border-radius: 50%;
-  font-size: 0.6875rem;
-  font-weight: 600;
-  background: var(--color-blue-light);
-  color: var(--color-blue);
-}
-
-.portal-pipelines__chain-op {
-  flex: 1;
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-}
-
-.portal-pipelines__chain-actions {
-  display: flex;
-  gap: 0.25rem;
-}
-
-.portal-pipelines__chain-actions button {
-  width: 1.5rem;
-  height: 1.5rem;
-  border-radius: var(--radius-md);
-  border: 1px solid var(--color-border);
-  background: var(--color-surface);
-  color: var(--color-text-3);
-  font-size: 0.8125rem;
-  line-height: 1;
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-
-.portal-pipelines__chain-actions button:hover:not(:disabled) {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-}
-
-.portal-pipelines__chain-actions button:disabled {
-  opacity: 0.4;
-  cursor: default;
-}
-
-.portal-pipelines__op-palette {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.375rem;
-}
-
-/* Schedule row */
 .portal-pipelines__schedule {
   display: flex;
   align-items: center;
diff --git a/frontend/editor/src/portal/views/Pipelines.test.tsx b/frontend/editor/src/portal/views/Pipelines.test.tsx
index ece7a2d87e..5bc20616bb 100644
--- a/frontend/editor/src/portal/views/Pipelines.test.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.test.tsx
@@ -3,22 +3,18 @@ import {
   fireEvent,
   render as baseRender,
   screen,
-  waitFor,
 } from "@testing-library/react";
 import { MantineProvider } from "@mantine/core";
-import { MemoryRouter } from "react-router-dom";
-import { HttpError } from "@portal/api/http";
+import { MemoryRouter, Route, Routes } from "react-router-dom";
+import type { PipelinesOverviewResponse } from "@portal/api/pipelines";
+import { Pipelines } from "@portal/views/Pipelines";
 
 const render = (
   ui: Parameters<typeof baseRender>[0],
   options?: Parameters<typeof baseRender>[1],
 ) => baseRender(ui, { wrapper: MantineProvider, ...options });
-import type { PipelinesOverviewResponse, Policy } from "@portal/api/pipelines";
-import type { SourcesResponse } from "@portal/api/sources";
-import { Pipelines } from "@portal/views/Pipelines";
 
-// Deterministic i18n: keys returned verbatim, so assertions are stable without
-// the async TOML backend.
+// Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
   useTranslation: () => ({
     t: (key: string) => key,
@@ -27,25 +23,8 @@ vi.mock("react-i18next", () => ({
 }));
 
 const fetchPipelines = vi.fn();
-const fetchPipeline = vi.fn();
-const savePipeline = vi.fn();
-const deletePipeline = vi.fn();
-const fetchTriggers = vi.fn();
-const triggerPipeline = vi.fn();
-const fetchRun = vi.fn();
 vi.mock("@portal/api/pipelines", () => ({
   fetchPipelines: () => fetchPipelines(),
-  fetchPipeline: (id: string) => fetchPipeline(id),
-  savePipeline: (policy: unknown) => savePipeline(policy),
-  deletePipeline: (id: string) => deletePipeline(id),
-  fetchTriggers: () => fetchTriggers(),
-  triggerPipeline: (id: string) => triggerPipeline(id),
-  fetchRun: (runId: string) => fetchRun(runId),
-}));
-
-const fetchSources = vi.fn();
-vi.mock("@portal/api/sources", () => ({
-  fetchSources: () => fetchSources(),
 }));
 
 const RESPONSE: PipelinesOverviewResponse = {
@@ -66,55 +45,20 @@ const RESPONSE: PipelinesOverviewResponse = {
       output: "inline",
       owner: "security@acme.com",
     },
-    {
-      id: "plc-archive",
-      name: "Archive compressor",
-      enabled: true,
-      status: "active",
-      trigger: "manual",
-      sources: [],
-      steps: ["/api/v1/misc/compress-pdf"],
-      output: "folder",
-      owner: "data@acme.com",
-    },
   ],
 };
 
-const RAW_REDACTION: Policy = {
-  id: "plc-redaction",
-  name: "Redaction sweep",
-  enabled: true,
-  trigger: {
-    type: "schedule",
-    options: { schedule: { type: "every", count: 6, unit: "HOURS" } },
-  },
-  sourceIds: ["src-claims"],
-  steps: [{ operation: "/api/v1/security/auto-redact", parameters: {} }],
-  output: { type: "inline", options: {} },
-};
-
-const SOURCES: SourcesResponse = {
-  kpis: [],
-  sources: [
-    {
-      id: "src-claims",
-      name: "Claims intake",
-      type: "folder",
-      status: "active",
-      referenceCount: 1,
-      referencingPolicies: [],
-      config: [],
-      docsTotal: 0,
-      docs24h: 0,
-      docs30d: 0,
-    },
-  ],
-};
-
-function renderView() {
+function renderView(initial = "/portal/pipelines") {
   return render(
-    <MemoryRouter>
-      <Pipelines />
+    <MemoryRouter initialEntries={[initial]}>
+      <Routes>
+        <Route path="/portal/pipelines" element={<Pipelines />} />
+        <Route path="/portal/pipelines/new" element={<div>builder new</div>} />
+        <Route
+          path="/portal/pipelines/:id"
+          element={<div>pipeline page</div>}
+        />
+      </Routes>
     </MemoryRouter>,
   );
 }
@@ -122,139 +66,19 @@ function renderView() {
 describe("Pipelines view", () => {
   beforeEach(() => {
     fetchPipelines.mockReset();
-    fetchPipeline.mockReset();
-    savePipeline.mockReset();
-    deletePipeline.mockReset();
-    fetchSources.mockReset();
-    fetchTriggers.mockReset();
-    triggerPipeline.mockReset();
-    fetchRun.mockReset();
-    // The composer loads the trigger registry on open; default to none.
-    fetchTriggers.mockResolvedValue([]);
+    fetchPipelines.mockResolvedValue(RESPONSE);
   });
 
-  it("surfaces the inline error message when a delete fails", async () => {
-    fetchPipelines.mockResolvedValue(RESPONSE);
-    deletePipeline.mockRejectedValue(
-      new HttpError(500, "Server Error", {
-        detail: "Could not delete pipeline",
-      }),
-    );
-
+  it("opens the builder when creating a pipeline", async () => {
     renderView();
-
-    fireEvent.click(await screen.findByText("Redaction sweep"));
-    fireEvent.click(await screen.findByText("portal.pipelines.detail.delete"));
-    fireEvent.click(await screen.findByText("portal.pipelines.delete.confirm"));
-
-    await waitFor(() => {
-      expect(deletePipeline).toHaveBeenCalledWith("plc-redaction");
-    });
-    expect(
-      await screen.findByText("Could not delete pipeline"),
-    ).toBeInTheDocument();
-  });
-
-  it("pauses a pipeline by re-saving it with enabled flipped off", async () => {
-    fetchPipelines.mockResolvedValue(RESPONSE);
-    fetchPipeline.mockResolvedValue(RAW_REDACTION);
-    savePipeline.mockResolvedValue({});
-
-    renderView();
-
-    fireEvent.click(await screen.findByText("Redaction sweep"));
-    fireEvent.click(await screen.findByText("portal.pipelines.detail.pause"));
-
-    await waitFor(() => {
-      expect(savePipeline).toHaveBeenCalledTimes(1);
-    });
-    expect(fetchPipeline).toHaveBeenCalledWith("plc-redaction");
-    expect(savePipeline).toHaveBeenCalledWith(
-      expect.objectContaining({ id: "plc-redaction", enabled: false }),
-    );
-  });
-
-  it("runs a pipeline now and reports success inline", async () => {
-    fetchPipelines.mockResolvedValue(RESPONSE);
-    triggerPipeline.mockResolvedValue(["run-1"]);
-    fetchRun.mockResolvedValue({
-      runId: "run-1",
-      policyId: "plc-redaction",
-      status: "COMPLETED",
-      currentStep: 1,
-      stepCount: 1,
-      error: null,
-      errorCode: null,
-      createdAt: 0,
-    });
-
-    renderView();
-
-    fireEvent.click(await screen.findByText("Redaction sweep"));
-    fireEvent.click(await screen.findByText("portal.pipelines.detail.run"));
-
-    await waitFor(() => {
-      expect(triggerPipeline).toHaveBeenCalledWith("plc-redaction");
-    });
-    expect(
-      await screen.findByText("portal.pipelines.run.completed"),
-    ).toBeInTheDocument();
-  });
-
-  it("surfaces an execution failure from a manual run", async () => {
-    fetchPipelines.mockResolvedValue(RESPONSE);
-    triggerPipeline.mockResolvedValue(["run-1"]);
-    fetchRun.mockResolvedValue({
-      runId: "run-1",
-      policyId: "plc-redaction",
-      status: "FAILED",
-      currentStep: 1,
-      stepCount: 1,
-      error: "step 1 blew up",
-      errorCode: null,
-      createdAt: 0,
-    });
-
-    renderView();
-
-    fireEvent.click(await screen.findByText("Redaction sweep"));
-    fireEvent.click(await screen.findByText("portal.pipelines.detail.run"));
-
-    expect(
-      await screen.findByText("portal.pipelines.run.failed"),
-    ).toBeInTheDocument();
-  });
-
-  it("creates a pipeline with the chosen name and chained operation", async () => {
-    fetchPipelines.mockResolvedValue(RESPONSE);
-    fetchSources.mockResolvedValue(SOURCES);
-    savePipeline.mockResolvedValue({});
-
-    renderView();
-
-    // Wait for the table so the initial fetch has settled, then open the composer.
     await screen.findByText("Redaction sweep");
     fireEvent.click(screen.getByText("portal.pipelines.actions.newPipeline"));
+    expect(await screen.findByText("builder new")).toBeInTheDocument();
+  });
 
-    fireEvent.change(await screen.findByRole("textbox"), {
-      target: { value: "Nightly compress" },
-    });
-    // Operation palette chip labels are derived from the endpoint path.
-    fireEvent.click(await screen.findByText("+ Compress"));
-    fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
-
-    await waitFor(() => {
-      expect(savePipeline).toHaveBeenCalledTimes(1);
-    });
-    expect(savePipeline).toHaveBeenCalledWith(
-      expect.objectContaining({
-        name: "Nightly compress",
-        trigger: null,
-        output: expect.objectContaining({ type: "inline" }),
-        steps: [
-          expect.objectContaining({ operation: "/api/v1/misc/compress-pdf" }),
-        ],
-      }),
-    );
+  it("opens a pipeline's own page when its row is clicked", async () => {
+    renderView();
+    fireEvent.click(await screen.findByText("Redaction sweep"));
+    expect(await screen.findByText("pipeline page")).toBeInTheDocument();
   });
 });
diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index 8781778ced..0122de5bbc 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -1,107 +1,32 @@
-import { useCallback, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Banner, Button, EmptyState, Modal, Skeleton } from "@app/ui";
+import { useNavigate } from "react-router-dom";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import { Button, EmptyState, Skeleton } from "@app/ui";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import { errorMessage } from "@portal/api/http";
 import {
-  deletePipeline,
-  fetchPipeline,
   fetchPipelines,
-  savePipeline,
   type PipelinesOverviewResponse,
   type PipelineView,
-  type Policy,
 } from "@portal/api/pipelines";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { KpiStrip } from "@portal/components/pipelines/KpiStrip";
 import { PipelinesTable } from "@portal/components/pipelines/PipelinesTable";
-import { PipelineDetailCard } from "@portal/components/pipelines/PipelineDetailCard";
-import { PipelineComposer } from "@portal/components/pipelines/PipelineComposer";
 import "@portal/views/Pipelines.css";
 
 export function Pipelines() {
   const { t } = useTranslation();
-  // Refetch after every mutation by bumping this counter, so the table reflects
-  // the backend (mirrors the Sources view).
-  const [version, setVersion] = useState(0);
-  const state = useAsync<PipelinesOverviewResponse>(
-    () => fetchPipelines(),
-    [version],
-  );
+  const navigate = useNavigate();
+  const state = useAsync<PipelinesOverviewResponse>(() => fetchPipelines(), []);
   const { data, loading } = state;
   const { isLoading, isEmpty } = useSectionFlags(state);
-  const refetch = useCallback(() => setVersion((v) => v + 1), []);
-
-  const [expandedId, setExpandedId] = useState<string | null>(null);
-  const [composerOpen, setComposerOpen] = useState(false);
-  const [editing, setEditing] = useState<Policy | null>(null);
-  const [mutating, setMutating] = useState(false);
-  const [pageError, setPageError] = useState<string | null>(null);
-  const [pendingDelete, setPendingDelete] = useState<PipelineView | null>(null);
-  const [deleting, setDeleting] = useState(false);
-  const [deleteError, setDeleteError] = useState<string | null>(null);
 
   const pipelines = data?.pipelines ?? [];
-  const expanded = pipelines.find((p) => p.id === expandedId) ?? null;
 
-  function openCreate() {
-    setEditing(null);
-    setComposerOpen(true);
-  }
-
-  // Editing needs the raw policy (steps, trigger, source ids), which the overview
-  // rows don't carry, so fetch it before opening the composer prefilled.
-  async function openEdit(pipeline: PipelineView) {
-    if (mutating) return;
-    setPageError(null);
-    setMutating(true);
-    try {
-      setEditing(await fetchPipeline(pipeline.id));
-      setComposerOpen(true);
-    } catch (e) {
-      setPageError(errorMessage(e));
-    } finally {
-      setMutating(false);
-    }
-  }
-
-  // Pause/resume: re-save the policy with enabled flipped (the backend has no
-  // dedicated endpoint; every mutation routes through POST /policies). Fetch the
-  // raw record first so the full config round-trips intact.
-  async function togglePause(pipeline: PipelineView) {
-    if (mutating) return;
-    setPageError(null);
-    setMutating(true);
-    try {
-      const raw = await fetchPipeline(pipeline.id);
-      await savePipeline({ ...raw, enabled: !raw.enabled });
-      refetch();
-    } catch (e) {
-      setPageError(errorMessage(e));
-    } finally {
-      setMutating(false);
-    }
-  }
-
-  function requestDelete(pipeline: PipelineView) {
-    setDeleteError(null);
-    setPendingDelete(pipeline);
-  }
-
-  async function confirmDelete() {
-    if (!pendingDelete || deleting) return;
-    setDeleting(true);
-    setDeleteError(null);
-    try {
-      await deletePipeline(pendingDelete.id);
-      setPendingDelete(null);
-      setExpandedId(null);
-      refetch();
-    } catch (e) {
-      setDeleteError(errorMessage(e));
-    } finally {
-      setDeleting(false);
-    }
-  }
+  const openCreate = () =>
+    navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/new`);
+  // A row opens that pipeline's own page (view / edit / run / delete live there).
+  const openPipeline = (pipeline: PipelineView) =>
+    navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/${pipeline.id}`);
 
   return (
     <div className="portal-pipelines">
@@ -114,13 +39,14 @@ export function Pipelines() {
             {t("portal.pipelines.subtitle")}
           </p>
         </div>
-        <Button onClick={openCreate} leftSection={<span aria-hidden>+</span>}>
+        <Button
+          onClick={openCreate}
+          leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+        >
           {t("portal.pipelines.actions.newPipeline")}
         </Button>
       </header>
 
-      {pageError && <Banner tone="danger" description={pageError} />}
-
       <KpiStrip data={data} loading={loading} />
 
       {isLoading && (
@@ -144,66 +70,8 @@ export function Pipelines() {
       )}
 
       {!isLoading && !isEmpty && pipelines.length > 0 && (
-        <PipelinesTable
-          pipelines={pipelines}
-          expandedId={expandedId}
-          onRowClick={(p) =>
-            setExpandedId((cur) => (cur === p.id ? null : p.id))
-          }
-        />
+        <PipelinesTable pipelines={pipelines} onRowClick={openPipeline} />
       )}
-
-      {expanded && (
-        <PipelineDetailCard
-          pipeline={expanded}
-          onClose={() => setExpandedId(null)}
-          onEdit={openEdit}
-          onTogglePause={togglePause}
-          onDelete={requestDelete}
-          busy={mutating}
-        />
-      )}
-
-      <PipelineComposer
-        open={composerOpen}
-        pipeline={editing ?? undefined}
-        onClose={() => setComposerOpen(false)}
-        onSaved={refetch}
-      />
-
-      <Modal
-        open={pendingDelete !== null}
-        onClose={() => !deleting && setPendingDelete(null)}
-        width="sm"
-        title={t("portal.pipelines.delete.title")}
-        footer={
-          <div className="portal-pipelines__composer-footer">
-            <Button
-              variant="tertiary"
-              size="sm"
-              disabled={deleting}
-              onClick={() => setPendingDelete(null)}
-            >
-              {t("portal.pipelines.delete.cancel")}
-            </Button>
-            <Button
-              size="sm"
-              accent="danger"
-              loading={deleting}
-              onClick={confirmDelete}
-            >
-              {t("portal.pipelines.delete.confirm")}
-            </Button>
-          </div>
-        }
-      >
-        <p>
-          {t("portal.pipelines.delete.body", {
-            name: pendingDelete?.name ?? "",
-          })}
-        </p>
-        {deleteError && <Banner tone="danger" description={deleteError} />}
-      </Modal>
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index 91191805ab..a7dd47136a 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -1,4 +1,5 @@
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
+import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, EmptyState, Modal, Skeleton } from "@app/ui";
 import { useView } from "@portal/contexts/ViewContext";
@@ -24,6 +25,7 @@ import "@portal/views/Sources.css";
 export function Sources() {
   const { t } = useTranslation();
   const { setActiveView } = useView();
+  const [searchParams, setSearchParams] = useSearchParams();
   // Refetch after every mutation by bumping this counter, so the table reflects
   // the in-memory store the handlers maintain (mirrors the Policies view).
   const [version, setVersion] = useState(0);
@@ -64,6 +66,17 @@ export function Sources() {
     setWizardOpen(true);
   }
 
+  // Arriving with ?new (e.g. from the pipeline builder's "connect a source" link) opens the
+  // create wizard straight away, then strips the flag so a refresh doesn't reopen it.
+  useEffect(() => {
+    if (searchParams.get("new") === null) return;
+    setEditingSource(null);
+    setWizardOpen(true);
+    const next = new URLSearchParams(searchParams);
+    next.delete("new");
+    setSearchParams(next, { replace: true });
+  }, [searchParams, setSearchParams]);
+
   // Editing needs the raw source (config options), which the overview rows don't
   // carry, so fetch it before opening the wizard prefilled.
   async function openEdit(source: SourceView) {

From 9ea848570f8082934f6d3763c0efb1789d9c7a60 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 16:31:01 +0100
Subject: [PATCH 33/35] Wire portal audit tab and documents to real audit data
 (#6912)

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../DefaultPortalAuditScopeResolver.java      |  15 +
 .../audit/PortalAuditEventRow.java            |   7 +
 .../proprietary/audit/PortalAuditScope.java   |  21 +
 .../audit/PortalAuditScopeResolver.java       |  18 +
 .../api/PortalDocumentsController.java        |  46 +
 .../api/PortalInfraAuditController.java       |  47 +
 .../model/api/audit/InfraAuditEventDto.java   |  44 +
 .../api/audit/InfraAuditLogResponse.java      |  30 +
 .../model/api/audit/InfraAuditSummary.java    |  28 +
 .../api/documents/PortalDocAuditEventDto.java |  24 +
 .../documents/PortalDocumentsResponseDto.java |  18 +
 .../documents/PortalDocumentsSummaryDto.java  |  18 +
 .../api/documents/PortalExtractionDto.java    |  17 +
 .../documents/PortalReviewDocumentDto.java    |  48 ++
 .../security/configuration/CacheConfig.java   |  11 +
 .../service/PortalAuditReadService.java       |  60 ++
 .../service/PortalDocumentsService.java       | 268 ++++++
 .../service/PortalInfraAuditService.java      | 251 ++++++
 .../SaasPortalAuditScopeResolver.java         |  45 +
 .../public/locales/en-US/translation.toml     |  59 +-
 frontend/editor/src/portal/api/documents.ts   |  12 +-
 frontend/editor/src/portal/api/http.ts        |  39 +
 .../editor/src/portal/api/infrastructure.ts   |  22 +-
 .../documents/DocumentExtractions.stories.tsx |  10 +-
 .../components/documents/DocumentOverview.tsx |  29 +-
 .../DocumentsSummaryStrip.stories.tsx         |  26 -
 .../documents/DocumentsSummaryStrip.tsx       |  48 --
 .../documents/ReviewQueue.stories.tsx         |  35 +-
 .../components/documents/ReviewQueue.tsx      | 122 +--
 .../documents/ReviewQueueTable.stories.tsx    |   8 +-
 .../components/documents/ReviewQueueTable.tsx | 167 ++--
 .../src/portal/components/documents/format.ts |  17 +-
 .../AuditExportModal.stories.tsx              |  37 +
 .../infrastructure/AuditExportModal.tsx       | 139 +++
 .../infrastructure/AuditTab.stories.tsx       |  87 +-
 .../components/infrastructure/AuditTab.tsx    |  56 +-
 .../components/infrastructure/infraFormat.ts  |   8 +
 frontend/editor/src/portal/mocks/documents.ts | 802 ++++++++----------
 .../src/portal/mocks/handlers/documents.ts    |   4 +-
 .../portal/mocks/handlers/infrastructure.ts   |  63 +-
 .../editor/src/portal/mocks/infrastructure.ts | 265 +++---
 .../editor/src/portal/views/Documents.css     |  69 +-
 .../editor/src/portal/views/Documents.tsx     | 101 ++-
 .../src/portal/views/Infrastructure.css       |  45 +
 44 files changed, 2395 insertions(+), 891 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/audit/DefaultPortalAuditScopeResolver.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditEventRow.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScope.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScopeResolver.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalDocumentsController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalInfraAuditController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditEventDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditLogResponse.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditSummary.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocAuditEventDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsResponseDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsSummaryDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalExtractionDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalReviewDocumentDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/PortalAuditReadService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/PortalInfraAuditService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/security/SaasPortalAuditScopeResolver.java
 delete mode 100644 frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.tsx
 create mode 100644 frontend/editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/infrastructure/AuditExportModal.tsx

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/audit/DefaultPortalAuditScopeResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/audit/DefaultPortalAuditScopeResolver.java
new file mode 100644
index 0000000000..3eb476c4df
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/audit/DefaultPortalAuditScopeResolver.java
@@ -0,0 +1,15 @@
+package stirling.software.proprietary.audit;
+
+import org.springframework.stereotype.Component;
+
+/** Self-hosted default: admins see the whole-server audit log, everyone else is denied. */
+@Component
+public class DefaultPortalAuditScopeResolver implements PortalAuditScopeResolver {
+
+    @Override
+    public PortalAuditScope resolve() {
+        return PortalAuditScopeResolver.hasAdminAuthority()
+                ? PortalAuditScope.server()
+                : PortalAuditScope.denied();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditEventRow.java b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditEventRow.java
new file mode 100644
index 0000000000..622d17c354
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditEventRow.java
@@ -0,0 +1,7 @@
+package stirling.software.proprietary.audit;
+
+import java.time.Instant;
+
+/** Immutable, cacheable projection of an {@code audit_events} row, shared across portal views. */
+public record PortalAuditEventRow(
+        long id, String principal, String type, String data, Instant timestamp) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScope.java b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScope.java
new file mode 100644
index 0000000000..078dc2a332
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScope.java
@@ -0,0 +1,21 @@
+package stirling.software.proprietary.audit;
+
+import java.util.List;
+
+/** Resolved audit visibility: fullServer (admin), principals-scoped (team lead), or !allowed. */
+public record PortalAuditScope(
+        boolean allowed, boolean fullServer, List<String> principals, String cacheKey) {
+
+    public static PortalAuditScope denied() {
+        return new PortalAuditScope(false, false, List.of(), "denied");
+    }
+
+    // Named server()/team() to avoid colliding with the record's fullServer() accessor.
+    public static PortalAuditScope server() {
+        return new PortalAuditScope(true, true, List.of(), "server");
+    }
+
+    public static PortalAuditScope team(String cacheKey, List<String> principals) {
+        return new PortalAuditScope(true, false, List.copyOf(principals), cacheKey);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScopeResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScopeResolver.java
new file mode 100644
index 0000000000..59b68d720e
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/audit/PortalAuditScopeResolver.java
@@ -0,0 +1,18 @@
+package stirling.software.proprietary.audit;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+/** Resolves which slice of the audit log the caller may see. */
+public interface PortalAuditScopeResolver {
+
+    PortalAuditScope resolve();
+
+    /** True when the current authentication carries {@code ROLE_ADMIN}. */
+    static boolean hasAdminAuthority() {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        return auth != null
+                && auth.getAuthorities().stream()
+                        .anyMatch(a -> "ROLE_ADMIN".equals(a.getAuthority()));
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalDocumentsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalDocumentsController.java
new file mode 100644
index 0000000000..14146eacb4
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalDocumentsController.java
@@ -0,0 +1,46 @@
+package stirling.software.proprietary.controller.api;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.annotations.api.ProprietaryUiDataApi;
+import stirling.software.proprietary.audit.PortalAuditScope;
+import stirling.software.proprietary.audit.PortalAuditScopeResolver;
+import stirling.software.proprietary.model.api.documents.PortalDocumentsResponseDto;
+import stirling.software.proprietary.security.config.EnterpriseEndpoint;
+import stirling.software.proprietary.service.PortalDocumentsService;
+
+/** Serves the portal Documents review queue, derived from real audit data and scoped per caller. */
+@ProprietaryUiDataApi
+@RequiredArgsConstructor
+@EnterpriseEndpoint
+public class PortalDocumentsController {
+
+    private final PortalDocumentsService portalDocumentsService;
+    private final PortalAuditScopeResolver auditScopeResolver;
+
+    // tier accepted for mock-seam symmetry; ignored (queue isn't tier-scoped).
+    @GetMapping("/documents")
+    @Operation(
+            summary = "Documents review queue",
+            description = "Files processed through the org, derived from the audit trail.")
+    public ResponseEntity<PortalDocumentsResponseDto> getDocuments(
+            @RequestParam(value = "tier", required = false) String tier) {
+        PortalAuditScope scope = auditScopeResolver.resolve();
+        if (!scope.allowed()) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        PortalDocumentsResponseDto body =
+                scope.fullServer()
+                        ? portalDocumentsService.serverDocuments()
+                        : portalDocumentsService.scopedDocuments(
+                                scope.cacheKey(), scope.principals());
+        return ResponseEntity.ok(body);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalInfraAuditController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalInfraAuditController.java
new file mode 100644
index 0000000000..866c295b8d
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalInfraAuditController.java
@@ -0,0 +1,47 @@
+package stirling.software.proprietary.controller.api;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.annotations.api.ProprietaryUiDataApi;
+import stirling.software.proprietary.audit.PortalAuditScope;
+import stirling.software.proprietary.audit.PortalAuditScopeResolver;
+import stirling.software.proprietary.model.api.audit.InfraAuditLogResponse;
+import stirling.software.proprietary.security.config.EnterpriseEndpoint;
+import stirling.software.proprietary.service.PortalInfraAuditService;
+
+/** Serves the Infrastructure → Audit tab from real audit data, scoped and cached per caller. */
+@ProprietaryUiDataApi
+@RequiredArgsConstructor
+@EnterpriseEndpoint
+public class PortalInfraAuditController {
+
+    private final PortalInfraAuditService portalInfraAuditService;
+    private final PortalAuditScopeResolver auditScopeResolver;
+
+    // tier accepted for endpoint symmetry; ignored (audit log isn't tier-scoped).
+    @GetMapping("/infrastructure/audit-log")
+    @Operation(
+            summary = "Infrastructure audit log",
+            description = "Recent audit events shaped for the portal Infrastructure → Audit tab.")
+    public ResponseEntity<InfraAuditLogResponse> getInfrastructureAuditLog(
+            @RequestParam(value = "tier", required = false) String tier) {
+        PortalAuditScope scope = auditScopeResolver.resolve();
+        if (!scope.allowed()) {
+            // Return 403 (not throw) so the tab shows its access message, not a generic 500.
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        InfraAuditLogResponse body =
+                scope.fullServer()
+                        ? portalInfraAuditService.serverAuditLog()
+                        : portalInfraAuditService.scopedAuditLog(
+                                scope.cacheKey(), scope.principals());
+        return ResponseEntity.ok(body);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditEventDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditEventDto.java
new file mode 100644
index 0000000000..86c27e2c6e
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditEventDto.java
@@ -0,0 +1,44 @@
+package stirling.software.proprietary.model.api.audit;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * A single infrastructure audit-log row, shaped for the portal Infrastructure → Audit tab. Derived
+ * from a {@code audit_events} row: the real {@link
+ * stirling.software.proprietary.audit.AuditEventType} is mapped to a display category/action.
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class InfraAuditEventDto {
+
+    @Schema(description = "Audit event id", example = "8841")
+    private String id;
+
+    @Schema(description = "Display timestamp (UTC)", example = "2026-07-07 18:59:31")
+    private String timestamp;
+
+    @Schema(description = "Category: auth | config | elevation | processing | security")
+    private String category;
+
+    @Schema(description = "Human-readable action", example = "Compress PDF")
+    private String action;
+
+    @Schema(description = "Actor principal", example = "alice.chen@acme.com")
+    private String actor;
+
+    @Schema(description = "Affected target (file, endpoint, or session)")
+    private String target;
+
+    @Schema(description = "Status: success | warning | danger | info")
+    private String status;
+
+    @Schema(description = "Operation latency in milliseconds", example = "412")
+    private long latencyMs;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditLogResponse.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditLogResponse.java
new file mode 100644
index 0000000000..9b1b9d31c8
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditLogResponse.java
@@ -0,0 +1,30 @@
+package stirling.software.proprietary.model.api.audit;
+
+import java.util.List;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Response for the portal Infrastructure → Audit tab: summary strip + recent event rows. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class InfraAuditLogResponse {
+
+    @Schema(description = "Headline counts")
+    private InfraAuditSummary summary;
+
+    @Schema(description = "Most-recent audit events, newest first")
+    private List<InfraAuditEventDto> events;
+
+    @Schema(
+            description =
+                    "True when this is the whole-server (admin) view. Team-scoped views are false; "
+                            + "drives whether the admin-only, whole-server CSV export is offered.")
+    private boolean fullServer;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditSummary.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditSummary.java
new file mode 100644
index 0000000000..c924218e3a
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/audit/InfraAuditSummary.java
@@ -0,0 +1,28 @@
+package stirling.software.proprietary.model.api.audit;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Headline counts for the infrastructure audit-log tab, derived from the returned events. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class InfraAuditSummary {
+
+    @Schema(description = "Total events in the returned window", example = "40")
+    private int totalEvents;
+
+    @Schema(description = "Processing-category events", example = "24")
+    private int processing;
+
+    @Schema(description = "Elevation-category events", example = "0")
+    private int elevation;
+
+    @Schema(description = "Config-category events", example = "6")
+    private int config;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocAuditEventDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocAuditEventDto.java
new file mode 100644
index 0000000000..c3e4ac3d7e
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocAuditEventDto.java
@@ -0,0 +1,24 @@
+package stirling.software.proprietary.model.api.documents;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** One event in a document's lifecycle timeline. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PortalDocAuditEventDto {
+    private String id;
+
+    /** ingested | extracted | flagged | reviewed | approved | archived | elevation */
+    private String kind;
+
+    /** Relative-time string, e.g. "2m ago". */
+    private String time;
+
+    private String actor;
+    private String detail;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsResponseDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsResponseDto.java
new file mode 100644
index 0000000000..f9b1f28009
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsResponseDto.java
@@ -0,0 +1,18 @@
+package stirling.software.proprietary.model.api.documents;
+
+import java.util.List;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Response for the portal Documents review queue. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PortalDocumentsResponseDto {
+    private PortalDocumentsSummaryDto summary;
+    private List<PortalReviewDocumentDto> documents;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsSummaryDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsSummaryDto.java
new file mode 100644
index 0000000000..1222afdc03
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalDocumentsSummaryDto.java
@@ -0,0 +1,18 @@
+package stirling.software.proprietary.model.api.documents;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** KPI strip for the documents queue. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PortalDocumentsSummaryDto {
+    private int totalInQueue;
+    private int processed;
+    private int errors;
+    private int processedToday;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalExtractionDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalExtractionDto.java
new file mode 100644
index 0000000000..e332530dbc
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalExtractionDto.java
@@ -0,0 +1,17 @@
+package stirling.software.proprietary.model.api.documents;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** A single extracted field. Empty for audit-derived documents (no extraction data yet). */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PortalExtractionDto {
+    private String field;
+    private String value;
+    private double confidence;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalReviewDocumentDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalReviewDocumentDto.java
new file mode 100644
index 0000000000..658b1c991d
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/documents/PortalReviewDocumentDto.java
@@ -0,0 +1,48 @@
+package stirling.software.proprietary.model.api.documents;
+
+import java.util.List;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * A document in the review queue, derived from the audit trail of a processed file. Extraction
+ * fields ({@code confidence}, {@code extractions}) are absent/empty - that data doesn't exist yet.
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PortalReviewDocumentDto {
+    private String id;
+    private String name;
+    private String type;
+
+    /** Where it was processed: "API" or "Editor". */
+    private String product;
+
+    /** The operation / pipeline, e.g. "Compress PDF" (or "Editor"). */
+    private String action;
+
+    /** The user who ran it. */
+    private String user;
+
+    /** processed | error */
+    private String status;
+
+    private String source;
+
+    /** Overall confidence 0..1, or null when there's no extraction data. */
+    private Double confidence;
+
+    private int fieldsExtracted;
+
+    /** Relative-time string, e.g. "4m ago". */
+    private String time;
+
+    private boolean sensitive;
+    private List<PortalExtractionDto> extractions;
+    private List<PortalDocAuditEventDto> audit;
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/CacheConfig.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/CacheConfig.java
index 501826a084..eef27703f2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/CacheConfig.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/CacheConfig.java
@@ -24,6 +24,9 @@ public class CacheConfig {
         this.applicationProperties = applicationProperties;
     }
 
+    /** Short-TTL cache of recent audit rows, shared by every audit-derived portal view. */
+    private static final String PORTAL_AUDIT_EVENTS_CACHE = "portalAuditEvents";
+
     @Bean
     public CacheManager cacheManager() {
         int keyRetentionDays = applicationProperties.getSecurity().getJwt().getKeyRetentionDays();
@@ -33,6 +36,14 @@ public class CacheConfig {
                         .maximumSize(1000) // Make configurable?
                         .expireAfterWrite(Duration.ofDays(keyRetentionDays))
                         .recordStats());
+        // 30s TTL keeps audit views near-live without re-scanning the DB; one entry per scope.
+        cacheManager.registerCustomCache(
+                PORTAL_AUDIT_EVENTS_CACHE,
+                Caffeine.newBuilder()
+                        .maximumSize(256)
+                        .expireAfterWrite(Duration.ofSeconds(30))
+                        .recordStats()
+                        .build());
         return cacheManager;
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalAuditReadService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalAuditReadService.java
new file mode 100644
index 0000000000..1678cd095f
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalAuditReadService.java
@@ -0,0 +1,60 @@
+package stirling.software.proprietary.service;
+
+import java.util.List;
+
+import org.springframework.cache.annotation.Cacheable;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Sort;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.audit.PortalAuditEventRow;
+import stirling.software.proprietary.model.security.PersistentAuditEvent;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+
+/** One cached read of recent {@code audit_events} per scope, shared by all audit-derived views. */
+@Service
+@RequiredArgsConstructor
+public class PortalAuditReadService {
+
+    /** Cache name - registered with a short TTL in CacheConfig. */
+    public static final String CACHE_NAME = "portalAuditEvents";
+
+    /** Newest rows to scan; each surface filters this down to what it shows. */
+    private static final int SCAN_LIMIT = 400;
+
+    private final PersistentAuditEventRepository auditRepository;
+
+    /** Recent whole-server events (admins). */
+    @Cacheable(value = CACHE_NAME, key = "'server'")
+    public List<PortalAuditEventRow> serverEvents() {
+        return toRows(auditRepository.findAll(recentPage()).getContent());
+    }
+
+    /** Recent events by the given principals (team scope). Empty principals yield an empty list. */
+    @Cacheable(value = CACHE_NAME, key = "#cacheKey")
+    public List<PortalAuditEventRow> scopedEvents(String cacheKey, List<String> principals) {
+        if (principals.isEmpty()) {
+            return List.of();
+        }
+        return toRows(auditRepository.findByPrincipalIn(principals, recentPage()).getContent());
+    }
+
+    private static PageRequest recentPage() {
+        return PageRequest.of(0, SCAN_LIMIT, Sort.by(Sort.Direction.DESC, "timestamp"));
+    }
+
+    private static List<PortalAuditEventRow> toRows(List<PersistentAuditEvent> events) {
+        return events.stream()
+                .map(
+                        e ->
+                                new PortalAuditEventRow(
+                                        e.getId() == null ? 0L : e.getId(),
+                                        e.getPrincipal(),
+                                        e.getType(),
+                                        e.getData(),
+                                        e.getTimestamp()))
+                .toList();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
new file mode 100644
index 0000000000..8784d5c5b6
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
@@ -0,0 +1,268 @@
+package stirling.software.proprietary.service;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.audit.AuditEventType;
+import stirling.software.proprietary.audit.PortalAuditEventRow;
+import stirling.software.proprietary.model.api.documents.PortalDocAuditEventDto;
+import stirling.software.proprietary.model.api.documents.PortalDocumentsResponseDto;
+import stirling.software.proprietary.model.api.documents.PortalDocumentsSummaryDto;
+import stirling.software.proprietary.model.api.documents.PortalReviewDocumentDto;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
+
+/** Builds the Documents feed from audit_events: one row per file; extraction fields stay null. */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class PortalDocumentsService {
+
+    private static final int RETURN_LIMIT = 40;
+
+    private final PortalAuditReadService auditReadService;
+    private final ObjectMapper objectMapper;
+
+    /** Whole-server view (admins). */
+    public PortalDocumentsResponseDto serverDocuments() {
+        return build(auditReadService.serverEvents());
+    }
+
+    /** Team-scoped view: only files touched by {@code principals}. */
+    public PortalDocumentsResponseDto scopedDocuments(String cacheKey, List<String> principals) {
+        return build(auditReadService.scopedEvents(cacheKey, principals));
+    }
+
+    private PortalDocumentsResponseDto build(List<PortalAuditEventRow> events) {
+        // Events arrive newest-first; each file in a processing event is one activity row.
+        Instant dayAgo = Instant.now().minus(Duration.ofDays(1));
+        List<PortalReviewDocumentDto> documents = new ArrayList<>();
+        int processedToday = 0;
+        for (PortalAuditEventRow event : events) {
+            if (documents.size() >= RETURN_LIMIT) {
+                break;
+            }
+            if (!isFileBearing(event.type())) {
+                continue;
+            }
+            Map<String, Object> data = parseData(event);
+            Object files = data.get("files");
+            if (!(files instanceof List<?> fileList)) {
+                continue;
+            }
+            String path = asString(data.get("path"));
+            String source = sourceLabel(asString(data.get("__origin")));
+            String product = "API integration".equals(source) ? "API" : "Editor";
+            String action = prettyTool(path);
+            boolean failed = isFailure(data);
+            Instant ts = event.timestamp();
+            long eventId = event.id();
+            int idx = 0;
+            for (Object f : fileList) {
+                if (documents.size() >= RETURN_LIMIT) {
+                    break;
+                }
+                if (!(f instanceof Map<?, ?> fileMap)) {
+                    continue;
+                }
+                String name = asString(fileMap.get("name"));
+                if (name == null || name.isBlank()) {
+                    continue;
+                }
+                documents.add(
+                        toDocument(
+                                eventId + "-" + idx++,
+                                name,
+                                asString(fileMap.get("type")),
+                                product,
+                                action,
+                                event.principal(),
+                                failed,
+                                source,
+                                ts));
+                if (!failed && ts != null && ts.isAfter(dayAgo)) {
+                    processedToday++;
+                }
+            }
+        }
+
+        int processed =
+                (int) documents.stream().filter(d -> "processed".equals(d.getStatus())).count();
+        int errors = documents.size() - processed;
+
+        PortalDocumentsSummaryDto summary =
+                PortalDocumentsSummaryDto.builder()
+                        .totalInQueue(documents.size())
+                        .processed(processed)
+                        .errors(errors)
+                        .processedToday(processedToday)
+                        .build();
+
+        return PortalDocumentsResponseDto.builder().summary(summary).documents(documents).build();
+    }
+
+    /** Build one activity row from a single file inside one processing event. */
+    private PortalReviewDocumentDto toDocument(
+            String rowId,
+            String name,
+            String contentType,
+            String product,
+            String action,
+            String user,
+            boolean failed,
+            String source,
+            Instant timestamp) {
+        PortalDocAuditEventDto op =
+                PortalDocAuditEventDto.builder()
+                        .id(rowId + "-op")
+                        .kind(failed ? "flagged" : "extracted")
+                        .time(relativeTime(timestamp))
+                        .actor(user)
+                        .detail(failed ? action + " failed" : action + " via " + source)
+                        .build();
+
+        return PortalReviewDocumentDto.builder()
+                .id("doc-" + rowId)
+                .name(name)
+                .type(docType(contentType, name))
+                .product(product)
+                .action(action)
+                .user(user)
+                .status(failed ? "error" : "processed")
+                .source(source)
+                .confidence(null)
+                .fieldsExtracted(0)
+                .time(relativeTime(timestamp))
+                // Audit events don't reveal content sensitivity, so never guess it.
+                .sensitive(false)
+                .extractions(List.of())
+                .audit(List.of(op))
+                .build();
+    }
+
+    private static boolean isFileBearing(String type) {
+        return AuditEventType.PDF_PROCESS.name().equals(type)
+                || AuditEventType.FILE_OPERATION.name().equals(type);
+    }
+
+    private static boolean isFailure(Map<String, Object> data) {
+        Object status = data.get("status");
+        if (status instanceof String s && "failure".equalsIgnoreCase(s)) {
+            return true;
+        }
+        Object code = data.get("statusCode");
+        return code instanceof Number n && n.intValue() >= 400;
+    }
+
+    private static String sourceLabel(String origin) {
+        if ("API".equals(origin)) {
+            return "API integration";
+        }
+        if ("SYSTEM".equals(origin)) {
+            return "System";
+        }
+        return "Web upload";
+    }
+
+    private static String docType(String contentType, String name) {
+        String ct = contentType == null ? "" : contentType.toLowerCase(Locale.ROOT);
+        if (ct.contains("pdf") || name.toLowerCase(Locale.ROOT).endsWith(".pdf")) {
+            return "PDF";
+        }
+        if (ct.startsWith("image/") || name.matches("(?i).*\\.(png|jpe?g|gif|webp|tiff?)$")) {
+            return "Image";
+        }
+        if (ct.contains("word") || name.matches("(?i).*\\.docx?$")) {
+            return "Word";
+        }
+        return "Document";
+    }
+
+    private static String prettyTool(String path) {
+        if (path == null || path.isBlank()) {
+            return "Processed";
+        }
+        String[] parts = path.split("/");
+        // Convert endpoints are /convert/{from}/{to}; label them as a conversion.
+        for (int i = 0; i + 2 < parts.length; i++) {
+            if ("convert".equals(parts[i]) && !parts[i + 1].isEmpty() && !parts[i + 2].isEmpty()) {
+                return "Convert " + prettyWords(parts[i + 1]) + " to " + prettyWords(parts[i + 2]);
+            }
+        }
+        String last = parts.length > 0 ? parts[parts.length - 1] : path;
+        String pretty = prettyWords(last);
+        return pretty.isEmpty() ? "Processed" : pretty;
+    }
+
+    /** Title-case a hyphenated path segment, upper-casing known acronyms. */
+    private static String prettyWords(String segment) {
+        StringBuilder sb = new StringBuilder();
+        for (String word : segment.split("-")) {
+            if (word.isEmpty()) {
+                continue;
+            }
+            if (sb.length() > 0) {
+                sb.append(' ');
+            }
+            String lower = word.toLowerCase(Locale.ROOT);
+            sb.append(
+                    switch (lower) {
+                        case "pdf" -> "PDF";
+                        case "pdfs" -> "PDFs";
+                        case "ocr" -> "OCR";
+                        case "img" -> "Image";
+                        case "csv" -> "CSV";
+                        default -> Character.toUpperCase(word.charAt(0)) + word.substring(1);
+                    });
+        }
+        return sb.toString();
+    }
+
+    private static String relativeTime(Instant ts) {
+        if (ts == null) {
+            return "";
+        }
+        long seconds = Duration.between(ts, Instant.now()).getSeconds();
+        if (seconds < 60) {
+            return "just now";
+        }
+        long minutes = seconds / 60;
+        if (minutes < 60) {
+            return minutes + "m ago";
+        }
+        long hours = minutes / 60;
+        if (hours < 24) {
+            return hours + "h ago";
+        }
+        return (hours / 24) + "d ago";
+    }
+
+    private Map<String, Object> parseData(PortalAuditEventRow event) {
+        if (event.data() == null || event.data().isEmpty()) {
+            return Map.of();
+        }
+        try {
+            @SuppressWarnings("unchecked")
+            Map<String, Object> parsed = objectMapper.readValue(event.data(), Map.class);
+            // A literal "null" payload parses to null; treat it as empty, not an NPE.
+            return parsed == null ? Map.of() : parsed;
+        } catch (JacksonException e) {
+            log.warn("Failed to parse audit event {} data as JSON", event.id());
+            return Map.of();
+        }
+    }
+
+    private static String asString(Object o) {
+        return o == null ? null : String.valueOf(o);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalInfraAuditService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalInfraAuditService.java
new file mode 100644
index 0000000000..73d45800a8
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalInfraAuditService.java
@@ -0,0 +1,251 @@
+package stirling.software.proprietary.service;
+
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.audit.AuditEventType;
+import stirling.software.proprietary.audit.PortalAuditEventRow;
+import stirling.software.proprietary.model.api.audit.InfraAuditEventDto;
+import stirling.software.proprietary.model.api.audit.InfraAuditLogResponse;
+import stirling.software.proprietary.model.api.audit.InfraAuditSummary;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
+
+/** Maps cached audit_events to the Infrastructure → Audit tab, dropping read-noise types. */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class PortalInfraAuditService {
+
+    /** Rows returned to the tab after filtering. */
+    private static final int RETURN_LIMIT = 40;
+
+    private static final DateTimeFormatter TS_FORMAT =
+            DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss").withZone(ZoneOffset.UTC);
+
+    private final PortalAuditReadService auditReadService;
+    private final ObjectMapper objectMapper;
+
+    /** Whole-server view (admins). */
+    public InfraAuditLogResponse serverAuditLog() {
+        return buildFromEvents(auditReadService.serverEvents(), true);
+    }
+
+    /** Team-scoped view: only events by the given principals; empty yields an empty log. */
+    public InfraAuditLogResponse scopedAuditLog(String cacheKey, List<String> principals) {
+        return buildFromEvents(auditReadService.scopedEvents(cacheKey, principals), false);
+    }
+
+    private InfraAuditLogResponse buildFromEvents(
+            List<PortalAuditEventRow> recent, boolean fullServer) {
+        List<InfraAuditEventDto> events =
+                recent.stream()
+                        .filter(e -> isInfraRelevant(e.type()))
+                        .map(this::toDto)
+                        .limit(RETURN_LIMIT)
+                        .toList();
+
+        int processing =
+                (int) events.stream().filter(e -> "processing".equals(e.getCategory())).count();
+        int elevation =
+                (int) events.stream().filter(e -> "elevation".equals(e.getCategory())).count();
+        int config = (int) events.stream().filter(e -> "config".equals(e.getCategory())).count();
+
+        InfraAuditSummary summary =
+                InfraAuditSummary.builder()
+                        .totalEvents(events.size())
+                        .processing(processing)
+                        .elevation(elevation)
+                        .config(config)
+                        .build();
+
+        return InfraAuditLogResponse.builder()
+                .summary(summary)
+                .events(events)
+                .fullServer(fullServer)
+                .build();
+    }
+
+    /** UI_DATA and HTTP_REQUEST are read/polling noise - excluded from the infrastructure view. */
+    private static boolean isInfraRelevant(String type) {
+        return !AuditEventType.UI_DATA.name().equals(type)
+                && !AuditEventType.HTTP_REQUEST.name().equals(type);
+    }
+
+    private InfraAuditEventDto toDto(PortalAuditEventRow event) {
+        Map<String, Object> data = parseData(event);
+        String path = asString(data.get("path"));
+        String category = categoryFor(event.type(), path);
+
+        return InfraAuditEventDto.builder()
+                .id(String.valueOf(event.id()))
+                .timestamp(event.timestamp() == null ? "" : TS_FORMAT.format(event.timestamp()))
+                .category(category)
+                .action(actionFor(event.type(), path))
+                .actor(event.principal())
+                .target(targetFor(category, path, data))
+                .status(statusFor(event.type(), category, data))
+                .latencyMs(asLong(data.get("latencyMs")))
+                .build();
+    }
+
+    private Map<String, Object> parseData(PortalAuditEventRow event) {
+        if (event.data() == null || event.data().isEmpty()) {
+            return Map.of();
+        }
+        try {
+            @SuppressWarnings("unchecked")
+            Map<String, Object> parsed = objectMapper.readValue(event.data(), Map.class);
+            // A literal "null" payload parses to null; treat it as empty, not an NPE.
+            return parsed == null ? Map.of() : parsed;
+        } catch (JacksonException e) {
+            log.warn("Failed to parse audit event {} data as JSON", event.id());
+            return Map.of();
+        }
+    }
+
+    private static String categoryFor(String type, String path) {
+        AuditEventType t = AuditEventType.fromString(type);
+        if (t == null) {
+            return "processing";
+        }
+        return switch (t) {
+            case USER_LOGIN, USER_LOGOUT, USER_FAILED_LOGIN -> "auth";
+            case SETTINGS_CHANGED, USER_PROFILE_UPDATE -> "config";
+            case PDF_PROCESS, FILE_OPERATION -> isSecurityPath(path) ? "security" : "processing";
+            // UI_DATA / HTTP_REQUEST are filtered out before mapping.
+            default -> "processing";
+        };
+    }
+
+    private static boolean isSecurityPath(String path) {
+        if (path == null) {
+            return false;
+        }
+        String p = path.toLowerCase(Locale.ROOT);
+        return p.contains("/security/")
+                || p.contains("password")
+                || p.contains("watermark")
+                || p.contains("sign")
+                || p.contains("cert")
+                || p.contains("redact");
+    }
+
+    private static String actionFor(String type, String path) {
+        AuditEventType t = AuditEventType.fromString(type);
+        if (t == null) {
+            return prettyTool(path);
+        }
+        return switch (t) {
+            case USER_LOGIN -> "User signed in";
+            case USER_LOGOUT -> "User signed out";
+            case USER_FAILED_LOGIN -> "Failed sign-in attempt";
+            case USER_PROFILE_UPDATE -> "Profile settings updated";
+            case SETTINGS_CHANGED -> "Admin settings changed";
+            case PDF_PROCESS, FILE_OPERATION -> prettyTool(path);
+            default -> prettyTool(path);
+        };
+    }
+
+    /** Acronyms/tokens that get special casing when title-casing a tool path. */
+    private static final Map<String, String> WORD_FIXUPS =
+            Map.of(
+                    "pdf", "PDF",
+                    "pdfs", "PDFs",
+                    "ocr", "OCR",
+                    "img", "Image",
+                    "csv", "CSV",
+                    "html", "HTML",
+                    "url", "URL",
+                    "xml", "XML");
+
+    /** "/api/v1/misc/compress-pdf" → "Compress PDF"; "merge-pdfs" → "Merge PDFs". */
+    private static String prettyTool(String path) {
+        if (path == null || path.isBlank()) {
+            return "PDF operation";
+        }
+        String[] parts = path.split("/");
+        String last = parts.length > 0 ? parts[parts.length - 1] : path;
+        StringBuilder sb = new StringBuilder();
+        for (String word : last.split("-")) {
+            if (word.isEmpty()) {
+                continue;
+            }
+            if (sb.length() > 0) {
+                sb.append(' ');
+            }
+            String lower = word.toLowerCase(Locale.ROOT);
+            sb.append(
+                    WORD_FIXUPS.getOrDefault(
+                            lower, Character.toUpperCase(word.charAt(0)) + word.substring(1)));
+        }
+        return sb.isEmpty() ? "PDF operation" : sb.toString();
+    }
+
+    private static String targetFor(String category, String path, Map<String, Object> data) {
+        if ("auth".equals(category)) {
+            // Auth events don't act on a resource; the session is the closest thing.
+            return "Web session";
+        }
+        if ("config".equals(category)) {
+            return path != null && !path.isBlank() ? path : "System settings";
+        }
+        // processing / security: prefer the first affected file name.
+        String file = firstFileName(data);
+        if (file != null) {
+            return file;
+        }
+        return path != null && !path.isBlank() ? prettyTool(path) : "Document";
+    }
+
+    private static String statusFor(String type, String category, Map<String, Object> data) {
+        if (AuditEventType.USER_FAILED_LOGIN.name().equals(type)) {
+            return "danger";
+        }
+        String status = asString(data.get("status"));
+        Integer code = asInteger(data.get("statusCode"));
+        if ("failure".equalsIgnoreCase(status) || (code != null && code >= 500)) {
+            return "danger";
+        }
+        if (code != null && code >= 400) {
+            return "warning";
+        }
+        if ("config".equals(category)) {
+            return "info";
+        }
+        return "success";
+    }
+
+    @SuppressWarnings("unchecked")
+    private static String firstFileName(Map<String, Object> data) {
+        Object files = data.get("files");
+        if (files instanceof List<?> list
+                && !list.isEmpty()
+                && list.get(0) instanceof Map<?, ?> f) {
+            Object name = ((Map<String, Object>) f).get("name");
+            return name != null ? String.valueOf(name) : null;
+        }
+        return null;
+    }
+
+    private static String asString(Object o) {
+        return o == null ? null : String.valueOf(o);
+    }
+
+    private static long asLong(Object o) {
+        return o instanceof Number n ? n.longValue() : 0L;
+    }
+
+    private static Integer asInteger(Object o) {
+        return o instanceof Number n ? n.intValue() : null;
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SaasPortalAuditScopeResolver.java b/app/saas/src/main/java/stirling/software/saas/security/SaasPortalAuditScopeResolver.java
new file mode 100644
index 0000000000..00c7c42757
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/security/SaasPortalAuditScopeResolver.java
@@ -0,0 +1,45 @@
+package stirling.software.saas.security;
+
+import java.util.List;
+import java.util.Objects;
+
+import org.springframework.context.annotation.Primary;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.audit.PortalAuditScope;
+import stirling.software.proprietary.audit.PortalAuditScopeResolver;
+import stirling.software.saas.repository.TeamMembershipRepository;
+
+/** SaaS audit visibility: admins see the server; team LEADERs see their team (by member email). */
+@Component
+@Primary
+@Profile("saas")
+@RequiredArgsConstructor
+public class SaasPortalAuditScopeResolver implements PortalAuditScopeResolver {
+
+    private final TeamSecurityExpressions teamSecurity;
+    private final TeamMembershipRepository membershipRepository;
+
+    @Override
+    public PortalAuditScope resolve() {
+        if (PortalAuditScopeResolver.hasAdminAuthority()) {
+            return PortalAuditScope.server();
+        }
+        if (!teamSecurity.isCurrentUserTeamLeader()) {
+            return PortalAuditScope.denied();
+        }
+        Long teamId = teamSecurity.currentUserTeamId();
+        if (teamId == null) {
+            return PortalAuditScope.denied();
+        }
+        List<String> memberEmails =
+                membershipRepository.findByTeamId(teamId).stream()
+                        .map(m -> m.getUser() == null ? null : m.getUser().getEmail())
+                        .filter(Objects::nonNull)
+                        .toList();
+        return PortalAuditScope.team("team:" + teamId, memberEmails);
+    }
+}
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 5a27ded6ee..6c301dac25 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6576,7 +6576,9 @@ beforeHelper = "header against your signing secret before trusting a payload. SD
 beforeSignature = "Verify the"
 
 [portal.documents]
-subtitle = "Review and approve documents moving through your pipelines."
+exportCsv = "Export CSV"
+search = "Search by filename, ID..."
+subtitle = "Every document your org has processed, with its full processing record. Content access is request-gated."
 title = "Documents"
 
 [portal.documents.audit]
@@ -6614,42 +6616,38 @@ value = "Value"
 
 [portal.documents.filters]
 all = "All"
-archived = "Archived"
 ariaLabel = "Filter documents by status"
-needsReview = "Needs review"
+flagged = "Flagged"
+inReview = "In review"
 processed = "Processed"
 
 [portal.documents.overview]
-confidence = "Confidence"
-fieldsExtracted = "Fields extracted"
-received = "Received"
-source = "Source"
+action = "Pipeline / Action"
+product = "Product"
+received = "Time"
 status = "Status"
 type = "Type"
+user = "User"
 
 [portal.documents.queue.empty]
 description = "As sources feed documents into your pipelines they'll appear here for review."
 title = "No documents in the queue"
 
-[portal.documents.summary]
-avgConfidence = "Avg confidence"
-inQueue = "In queue"
-needsReview = "Needs review"
-processedToday = "Processed today"
-
 [portal.documents.table]
+auto = "Auto"
+editorAction = "Editor"
 empty = "No documents match this filter."
+rowActions = "Row actions"
 sensitiveLabel = "Sensitive"
 sensitiveTitle = "Sensitive — access required"
 
 [portal.documents.table.columns]
-confidence = "Confidence"
-fields = "Fields"
-name = "Name"
-source = "Source"
+action = "Pipeline / Action"
+document = "Document"
+product = "Product"
 status = "Status"
 time = "Time"
-type = "Type"
+user = "User"
 
 [portal.editorAdmin]
 subtitle = "Deploy the Stirling PDF Editor, pair self-hosted instances to your org, and operate the running fleet — targets, health, credentials, and offline activation in one place."
@@ -6894,13 +6892,32 @@ actor = "Actor"
 event = "Event"
 latency = "Latency"
 status = "Status"
-target = "Target"
+target = "Resource"
 timestamp = "Timestamp"
 
 [portal.infrastructure.audit.empty]
 description = "Workspace activity will appear here as it happens."
 title = "No audit events"
 
+[portal.infrastructure.audit.export]
+cancel = "Cancel"
+error = "Export failed. Please try again."
+exportButton = "Export"
+exporting = "Exporting…"
+fieldsLegend = "Columns"
+format = "Format"
+open = "Export"
+subtitle = "Download audit events as CSV or JSON. Choose which columns to include."
+title = "Export audit log"
+
+[portal.infrastructure.audit.export.fields]
+date = "Date"
+documentName = "Document name"
+ipAddress = "IP address"
+outcome = "Outcome"
+tool = "Tool"
+username = "Username"
+
 [portal.infrastructure.audit.filters]
 all = "All"
 auth = "Auth"
@@ -6909,6 +6926,10 @@ elevation = "Elevation"
 processing = "Processing"
 security = "Security"
 
+[portal.infrastructure.audit.forbidden]
+description = "The audit log is available to team leads and admins. Ask your team lead or an admin for access."
+title = "You don't have access"
+
 [portal.infrastructure.audit.metrics]
 config = "Config"
 elevation = "Elevation"
diff --git a/frontend/editor/src/portal/api/documents.ts b/frontend/editor/src/portal/api/documents.ts
index 3e8e4e1170..25e34f731d 100644
--- a/frontend/editor/src/portal/api/documents.ts
+++ b/frontend/editor/src/portal/api/documents.ts
@@ -9,18 +9,22 @@ export type {
   DocumentsResponse,
   DocumentsSummary,
   Extraction,
+  ProductType,
   ReviewDocument,
 } from "@portal/mocks/documents";
 export {
+  classificationTone,
   DOC_AUDIT_LABEL,
   DOC_AUDIT_TONE,
   DOCUMENT_STATUS_LABEL,
   DOCUMENT_STATUS_TONE,
+  PRODUCT_CHIP_TONE,
 } from "@portal/mocks/documents";
 
-/** GET /v1/documents?tier=… — summary strip + the review queue for the tier. */
+/** GET the audit-derived Documents feed; SaaS or local, scoped server-side. `tier` ignored. */
 export async function fetchDocuments(tier: Tier): Promise<DocumentsResponse> {
-  return apiClient.local.json<DocumentsResponse>(
-    `/v1/documents?tier=${encodeURIComponent(tier)}`,
-  );
+  const path = `/api/v1/proprietary/ui-data/documents?tier=${encodeURIComponent(tier)}`;
+  return apiClient.saas.isConfigured()
+    ? apiClient.saas.json<DocumentsResponse>(path)
+    : apiClient.local.json<DocumentsResponse>(path);
 }
diff --git a/frontend/editor/src/portal/api/http.ts b/frontend/editor/src/portal/api/http.ts
index 2dfa914890..17bc55a530 100644
--- a/frontend/editor/src/portal/api/http.ts
+++ b/frontend/editor/src/portal/api/http.ts
@@ -168,6 +168,24 @@ async function localJson<T>(
   return unwrap<T>(res);
 }
 
+/** Same-origin GET returning a binary Blob (e.g. a CSV/JSON export download). */
+async function localBlob(
+  path: string,
+  options: HttpRequestOptions = {},
+): Promise<Blob> {
+  const res = await fetch(path, {
+    method: options.method ?? "GET",
+    headers: { ...localAuthHeader(), ...options.headers },
+    signal: options.signal,
+  });
+  if (res.status === 401) {
+    clearStoredToken();
+    window.dispatchEvent(new CustomEvent("jwt-available"));
+  }
+  if (!res.ok) throw new HttpError(res.status, res.statusText, null);
+  return res.blob();
+}
+
 // ────────────────────────────────────────────────────────────────────────────
 // saas — hosted SaaS Java, admin's Supabase JWT
 // ────────────────────────────────────────────────────────────────────────────
@@ -197,6 +215,25 @@ async function saasJson<T>(
   return unwrap<T>(res);
 }
 
+/** SaaS GET returning a binary Blob, with the Supabase JWT attached. */
+async function saasBlob(
+  path: string,
+  options: HttpRequestOptions = {},
+): Promise<Blob> {
+  const base = saasBaseUrl();
+  // Same-origin SaaS resolves to "" (falsy); only null means unconfigured.
+  if (base === null) throw new SaasUnconfiguredError();
+  const token = await getPortalSaasToken();
+  if (!token) throw new SaasNotLinkedError();
+  const res = await fetch(`${base}${path}`, {
+    method: options.method ?? "GET",
+    headers: { Authorization: `Bearer ${token}`, ...options.headers },
+    signal: options.signal,
+  });
+  if (!res.ok) throw new HttpError(res.status, res.statusText, null);
+  return res.blob();
+}
+
 // ────────────────────────────────────────────────────────────────────────────
 // Exported API client
 // ────────────────────────────────────────────────────────────────────────────
@@ -205,10 +242,12 @@ export const apiClient = {
   /** Local backend (this instance). Spring admin bearer auto-attached. */
   local: {
     json: localJson,
+    blob: localBlob,
   },
   /** Hosted SaaS Java. Admin's Supabase JWT auto-attached. */
   saas: {
     json: saasJson,
+    blob: saasBlob,
     /** True when a SaaS base URL is resolvable. Doesn't check session liveness. */
     isConfigured: (): boolean => saasBaseUrl() !== null,
   },
diff --git a/frontend/editor/src/portal/api/infrastructure.ts b/frontend/editor/src/portal/api/infrastructure.ts
index 9d3023abd6..ec844330fe 100644
--- a/frontend/editor/src/portal/api/infrastructure.ts
+++ b/frontend/editor/src/portal/api/infrastructure.ts
@@ -90,9 +90,23 @@ export async function fetchStorage(tier: Tier): Promise<StorageConfig> {
   );
 }
 
-/** GET /v1/infrastructure/audit-log?tier=… */
+/** GET the audit log; SaaS or local, backend-scoped (admin → server, SaaS lead → team). */
 export async function fetchAuditLog(tier: Tier): Promise<AuditLogResponse> {
-  return apiClient.local.json<AuditLogResponse>(
-    `/v1/infrastructure/audit-log${q(tier)}`,
-  );
+  const path = `/api/v1/proprietary/ui-data/infrastructure/audit-log${q(tier)}`;
+  return apiClient.saas.isConfigured()
+    ? apiClient.saas.json<AuditLogResponse>(path)
+    : apiClient.local.json<AuditLogResponse>(path);
+}
+
+/** Download the audit log as a CSV/JSON blob (admin-only, whole-server); SaaS or local. */
+export async function exportAuditLog(
+  format: "csv" | "json",
+  fields: string,
+): Promise<Blob> {
+  const path = `/api/v1/proprietary/ui-data/audit-export?format=${format}&fields=${encodeURIComponent(
+    fields,
+  )}`;
+  return apiClient.saas.isConfigured()
+    ? apiClient.saas.blob(path)
+    : apiClient.local.blob(path);
 }
diff --git a/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx b/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
index a729289915..d96ef55a1f 100644
--- a/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
+++ b/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
@@ -6,9 +6,6 @@ import "@portal/views/Documents.css";
 const ALL = documentsFor("enterprise");
 const NON_SENSITIVE = ALL.find((d) => !d.sensitive)!;
 const SENSITIVE = ALL.find((d) => d.sensitive)!;
-const NO_AMOUNT = ALL.find((d) =>
-  d.extractions.some((e) => e.confidence === 0),
-)!;
 
 const meta: Meta<typeof DocumentExtractions> = {
   title: "Portal/Documents/DocumentExtractions",
@@ -26,14 +23,9 @@ const meta: Meta<typeof DocumentExtractions> = {
 export default meta;
 type Story = StoryObj<typeof DocumentExtractions>;
 
-/** Per-field table with mixed confidence tones. */
+/** No extraction data exists yet - the table shows its empty state. */
 export const Default: Story = {};
 
-/** A field that failed to extract sits at 0% confidence. */
-export const LowConfidence: Story = {
-  args: { doc: NO_AMOUNT },
-};
-
 /** Sensitive doc with no active grant — content stays masked. */
 export const Masked: Story = {
   args: { doc: SENSITIVE, unlocked: false },
diff --git a/frontend/editor/src/portal/components/documents/DocumentOverview.tsx b/frontend/editor/src/portal/components/documents/DocumentOverview.tsx
index 3994bd7098..91fa0ce6b8 100644
--- a/frontend/editor/src/portal/components/documents/DocumentOverview.tsx
+++ b/frontend/editor/src/portal/components/documents/DocumentOverview.tsx
@@ -4,9 +4,8 @@ import {
   DOCUMENT_STATUS_LABEL,
   type ReviewDocument,
 } from "@portal/api/documents";
-import { confidencePct } from "@portal/components/documents/format";
 
-/** Key fields for the selected document — status, source, confidence. */
+/** Key fields for the selected document - product, action, user, status. */
 export function DocumentOverview({ doc }: { doc: ReviewDocument }) {
   const { t } = useTranslation();
   return (
@@ -16,22 +15,24 @@ export function DocumentOverview({ doc }: { doc: ReviewDocument }) {
           label={t("portal.documents.overview.status")}
           value={DOCUMENT_STATUS_LABEL[doc.status]}
         />
+        <StatTile
+          label={t("portal.documents.overview.product")}
+          value={doc.product}
+        />
+        <StatTile
+          label={t("portal.documents.overview.action")}
+          value={
+            doc.product === "Editor" || !doc.action ? "Editor" : doc.action
+          }
+        />
+        <StatTile
+          label={t("portal.documents.overview.user")}
+          value={doc.user || "-"}
+        />
         <StatTile
           label={t("portal.documents.overview.type")}
           value={doc.type}
         />
-        <StatTile
-          label={t("portal.documents.overview.confidence")}
-          value={confidencePct(doc.confidence)}
-        />
-        <StatTile
-          label={t("portal.documents.overview.fieldsExtracted")}
-          value={doc.fieldsExtracted}
-        />
-        <StatTile
-          label={t("portal.documents.overview.source")}
-          value={doc.source}
-        />
         <StatTile
           label={t("portal.documents.overview.received")}
           value={doc.time}
diff --git a/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.stories.tsx b/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.stories.tsx
deleted file mode 100644
index 1bab1092be..0000000000
--- a/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.stories.tsx
+++ /dev/null
@@ -1,26 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { summaryFor } from "@portal/mocks/documents";
-import { DocumentsSummaryStrip } from "@portal/components/documents/DocumentsSummaryStrip";
-import "@portal/views/Documents.css";
-
-const meta: Meta<typeof DocumentsSummaryStrip> = {
-  title: "Portal/Documents/DocumentsSummaryStrip",
-  component: DocumentsSummaryStrip,
-  parameters: { layout: "padded" },
-  args: { summary: summaryFor("enterprise"), loading: false },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "78rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof DocumentsSummaryStrip>;
-
-export const Default: Story = {};
-
-export const Loading: Story = {
-  args: { summary: null, loading: true },
-};
diff --git a/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.tsx b/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.tsx
deleted file mode 100644
index eb116e7393..0000000000
--- a/frontend/editor/src/portal/components/documents/DocumentsSummaryStrip.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { MetricCard, MetricStrip, Skeleton } from "@app/ui";
-import type { DocumentsSummary } from "@portal/api/documents";
-import { confidencePct } from "@portal/components/documents/format";
-
-interface DocumentsSummaryStripProps {
-  summary: DocumentsSummary | null;
-  loading: boolean;
-}
-
-/** KPI strip across the top of the review queue. */
-export function DocumentsSummaryStrip({
-  summary,
-  loading,
-}: DocumentsSummaryStripProps) {
-  const { t } = useTranslation();
-  if (loading && !summary) {
-    return (
-      <MetricStrip>
-        {Array.from({ length: 4 }).map((_, i) => (
-          <Skeleton key={i} height="5.5rem" />
-        ))}
-      </MetricStrip>
-    );
-  }
-  if (!summary) return null;
-
-  return (
-    <MetricStrip>
-      <MetricCard
-        label={t("portal.documents.summary.inQueue")}
-        value={summary.totalInQueue.toLocaleString()}
-      />
-      <MetricCard
-        label={t("portal.documents.summary.needsReview")}
-        value={summary.needsReview.toLocaleString()}
-      />
-      <MetricCard
-        label={t("portal.documents.summary.avgConfidence")}
-        value={confidencePct(summary.avgConfidence)}
-      />
-      <MetricCard
-        label={t("portal.documents.summary.processedToday")}
-        value={summary.processedToday.toLocaleString()}
-      />
-    </MetricStrip>
-  );
-}
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueue.stories.tsx b/frontend/editor/src/portal/components/documents/ReviewQueue.stories.tsx
index 2d1d37d88e..ced1628253 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueue.stories.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueue.stories.tsx
@@ -1,5 +1,5 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
+import { documentsFor } from "@portal/mocks/documents";
 import { ReviewQueue } from "@portal/components/documents/ReviewQueue";
 import "@portal/views/Documents.css";
 
@@ -7,9 +7,10 @@ const meta: Meta<typeof ReviewQueue> = {
   title: "Portal/Documents/ReviewQueue",
   component: ReviewQueue,
   parameters: { layout: "padded" },
+  args: { documents: documentsFor("enterprise"), loading: false },
   decorators: [
     (S) => (
-      <div style={{ maxWidth: "78rem" }}>
+      <div style={{ maxWidth: "80rem" }}>
         <S />
       </div>
     ),
@@ -18,38 +19,12 @@ const meta: Meta<typeof ReviewQueue> = {
 export default meta;
 type Story = StoryObj<typeof ReviewQueue>;
 
-/** Live queue served by the default MSW handler (drives off the toolbar tier). */
 export const Default: Story = {};
 
 export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/documents", async () => {
-          await delay("infinite");
-          return HttpResponse.json({ summary: {}, documents: [] });
-        }),
-      ],
-    },
-  },
+  args: { documents: [], loading: true },
 };
 
 export const Empty: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/documents", () =>
-          HttpResponse.json({
-            summary: {
-              totalInQueue: 0,
-              needsReview: 0,
-              avgConfidence: 0,
-              processedToday: 0,
-            },
-            documents: [],
-          }),
-        ),
-      ],
-    },
-  },
+  args: { documents: [], loading: false },
 };
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
index 6eab89e9eb..b4423fbe5c 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
@@ -1,57 +1,68 @@
 import { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { EmptyState, Skeleton, Tabs, type TabItem } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchDocuments,
-  type DocumentStatus,
-  type DocumentsResponse,
-  type ReviewDocument,
-} from "@portal/api/documents";
-import { DocumentsSummaryStrip } from "@portal/components/documents/DocumentsSummaryStrip";
+import { EmptyState, Input, Skeleton, Tabs, type TabItem } from "@app/ui";
+import type { DocumentStatus, ReviewDocument } from "@portal/api/documents";
 import { ReviewQueueTable } from "@portal/components/documents/ReviewQueueTable";
 import { DocumentDrawer } from "@portal/components/documents/DocumentDrawer";
 
-type QueueFilter = "all" | "needs-review" | "processed" | "archived";
+type QueueFilter = "all" | "flagged" | "processed" | "in-review";
 
 /** Which document statuses each filter pill admits. */
 const FILTER_STATUSES: Record<QueueFilter, DocumentStatus[] | null> = {
   all: null,
-  // "Needs review" surfaces both routed-for-review and flagged docs — the two
-  // states that demand a human decision.
-  "needs-review": ["needs-review", "flagged"],
+  flagged: ["flagged"],
   processed: ["processed"],
-  archived: ["archived"],
+  "in-review": ["in-review"],
 };
 
-function countFor(docs: ReviewDocument[], filter: QueueFilter): number {
-  const statuses = FILTER_STATUSES[filter];
-  if (statuses === null) return docs.length;
-  return docs.filter((d) => statuses.includes(d.status)).length;
+interface ReviewQueueProps {
+  documents: ReviewDocument[];
+  loading: boolean;
+}
+
+function SearchIcon() {
+  return (
+    <svg width="15" height="15" viewBox="0 0 24 24" fill="none" aria-hidden>
+      <circle cx="11" cy="11" r="7" stroke="currentColor" strokeWidth="2" />
+      <path
+        d="m20 20-3.5-3.5"
+        stroke="currentColor"
+        strokeWidth="2"
+        strokeLinecap="round"
+      />
+    </svg>
+  );
 }
 
 /**
- * The review/approval queue: KPI strip, status filter pills, the document
- * stream table, and a detail drawer. The primary Documents surface.
+ * The processing list: status filter pills, a filename search, the document
+ * table, and a detail drawer. The primary Documents surface.
  */
-export function ReviewQueue() {
+export function ReviewQueue({ documents, loading }: ReviewQueueProps) {
   const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<DocumentsResponse>(() => fetchDocuments(tier), [tier]);
-  const { data, loading } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
   const [filter, setFilter] = useState<QueueFilter>("all");
+  const [query, setQuery] = useState("");
   const [selectedId, setSelectedId] = useState<string | null>(null);
 
-  const documents = useMemo(() => data?.documents ?? [], [data]);
+  const searched = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    if (!q) return documents;
+    return documents.filter(
+      (d) => d.name.toLowerCase().includes(q) || d.id.toLowerCase().includes(q),
+    );
+  }, [documents, query]);
 
   const rows = useMemo(() => {
     const statuses = FILTER_STATUSES[filter];
-    if (statuses === null) return documents;
-    return documents.filter((d) => statuses.includes(d.status));
-  }, [documents, filter]);
+    if (statuses === null) return searched;
+    return searched.filter((d) => statuses.includes(d.status));
+  }, [searched, filter]);
+
+  const countFor = (f: QueueFilter): number => {
+    const statuses = FILTER_STATUSES[f];
+    if (statuses === null) return documents.length;
+    return documents.filter((d) => statuses.includes(d.status)).length;
+  };
 
   const selected = documents.find((d) => d.id === selectedId) ?? null;
 
@@ -59,39 +70,48 @@ export function ReviewQueue() {
     {
       key: "all",
       label: t("portal.documents.filters.all"),
-      count: countFor(documents, "all"),
+      count: countFor("all"),
     },
     {
-      key: "needs-review",
-      label: t("portal.documents.filters.needsReview"),
-      count: countFor(documents, "needs-review"),
+      key: "flagged",
+      label: t("portal.documents.filters.flagged"),
+      count: countFor("flagged"),
     },
     {
       key: "processed",
       label: t("portal.documents.filters.processed"),
-      count: countFor(documents, "processed"),
+      count: countFor("processed"),
     },
     {
-      key: "archived",
-      label: t("portal.documents.filters.archived"),
-      count: countFor(documents, "archived"),
+      key: "in-review",
+      label: t("portal.documents.filters.inReview"),
+      count: countFor("in-review"),
     },
   ];
 
+  const isLoading = loading && documents.length === 0;
+  const isEmpty = !loading && documents.length === 0;
+
   return (
     <div className="portal-documents__queue">
-      <DocumentsSummaryStrip
-        summary={data?.summary ?? null}
-        loading={loading}
-      />
-
-      <Tabs<QueueFilter>
-        items={filterItems}
-        activeKey={filter}
-        onChange={setFilter}
-        variant="pill"
-        ariaLabel={t("portal.documents.filters.ariaLabel")}
-      />
+      <div className="portal-documents__toolbar">
+        <Tabs<QueueFilter>
+          items={filterItems}
+          activeKey={filter}
+          onChange={setFilter}
+          variant="pill"
+          ariaLabel={t("portal.documents.filters.ariaLabel")}
+        />
+        <Input
+          className="portal-documents__search"
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder={t("portal.documents.search")}
+          aria-label={t("portal.documents.search")}
+          leadingIcon={<SearchIcon />}
+          inputSize="sm"
+        />
+      </div>
 
       {isLoading && (
         <div className="portal-documents__table-skeleton" aria-hidden>
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueueTable.stories.tsx b/frontend/editor/src/portal/components/documents/ReviewQueueTable.stories.tsx
index bf0f6bb640..1ebdd430aa 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueueTable.stories.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueueTable.stories.tsx
@@ -12,7 +12,7 @@ const meta: Meta<typeof ReviewQueueTable> = {
   args: { documents: DOCS, onRowClick: () => {} },
   decorators: [
     (S) => (
-      <div style={{ maxWidth: "78rem" }}>
+      <div style={{ maxWidth: "80rem" }}>
         <S />
       </div>
     ),
@@ -23,12 +23,10 @@ type Story = StoryObj<typeof ReviewQueueTable>;
 
 export const Default: Story = {};
 
-/** Only the rows demanding a decision. */
+/** Only the rows that need a human decision. */
 export const NeedsReview: Story = {
   args: {
-    documents: DOCS.filter(
-      (d) => d.status === "needs-review" || d.status === "flagged",
-    ),
+    documents: DOCS.filter((d) => d.status === "flagged"),
   },
 };
 
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx b/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
index 88835344e8..cda3d20ca2 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
@@ -1,22 +1,50 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { ProgressBar, StatusBadge, Table, type TableColumn } from "@app/ui";
+import { Button, Chip, StatusBadge, Table, type TableColumn } from "@app/ui";
 import {
+  classificationTone,
   DOCUMENT_STATUS_LABEL,
   DOCUMENT_STATUS_TONE,
+  PRODUCT_CHIP_TONE,
   type ReviewDocument,
 } from "@portal/api/documents";
-import {
-  confidencePct,
-  confidenceTone,
-} from "@portal/components/documents/format";
 
 interface ReviewQueueTableProps {
   documents: ReviewDocument[];
   onRowClick: (doc: ReviewDocument) => void;
 }
 
-/** The document stream — one row per document awaiting a review decision. */
+function BoltIcon() {
+  return (
+    <svg
+      width="10"
+      height="10"
+      viewBox="0 0 24 24"
+      fill="currentColor"
+      aria-hidden
+    >
+      <path d="M13 2 4 14h6l-1 8 9-12h-6l1-8z" />
+    </svg>
+  );
+}
+
+function KebabIcon() {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 24 24"
+      fill="currentColor"
+      aria-hidden
+    >
+      <circle cx="12" cy="5" r="1.6" />
+      <circle cx="12" cy="12" r="1.6" />
+      <circle cx="12" cy="19" r="1.6" />
+    </svg>
+  );
+}
+
+/** The document stream - one row per document your org has processed. */
 export function ReviewQueueTable({
   documents,
   onRowClick,
@@ -25,79 +53,106 @@ export function ReviewQueueTable({
   const columns = useMemo<TableColumn<ReviewDocument>[]>(
     () => [
       {
-        key: "name",
-        header: t("portal.documents.table.columns.name"),
+        key: "document",
+        header: t("portal.documents.table.columns.document"),
         render: (d) => (
-          <div className="portal-documents__name-cell">
-            <span className="portal-documents__name">{d.name}</span>
-            {d.sensitive && (
-              <span
-                className="portal-documents__lock"
-                title={t("portal.documents.table.sensitiveTitle")}
-                aria-label={t("portal.documents.table.sensitiveLabel")}
-              >
-                🔒
-              </span>
-            )}
+          <div className="portal-documents__doc-cell">
+            <div className="portal-documents__doc-head">
+              <span className="portal-documents__name">{d.name}</span>
+              {d.classification && (
+                <Chip accent={classificationTone(d)} size="sm">
+                  {d.classification}
+                </Chip>
+              )}
+              {d.auto && (
+                <Chip accent="success" size="sm" leadingIcon={<BoltIcon />}>
+                  {t("portal.documents.table.auto")}
+                </Chip>
+              )}
+              {d.sensitive && (
+                <span
+                  className="portal-documents__lock"
+                  title={t("portal.documents.table.sensitiveTitle")}
+                  aria-label={t("portal.documents.table.sensitiveLabel")}
+                >
+                  🔒
+                </span>
+              )}
+            </div>
+            {d.note && <span className="portal-documents__note">{d.note}</span>}
           </div>
         ),
       },
       {
-        key: "type",
-        header: t("portal.documents.table.columns.type"),
-        render: (d) => d.type,
+        key: "product",
+        header: t("portal.documents.table.columns.product"),
+        width: "7rem",
+        render: (d) => (
+          <Chip accent={PRODUCT_CHIP_TONE[d.product]} size="sm" showDot={false}>
+            {d.product}
+          </Chip>
+        ),
+      },
+      {
+        key: "action",
+        header: t("portal.documents.table.columns.action"),
+        width: "12rem",
+        render: (d) =>
+          d.product === "Editor" || !d.action ? (
+            <span className="portal-documents__editor-action">
+              {t("portal.documents.table.editorAction")}
+            </span>
+          ) : (
+            <span className="portal-documents__action">{d.action}</span>
+          ),
+      },
+      {
+        key: "user",
+        header: t("portal.documents.table.columns.user"),
+        width: "8rem",
+        render: (d) => (
+          <span className="portal-documents__muted">{d.user || "-"}</span>
+        ),
       },
       {
         key: "status",
         header: t("portal.documents.table.columns.status"),
+        width: "10rem",
         render: (d) => (
           <StatusBadge tone={DOCUMENT_STATUS_TONE[d.status]} size="sm">
             {DOCUMENT_STATUS_LABEL[d.status]}
+            {d.status === "in-review" && d.reviewer ? ` · ${d.reviewer}` : ""}
           </StatusBadge>
         ),
       },
-      {
-        key: "source",
-        header: t("portal.documents.table.columns.source"),
-        render: (d) => (
-          <span className="portal-documents__muted">{d.source}</span>
-        ),
-      },
-      {
-        key: "confidence",
-        header: t("portal.documents.table.columns.confidence"),
-        width: "9rem",
-        render: (d) => (
-          <div className="portal-documents__confidence">
-            <ProgressBar value={d.confidence} height={6} />
-            <span
-              className={`portal-documents__confidence-pct portal-documents__confidence-pct--${confidenceTone(
-                d.confidence,
-              )}`}
-            >
-              {confidencePct(d.confidence)}
-            </span>
-          </div>
-        ),
-      },
-      {
-        key: "fields",
-        header: t("portal.documents.table.columns.fields"),
-        align: "right",
-        render: (d) => (
-          <span className="portal-documents__mono">{d.fieldsExtracted}</span>
-        ),
-      },
       {
         key: "time",
         header: t("portal.documents.table.columns.time"),
-        align: "right",
+        width: "7rem",
         render: (d) => (
           <span className="portal-documents__muted">{d.time}</span>
         ),
       },
+      {
+        key: "actions",
+        header: "",
+        width: "3rem",
+        render: (d) => (
+          <Button
+            variant="quiet"
+            size="sm"
+            shape="circle"
+            leftSection={<KebabIcon />}
+            aria-label={t("portal.documents.table.rowActions")}
+            onClick={(e) => {
+              e.stopPropagation();
+              onRowClick(d);
+            }}
+          />
+        ),
+      },
     ],
-    [t],
+    [t, onRowClick],
   );
 
   return (
diff --git a/frontend/editor/src/portal/components/documents/format.ts b/frontend/editor/src/portal/components/documents/format.ts
index e2d4899818..879a23ef75 100644
--- a/frontend/editor/src/portal/components/documents/format.ts
+++ b/frontend/editor/src/portal/components/documents/format.ts
@@ -1,16 +1,17 @@
 import type { StatusTone } from "@app/ui";
 
-/** Format a 0–1 confidence fraction as a whole-percent string. */
-export function confidencePct(n: number): string {
+/**
+ * Format a 0–1 confidence fraction as a whole-percent string. `null`/`undefined`
+ * (no extraction data) renders as an em-free dash.
+ */
+export function confidencePct(n: number | null | undefined): string {
+  if (n == null) return "-";
   return `${Math.round(n * 100)}%`;
 }
 
-/**
- * Tone for a confidence value. The bands match the review thresholds: below
- * 60% is unreliable (danger), 60–85% warrants a glance (warning), above is
- * trusted (success).
- */
-export function confidenceTone(n: number): StatusTone {
+/** Tone for a confidence value: <60% danger, 60-85% warning, above success, none neutral. */
+export function confidenceTone(n: number | null | undefined): StatusTone {
+  if (n == null) return "neutral";
   if (n < 0.6) return "danger";
   if (n < 0.85) return "warning";
   return "success";
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx b/frontend/editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx
new file mode 100644
index 0000000000..dc12295a32
--- /dev/null
+++ b/frontend/editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx
@@ -0,0 +1,37 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { AuditExportModal } from "@portal/components/infrastructure/AuditExportModal";
+import "@portal/views/Infrastructure.css";
+
+/**
+ * Export modal for the Infrastructure → Audit tab. Rendered always-open here.
+ * Downloads via the editor's real `/audit-export` endpoint (mocked by MSW), so
+ * clicking "Export" pulls a sample CSV/JSON.
+ */
+const meta: Meta<typeof AuditExportModal> = {
+  title: "Portal/Infrastructure/AuditExportModal",
+  component: AuditExportModal,
+  parameters: { layout: "fullscreen" },
+  args: { open: true, onClose: () => {} },
+};
+export default meta;
+type Story = StoryObj<typeof AuditExportModal>;
+
+export const Open: Story = {};
+
+/**
+ * The export request fails - click "Export" to see the inline error message.
+ * (Overrides the sample-export handler with a 500.)
+ */
+export const ExportFails: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get(
+          "*/api/v1/proprietary/ui-data/audit-export",
+          () => new HttpResponse(null, { status: 500 }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditExportModal.tsx b/frontend/editor/src/portal/components/infrastructure/AuditExportModal.tsx
new file mode 100644
index 0000000000..5b147ed90f
--- /dev/null
+++ b/frontend/editor/src/portal/components/infrastructure/AuditExportModal.tsx
@@ -0,0 +1,139 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button, Checkbox, Modal, RadioGroup } from "@app/ui";
+import { exportAuditLog } from "@portal/api/infrastructure";
+
+interface AuditExportModalProps {
+  open: boolean;
+  onClose: () => void;
+}
+
+type ExportFormat = "csv" | "json";
+
+/** Columns offered for export - mirrors the editor's audit export section. */
+const FIELD_KEYS = [
+  "date",
+  "username",
+  "ipaddress",
+  "tool",
+  "documentName",
+  "outcome",
+] as const;
+type FieldKey = (typeof FIELD_KEYS)[number];
+
+const DEFAULT_FIELDS: Record<FieldKey, boolean> = {
+  date: true,
+  username: true,
+  ipaddress: false,
+  tool: true,
+  documentName: true,
+  outcome: true,
+};
+
+/** Export the audit log to CSV/JSON via the admin-only, whole-server endpoint. */
+export function AuditExportModal({ open, onClose }: AuditExportModalProps) {
+  const { t } = useTranslation();
+  const [format, setFormat] = useState<ExportFormat>("csv");
+  const [fields, setFields] =
+    useState<Record<FieldKey, boolean>>(DEFAULT_FIELDS);
+  const [exporting, setExporting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const anyField = FIELD_KEYS.some((k) => fields[k]);
+
+  async function handleExport() {
+    setError(null);
+    setExporting(true);
+    try {
+      const fieldsParam = FIELD_KEYS.filter((k) => fields[k]).join(",");
+      const blob = await exportAuditLog(format, fieldsParam);
+      const url = window.URL.createObjectURL(blob);
+      const link = document.createElement("a");
+      link.href = url;
+      link.download = `audit-export-${new Date().toISOString()}.${format}`;
+      document.body.appendChild(link);
+      link.click();
+      document.body.removeChild(link);
+      window.URL.revokeObjectURL(url);
+      onClose();
+    } catch {
+      setError(t("portal.infrastructure.audit.export.error"));
+    } finally {
+      setExporting(false);
+    }
+  }
+
+  const fieldLabel: Record<FieldKey, string> = {
+    date: t("portal.infrastructure.audit.export.fields.date"),
+    username: t("portal.infrastructure.audit.export.fields.username"),
+    ipaddress: t("portal.infrastructure.audit.export.fields.ipAddress"),
+    tool: t("portal.infrastructure.audit.export.fields.tool"),
+    documentName: t("portal.infrastructure.audit.export.fields.documentName"),
+    outcome: t("portal.infrastructure.audit.export.fields.outcome"),
+  };
+
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      title={t("portal.infrastructure.audit.export.title")}
+      subtitle={t("portal.infrastructure.audit.export.subtitle")}
+      footer={
+        <div className="portal-infra__export-actions">
+          <Button variant="tertiary" onClick={onClose} disabled={exporting}>
+            {t("portal.infrastructure.audit.export.cancel")}
+          </Button>
+          <Button
+            variant="primary"
+            onClick={handleExport}
+            disabled={exporting || !anyField}
+          >
+            {exporting
+              ? t("portal.infrastructure.audit.export.exporting")
+              : t("portal.infrastructure.audit.export.exportButton")}
+          </Button>
+        </div>
+      }
+    >
+      <div className="portal-infra__export">
+        <div className="portal-infra__export-group">
+          <span className="portal-infra__export-label">
+            {t("portal.infrastructure.audit.export.format")}
+          </span>
+          <RadioGroup<ExportFormat>
+            name="audit-export-format"
+            value={format}
+            onChange={setFormat}
+            direction="horizontal"
+            options={[
+              { value: "csv", label: "CSV" },
+              { value: "json", label: "JSON" },
+            ]}
+          />
+        </div>
+
+        <div className="portal-infra__export-group">
+          <span className="portal-infra__export-label">
+            {t("portal.infrastructure.audit.export.fieldsLegend")}
+          </span>
+          <div className="portal-infra__export-fields">
+            {FIELD_KEYS.map((k) => (
+              <Checkbox
+                key={k}
+                label={fieldLabel[k]}
+                checked={fields[k]}
+                onChange={(e) => {
+                  // Capture synchronously; React nulls currentTarget before the state update.
+                  const checked = e.target.checked;
+                  setFields((prev) => ({ ...prev, [k]: checked }));
+                }}
+              />
+            ))}
+          </div>
+        </div>
+
+        {error && <p className="portal-infra__export-error">{error}</p>}
+      </div>
+    </Modal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
index d4aefcd197..3bb2d6dc3c 100644
--- a/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
@@ -24,10 +24,13 @@ export const Loading: Story = {
   parameters: {
     msw: {
       handlers: [
-        http.get("/v1/infrastructure/audit-log", async () => {
-          await delay("infinite");
-          return HttpResponse.json({ summary: {}, events: [] });
-        }),
+        http.get(
+          "*/api/v1/proprietary/ui-data/infrastructure/audit-log",
+          async () => {
+            await delay("infinite");
+            return HttpResponse.json({ summary: {}, events: [] });
+          },
+        ),
       ],
     },
   },
@@ -37,10 +40,84 @@ export const Empty: Story = {
   parameters: {
     msw: {
       handlers: [
-        http.get("/v1/infrastructure/audit-log", () =>
+        http.get("*/api/v1/proprietary/ui-data/infrastructure/audit-log", () =>
           HttpResponse.json({
             summary: { totalEvents: 0, processing: 0, elevation: 0, config: 0 },
             events: [],
+            fullServer: true,
+          }),
+        ),
+      ],
+    },
+  },
+};
+
+// A team member who isn't a lead (or any caller the backend scopes out) gets a
+// 403 - the tab shows the access message, not the "no events" empty state.
+export const NonLeadForbidden: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/proprietary/ui-data/infrastructure/audit-log", () =>
+          HttpResponse.json({ detail: "Not permitted" }, { status: 403 }),
+        ),
+      ],
+    },
+  },
+};
+
+// A team leader sees only their own team's events - a narrower slice than the
+// admin whole-server view (the Default story). fullServer:false, so no Export.
+export const TeamLeadScoped: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/proprietary/ui-data/infrastructure/audit-log", () =>
+          HttpResponse.json({
+            summary: { totalEvents: 4, processing: 2, elevation: 0, config: 1 },
+            events: [
+              {
+                id: "9102",
+                timestamp: "2026-07-07 18:12:03",
+                category: "processing",
+                action: "Compress PDF",
+                actor: "alice.chen@acme.com",
+                target: "acme-invoice-8841.pdf",
+                status: "success",
+                latencyMs: 842,
+              },
+              {
+                id: "9101",
+                timestamp: "2026-07-07 17:44:20",
+                category: "auth",
+                action: "User signed in",
+                actor: "bob.martin@acme.com",
+                target: "Web session",
+                status: "success",
+                latencyMs: 128,
+              },
+              {
+                id: "9100",
+                timestamp: "2026-07-07 17:05:58",
+                category: "config",
+                action: "Profile settings updated",
+                actor: "alice.chen@acme.com",
+                target: "/api/v1/user/change-settings",
+                status: "info",
+                latencyMs: 175,
+              },
+              {
+                id: "9099",
+                timestamp: "2026-07-07 16:31:11",
+                category: "processing",
+                action: "Merge PDFs",
+                actor: "bob.martin@acme.com",
+                target: "onboarding-packet.pdf",
+                status: "success",
+                latencyMs: 2199,
+              },
+            ],
+            fullServer: false,
           }),
         ),
       ],
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
index 6420950458..0b0d806c59 100644
--- a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
@@ -1,6 +1,7 @@
 import { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
+  Button,
   Card,
   EmptyState,
   MetricCard,
@@ -12,19 +13,21 @@ import {
 } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
+import { HttpError } from "@portal/api/http";
 import {
   fetchAuditLog,
   type AuditCategory,
   type AuditEvent,
   type AuditLogResponse,
 } from "@portal/api/infrastructure";
+import { AuditExportModal } from "@portal/components/infrastructure/AuditExportModal";
 import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
 import { TableSkeleton } from "@portal/components/infrastructure/TableSkeleton";
 import {
   AUDIT_CAT_LABEL,
   AUDIT_CAT_TONE,
+  AUDIT_STATUS_LABEL,
   AUDIT_TONE,
-  titleCase,
 } from "@portal/components/infrastructure/infraFormat";
 
 type AuditFilter = "all" | AuditCategory;
@@ -33,6 +36,7 @@ export function AuditTab() {
   const { t } = useTranslation();
   const { tier } = useTier();
   const [filter, setFilter] = useState<AuditFilter>("all");
+  const [exportOpen, setExportOpen] = useState(false);
 
   const auditFilters: TabItem<AuditFilter>[] = [
     { key: "all", label: t("portal.infrastructure.audit.filters.all") },
@@ -85,7 +89,7 @@ export function AuditTab() {
       header: t("portal.infrastructure.audit.columns.status"),
       render: (e) => (
         <StatusBadge tone={AUDIT_TONE[e.status]} size="sm">
-          {titleCase(e.status)}
+          {AUDIT_STATUS_LABEL[e.status]}
         </StatusBadge>
       ),
     },
@@ -104,8 +108,10 @@ export function AuditTab() {
   ];
 
   const state = useAsync<AuditLogResponse>(() => fetchAuditLog(tier), [tier]);
-  const { data } = state;
+  const { data, error } = state;
   const { isLoading, isEmpty } = useSectionFlags(state);
+  // Backend returns 403 for scoped-out callers; show an access message, not an empty state.
+  const forbidden = error instanceof HttpError && error.status === 403;
 
   const rows = useMemo(() => {
     if (!data) return [];
@@ -115,9 +121,22 @@ export function AuditTab() {
 
   return (
     <div className="portal-infra__stack">
-      <SectionHeader
-        title={t("portal.infrastructure.audit.heading")}
-        sub={t("portal.infrastructure.audit.subheading")}
+      <div className="portal-infra__audit-head">
+        <SectionHeader
+          title={t("portal.infrastructure.audit.heading")}
+          sub={t("portal.infrastructure.audit.subheading")}
+        />
+        {/* Export is admin-only + whole-server, so only shown in the full-server view. */}
+        {data?.fullServer && (
+          <Button variant="secondary" onClick={() => setExportOpen(true)}>
+            {t("portal.infrastructure.audit.export.open")}
+          </Button>
+        )}
+      </div>
+
+      <AuditExportModal
+        open={exportOpen}
+        onClose={() => setExportOpen(false)}
       />
 
       {data && (
@@ -141,17 +160,26 @@ export function AuditTab() {
         </section>
       )}
 
-      <Tabs<AuditFilter>
-        items={auditFilters}
-        activeKey={filter}
-        onChange={setFilter}
-        variant="pill"
-        ariaLabel={t("portal.infrastructure.audit.filterAriaLabel")}
-      />
+      {!forbidden && (
+        <Tabs<AuditFilter>
+          items={auditFilters}
+          activeKey={filter}
+          onChange={setFilter}
+          variant="pill"
+          ariaLabel={t("portal.infrastructure.audit.filterAriaLabel")}
+        />
+      )}
 
       <Card padding="none">
         {isLoading && <TableSkeleton rows={6} cols={6} />}
-        {isEmpty && (
+        {!isLoading && forbidden && (
+          <EmptyState
+            size="compact"
+            title={t("portal.infrastructure.audit.forbidden.title")}
+            description={t("portal.infrastructure.audit.forbidden.description")}
+          />
+        )}
+        {!isLoading && !forbidden && isEmpty && (
           <EmptyState
             size="compact"
             title={t("portal.infrastructure.audit.empty.title")}
diff --git a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
index 2cf7c2e028..df3f993360 100644
--- a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
+++ b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
@@ -100,6 +100,14 @@ export const AUDIT_TONE: Record<AuditStatus, StatusTone> = {
   info: "info",
 };
 
+// Human labels for the status badge: danger/warning are tones, not outcomes (read "Error").
+export const AUDIT_STATUS_LABEL: Record<AuditStatus, string> = {
+  success: "Success",
+  warning: "Warning",
+  danger: "Error",
+  info: "Info",
+};
+
 export const AUDIT_CAT_LABEL: Record<AuditCategory, string> = {
   auth: "Auth",
   config: "Config",
diff --git a/frontend/editor/src/portal/mocks/documents.ts b/frontend/editor/src/portal/mocks/documents.ts
index 218c812527..b4b7fe2325 100644
--- a/frontend/editor/src/portal/mocks/documents.ts
+++ b/frontend/editor/src/portal/mocks/documents.ts
@@ -1,35 +1,31 @@
 /**
- * Document review-queue fixtures and the types api/documents.ts shares with them.
+ * Documents fixtures and the types api/documents.ts shares with them.
  *
- * A "document" here is a single item flowing through the org's pipelines and
- * waiting on a review/approval decision. Each carries its extracted fields, an
- * audit timeline, and a `sensitive` flag that gates whether its content is
- * shown directly or behind a zero-standing-access elevation request.
- *
- * api/documents.ts imports the types; the MSW handlers serve the fixture data
- * over the intercepted apiClient.local.json() calls. Components never reach into this
- * module directly. Once a real backend exists the handlers stop being
- * registered and these fixtures can be deleted (or kept as test seeds).
+ * A "document" is a file your org has processed, shown with its processing
+ * record: which product ran it (API vs Editor), the pipeline/action, the user,
+ * a classification chip (when auto-classified), the outcome, and when. Content
+ * access is request-gated (the `sensitive` flag drives the drawer's elevation).
+ * The real backend fills what it can from audit_events; the MSW handlers serve
+ * these fixtures for the demo. Confidence scores aren't supported yet, so they
+ * stay null and never surface in the table.
  */
 
 import type { Tier } from "@portal/contexts/TierContext";
-import type { StatusTone } from "@app/ui";
+import type { ChipAccent, StatusTone } from "@app/ui";
 
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Domain types                                                             */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-export type DocumentStatus =
-  | "processed"
-  | "flagged"
-  | "needs-review"
-  | "archived";
+export type DocumentStatus = "processed" | "flagged" | "in-review" | "error";
+
+/** Which Stirling product ran the operation. */
+export type ProductType = "API" | "Editor";
 
 /** A single field pulled out of the document by extraction. */
 export interface Extraction {
   field: string;
   value: string;
-  /** Per-field confidence 0..1. */
   confidence: number;
 }
 
@@ -46,7 +42,6 @@ export type DocAuditKind =
 export interface DocAuditEvent {
   id: string;
   kind: DocAuditKind;
-  /** Relative-time string, e.g. "2m ago". */
   time: string;
   actor: string;
   detail: string;
@@ -55,33 +50,39 @@ export interface DocAuditEvent {
 export interface ReviewDocument {
   id: string;
   name: string;
-  /** Document type label, e.g. "Invoice", "Contract". */
+  /** File-type label, e.g. "PDF". */
   type: string;
+  /** Auto-classification label (e.g. "Contract"), or null when not classified. */
+  classification: string | null;
+  /** True when the classification was assigned automatically. */
+  auto: boolean;
+  /** Short descriptive sub-line (editor action or flag reason), or null. */
+  note: string | null;
+  /** Where it was processed. */
+  product: ProductType;
+  /** Pipeline/action, e.g. "contract". Null (or Editor product) renders "Editor". */
+  action: string | null;
+  /** The user who ran it. */
+  user: string;
   status: DocumentStatus;
+  /** Reviewer name for in-review docs, e.g. "Sarah K.". */
+  reviewer: string | null;
   /** Originating source name. */
   source: string;
-  /** Overall extraction confidence 0..1. */
-  confidence: number;
-  /** Count of extracted fields (matches extractions.length). */
+  /** Overall confidence 0..1, or null (unsupported - never shown in the table). */
+  confidence: number | null;
   fieldsExtracted: number;
-  /** Relative-time string, e.g. "4m ago". */
+  /** Relative-time string, e.g. "2 min ago". */
   time: string;
-  /**
-   * When true, content sits behind a zero-standing-access wall. The viewer
-   * sees a "Request access" affordance instead of the extractions until a
-   * timed elevation is granted.
-   */
   sensitive: boolean;
   extractions: Extraction[];
   audit: DocAuditEvent[];
 }
 
 export interface DocumentsSummary {
-  /** Total documents currently in the queue. */
   totalInQueue: number;
-  needsReview: number;
-  /** Mean extraction confidence across the queue, 0..1. */
-  avgConfidence: number;
+  processed: number;
+  errors: number;
   processedToday: number;
 }
 
@@ -92,28 +93,39 @@ export interface DocumentsResponse {
 
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Presentation metadata (label + chip tone)                                */
-/*  Lives client-side — product copy, not data. Re-exported via api/.        */
 /* ──────────────────────────────────────────────────────────────────────── */
 
 export const DOCUMENT_STATUS_LABEL: Record<DocumentStatus, string> = {
   processed: "Processed",
-  flagged: "Flagged",
-  "needs-review": "Needs review",
-  archived: "Archived",
+  flagged: "Needs Review",
+  "in-review": "In Review",
+  error: "Error",
 };
 
 export const DOCUMENT_STATUS_TONE: Record<DocumentStatus, StatusTone> = {
   processed: "success",
-  flagged: "danger",
-  "needs-review": "warning",
-  archived: "neutral",
+  flagged: "warning",
+  "in-review": "purple",
+  error: "danger",
 };
 
+export const PRODUCT_CHIP_TONE: Record<ProductType, ChipAccent> = {
+  API: "brand",
+  Editor: "success",
+};
+
+/** Classification chip accent: danger when unclassified, warning when it needs a look. */
+export function classificationTone(doc: ReviewDocument): ChipAccent {
+  if (doc.classification === "Unclassified") return "danger";
+  if (doc.status === "processed") return "success";
+  return "warning";
+}
+
 export const DOC_AUDIT_LABEL: Record<DocAuditKind, string> = {
   ingested: "Ingested",
-  extracted: "Extracted",
-  flagged: "Flagged",
-  reviewed: "Reviewed",
+  extracted: "Processed",
+  flagged: "Needs Review",
+  reviewed: "In Review",
   approved: "Approved",
   archived: "Archived",
   elevation: "Elevation",
@@ -121,436 +133,312 @@ export const DOC_AUDIT_LABEL: Record<DocAuditKind, string> = {
 
 export const DOC_AUDIT_TONE: Record<DocAuditKind, StatusTone> = {
   ingested: "info",
-  extracted: "info",
-  flagged: "danger",
-  reviewed: "warning",
+  extracted: "success",
+  flagged: "warning",
+  reviewed: "purple",
   approved: "success",
   archived: "neutral",
   elevation: "purple",
 };
 
 /* ──────────────────────────────────────────────────────────────────────── */
-/*  Fixture builders                                                         */
+/*  Fixture builder                                                          */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-/**
- * Pro-tier queue. A spread of statuses, types, sources, and confidences plus
- * deliberate edge cases: a 100%-confidence clean processed doc, a flagged
- * low-confidence outlier, and a doc with zero extracted fields.
- */
-const PRO_DOCS: ReviewDocument[] = [
-  {
-    id: "doc-inv-8841",
-    name: "ACME-INV-8841.pdf",
-    type: "Invoice",
-    status: "needs-review",
-    source: "invoices@acme.com",
-    confidence: 0.82,
-    fieldsExtracted: 6,
-    time: "3m ago",
-    sensitive: false,
-    extractions: [
-      { field: "Vendor", value: "Globex Supplies Ltd", confidence: 0.98 },
-      { field: "Invoice no.", value: "INV-8841", confidence: 0.99 },
-      { field: "Invoice date", value: "2026-06-12", confidence: 0.94 },
-      { field: "Due date", value: "2026-07-12", confidence: 0.88 },
-      { field: "Total", value: "$12,480.00", confidence: 0.71 },
-      { field: "PO number", value: "PO-2231 (unverified)", confidence: 0.42 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "4m ago",
-        actor: "invoices@acme.com",
-        detail: "Received via email inbox",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "4m ago",
-        actor: "Invoice Extractor",
-        detail: "6 fields extracted · 82% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "flagged",
-        time: "3m ago",
-        actor: "Invoice Extractor",
-        detail: "PO number below 50% confidence — routed to review",
-      },
-    ],
-  },
-  {
-    id: "doc-receipt-3320",
-    name: "expense-receipt-3320.jpg",
-    type: "Receipt",
-    status: "processed",
-    source: "Stirling Desktop — Reviewer pool",
-    confidence: 1.0,
-    fieldsExtracted: 4,
-    time: "11m ago",
-    sensitive: false,
-    extractions: [
-      { field: "Merchant", value: "Blue Bottle Coffee", confidence: 1.0 },
-      { field: "Date", value: "2026-06-15", confidence: 1.0 },
-      { field: "Amount", value: "$8.50", confidence: 1.0 },
-      { field: "Category", value: "Meals", confidence: 1.0 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "12m ago",
-        actor: "review-team@acme.com",
-        detail: "Uploaded from desktop app",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "12m ago",
-        actor: "Invoice Extractor",
-        detail: "4 fields extracted · 100% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "approved",
-        time: "11m ago",
-        actor: "Invoice Extractor",
-        detail: "Auto-approved — all fields above threshold",
-      },
-    ],
-  },
-  {
-    id: "doc-contract-7712",
-    name: "MSA-Globex-2026.pdf",
-    type: "Contract",
-    status: "needs-review",
-    source: "SharePoint — Legal",
-    confidence: 0.76,
-    fieldsExtracted: 5,
-    // Sensitive: legal contract behind zero-standing-access. Content is hidden
-    // until a timed elevation is granted.
-    sensitive: true,
-    time: "27m ago",
-    extractions: [
-      { field: "Counterparty", value: "Globex Corporation", confidence: 0.95 },
-      { field: "Effective date", value: "2026-07-01", confidence: 0.9 },
-      { field: "Term", value: "36 months", confidence: 0.84 },
-      { field: "Auto-renewal", value: "Yes — 12 months", confidence: 0.61 },
-      { field: "Governing law", value: "Delaware", confidence: 0.49 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "31m ago",
-        actor: "SharePoint — Legal",
-        detail: "Synced from Contracts / Inbound",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "30m ago",
-        actor: "Contract Router",
-        detail: "5 fields extracted · 76% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "flagged",
-        time: "27m ago",
-        actor: "Contract Router",
-        detail: "Governing-law clause ambiguous — routed to legal review",
-      },
-    ],
-  },
-  {
-    id: "doc-claim-1190",
-    name: "claim-1190-intake.pdf",
-    type: "Claim",
-    status: "flagged",
-    source: "S3 — claims-intake",
-    confidence: 0.38,
-    fieldsExtracted: 3,
-    // Edge case: low-confidence outlier that failed to parse a scanned form.
-    sensitive: false,
-    time: "44m ago",
-    extractions: [
-      { field: "Claimant", value: "(illegible)", confidence: 0.21 },
-      { field: "Policy no.", value: "POL-44120", confidence: 0.66 },
-      { field: "Claim amount", value: "(not found)", confidence: 0.0 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "46m ago",
-        actor: "S3 — claims-intake",
-        detail: "Picked up from intake bucket",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "45m ago",
-        actor: "KYC Processor",
-        detail: "3 fields extracted · 38% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "flagged",
-        time: "44m ago",
-        actor: "KYC Processor",
-        detail: "Scan quality too low — manual re-key required",
-      },
-    ],
-  },
-  {
-    id: "doc-w9-0042",
-    name: "vendor-W9-globex.pdf",
-    type: "Tax form",
-    status: "processed",
-    source: "Acme Production",
-    confidence: 0.93,
-    fieldsExtracted: 5,
-    sensitive: true,
-    time: "1h ago",
-    extractions: [
-      { field: "Legal name", value: "Globex Supplies Ltd", confidence: 0.97 },
-      { field: "TIN", value: "••-•••4821", confidence: 0.91 },
-      { field: "Entity type", value: "LLC", confidence: 0.95 },
-      {
-        field: "Address",
-        value: "44 Industrial Way, Springfield",
-        confidence: 0.9,
-      },
-      { field: "Signature", value: "Present", confidence: 0.92 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "1h ago",
-        actor: "Acme Production",
-        detail: "Uploaded via POST /v1/extract",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "1h ago",
-        actor: "KYC Processor",
-        detail: "5 fields extracted · 93% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "approved",
-        time: "58m ago",
-        actor: "you@acme.com",
-        detail: "Reviewed and approved",
-      },
-    ],
-  },
-  {
-    id: "doc-po-6610",
-    name: "purchase-order-6610.pdf",
-    type: "Purchase order",
-    status: "archived",
-    source: "Nightly archive reprocess",
-    confidence: 0.88,
-    fieldsExtracted: 4,
-    sensitive: false,
-    time: "8h ago",
-    extractions: [
-      { field: "Supplier", value: "Initech", confidence: 0.92 },
-      { field: "PO number", value: "PO-6610", confidence: 0.99 },
-      { field: "Line items", value: "7", confidence: 0.85 },
-      { field: "Total", value: "$3,210.00", confidence: 0.78 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "8h ago",
-        actor: "Nightly archive reprocess",
-        detail: "Reprocessed from archive bucket",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "8h ago",
-        actor: "Invoice Extractor",
-        detail: "4 fields extracted · 88% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "archived",
-        time: "8h ago",
-        actor: "system",
-        detail: "Retention policy — archived after approval",
-      },
-    ],
-  },
-];
+type DocSeed = {
+  id: string;
+  name: string;
+  product: ProductType;
+  user: string;
+  status: DocumentStatus;
+  time: string;
+  classification?: string;
+  auto?: boolean;
+  note?: string;
+  action?: string;
+  reviewer?: string;
+  sensitive?: boolean;
+  type?: string;
+};
 
-/**
- * Enterprise-only additions — deeper queue with more sensitive items so the
- * zero-standing-access elevation flow has something to gate, plus richer
- * audit trails.
- */
-const ENTERPRISE_EXTRA: ReviewDocument[] = [
-  {
-    id: "doc-kyc-5523",
-    name: "onboarding-passport-5523.pdf",
-    type: "KYC document",
-    status: "needs-review",
-    source: "S3 — claims-intake",
-    confidence: 0.79,
-    fieldsExtracted: 6,
-    sensitive: true,
-    time: "9m ago",
-    extractions: [
-      { field: "Full name", value: "Maria L. Vance", confidence: 0.96 },
-      { field: "Document type", value: "Passport", confidence: 0.99 },
-      { field: "Document no.", value: "••••••742", confidence: 0.83 },
-      { field: "Date of birth", value: "1989-03-14", confidence: 0.88 },
-      { field: "Nationality", value: "United Kingdom", confidence: 0.94 },
-      { field: "Expiry", value: "2029-11-02", confidence: 0.55 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "10m ago",
-        actor: "S3 — claims-intake",
-        detail: "Picked up from intake bucket",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "10m ago",
-        actor: "KYC Processor",
-        detail: "6 fields extracted · 79% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "flagged",
-        time: "9m ago",
-        actor: "Compliance Sweep",
-        detail: "PII present — four-eyes review required before release",
-      },
-    ],
-  },
-  {
-    id: "doc-dpa-2207",
-    name: "DPA-globex-amendment.pdf",
-    type: "Contract",
-    status: "flagged",
-    source: "SharePoint — Legal",
-    confidence: 0.84,
-    fieldsExtracted: 5,
-    sensitive: true,
-    time: "1h ago",
-    extractions: [
-      { field: "Counterparty", value: "Globex Corporation", confidence: 0.95 },
-      { field: "Data categories", value: "PII, financial", confidence: 0.81 },
-      { field: "Sub-processors", value: "3 listed", confidence: 0.77 },
-      { field: "SCC version", value: "2021/914", confidence: 0.9 },
-      { field: "Breach window", value: "72 hours", confidence: 0.76 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "1h ago",
-        actor: "SharePoint — Legal",
-        detail: "Synced from Contracts / Inbound",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "1h ago",
-        actor: "Contract Router",
-        detail: "5 fields extracted · 84% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "flagged",
-        time: "1h ago",
-        actor: "Compliance Sweep",
-        detail: "Sub-processor list changed — escalated to DPO",
-      },
-    ],
-  },
-  {
-    id: "doc-coi-9001",
-    name: "certificate-of-insurance-9001.pdf",
-    type: "Compliance",
-    status: "processed",
-    source: "Compliance Sweep",
-    confidence: 0.96,
-    fieldsExtracted: 5,
-    sensitive: false,
-    time: "2h ago",
-    extractions: [
-      { field: "Insured", value: "Acme Corp", confidence: 0.98 },
-      { field: "Carrier", value: "Liberty Mutual", confidence: 0.97 },
-      { field: "Policy no.", value: "CGL-77120", confidence: 0.95 },
-      { field: "Coverage", value: "$2,000,000", confidence: 0.96 },
-      { field: "Expiry", value: "2027-01-31", confidence: 0.94 },
-    ],
-    audit: [
-      {
-        id: "a1",
-        kind: "ingested",
-        time: "2h ago",
-        actor: "Compliance Sweep",
-        detail: "Pulled for COI compliance check",
-      },
-      {
-        id: "a2",
-        kind: "extracted",
-        time: "2h ago",
-        actor: "Compliance Sweep",
-        detail: "5 fields extracted · 96% mean confidence",
-      },
-      {
-        id: "a3",
-        kind: "approved",
-        time: "2h ago",
-        actor: "compliance@acme.com",
-        detail: "Coverage verified — approved",
-      },
-    ],
-  },
-];
-
-/** Documents for a given tier. Free is a slim queue; enterprise is the deepest. */
-export function documentsFor(tier: Tier): ReviewDocument[] {
-  if (tier === "free") {
-    // Free keeps a simple, non-sensitive queue — no elevation flow to exercise.
-    return PRO_DOCS.filter((d) => !d.sensitive).slice(0, 3);
-  }
-  if (tier === "enterprise") return [...ENTERPRISE_EXTRA, ...PRO_DOCS];
-  return PRO_DOCS;
+function mk(s: DocSeed): ReviewDocument {
+  const source = s.product === "API" ? "API integration" : "Web upload";
+  const resultKind: DocAuditKind =
+    s.status === "flagged"
+      ? "flagged"
+      : s.status === "in-review"
+        ? "reviewed"
+        : "extracted";
+  const audit: DocAuditEvent[] = [
+    {
+      id: `${s.id}-a1`,
+      kind: "ingested",
+      time: s.time,
+      actor: s.user || "system",
+      detail: `Received via ${source}`,
+    },
+    {
+      id: `${s.id}-a2`,
+      kind: resultKind,
+      time: s.time,
+      actor: s.user || "system",
+      detail: s.note ?? (s.action ? `Ran ${s.action}` : "Processed"),
+    },
+  ];
+  return {
+    id: s.id,
+    name: s.name,
+    type: s.type ?? "PDF",
+    classification: s.classification ?? null,
+    auto: s.auto ?? false,
+    note: s.note ?? null,
+    product: s.product,
+    action: s.action ?? null,
+    user: s.user,
+    status: s.status,
+    reviewer: s.reviewer ?? null,
+    source,
+    confidence: null,
+    fieldsExtracted: 0,
+    time: s.time,
+    sensitive: s.sensitive ?? false,
+    extractions: [],
+    audit,
+  };
+}
+
+// Ordered newest-first; 15 processed, 4 needs-review, 1 in-review → "All 20".
+const DOCS: ReviewDocument[] = [
+  mk({
+    id: "d1",
+    name: "acme_services_agreement.pdf",
+    classification: "Contract",
+    auto: true,
+    product: "API",
+    action: "contract",
+    user: "matt",
+    status: "processed",
+    time: "2 min ago",
+  }),
+  mk({
+    id: "d2",
+    name: "quarterly_report_draft.pdf",
+    note: "Merge + watermark removal",
+    product: "Editor",
+    user: "sarah.k",
+    status: "processed",
+    time: "3 min ago",
+  }),
+  mk({
+    id: "d3",
+    name: "flagged_contract.pdf",
+    classification: "Contract",
+    note: "Low confidence PII detection",
+    product: "API",
+    action: "contract",
+    user: "matt",
+    status: "flagged",
+    time: "4 min ago",
+  }),
+  mk({
+    id: "d4",
+    name: "loan_disclosure_preview.pdf",
+    classification: "Closing Disclosure",
+    auto: true,
+    product: "API",
+    action: "closing disclosure",
+    user: "",
+    status: "processed",
+    time: "5 min ago",
+  }),
+  mk({
+    id: "d5",
+    name: "patient_intake_form.pdf",
+    classification: "Patient Intake",
+    auto: true,
+    product: "API",
+    action: "patient intake",
+    user: "matt",
+    status: "processed",
+    time: "6 min ago",
+  }),
+  mk({
+    id: "d6",
+    name: "invoice_batch_march.pdf",
+    note: "Split into 12 pages + OCR",
+    product: "Editor",
+    user: "mike.r",
+    status: "processed",
+    time: "8 min ago",
+  }),
+  mk({
+    id: "d7",
+    name: "unknown_format.pdf",
+    classification: "Unclassified",
+    note: "Unrecognized format, needs manual classification",
+    product: "API",
+    action: "documents",
+    user: "matt",
+    status: "flagged",
+    time: "9 min ago",
+  }),
+  mk({
+    id: "d8",
+    name: "employee_w2_martinez.pdf",
+    classification: "Tax Document",
+    auto: true,
+    product: "API",
+    action: "tax document",
+    user: "matt",
+    status: "processed",
+    time: "11 min ago",
+  }),
+  mk({
+    id: "d9",
+    name: "nda_countersigned.pdf",
+    classification: "Contract",
+    auto: true,
+    product: "API",
+    action: "contract",
+    user: "",
+    status: "processed",
+    time: "13 min ago",
+  }),
+  mk({
+    id: "d10",
+    name: "ambiguous_signature.pdf",
+    classification: "Contract",
+    note: "Signature verification failed",
+    product: "API",
+    action: "contract",
+    user: "matt",
+    status: "in-review",
+    reviewer: "Sarah K.",
+    time: "15 min ago",
+  }),
+  mk({
+    id: "d11",
+    name: "vendor_invoice_globex.pdf",
+    classification: "Invoice",
+    auto: true,
+    product: "API",
+    action: "invoice",
+    user: "matt",
+    status: "processed",
+    time: "18 min ago",
+  }),
+  mk({
+    id: "d12",
+    name: "merged_appendix.pdf",
+    note: "Merge + compress",
+    product: "Editor",
+    user: "sarah.k",
+    status: "processed",
+    time: "22 min ago",
+  }),
+  mk({
+    id: "d13",
+    name: "medical_record_scan.pdf",
+    classification: "Patient Intake",
+    auto: true,
+    product: "API",
+    action: "patient intake",
+    user: "lisa.m",
+    status: "processed",
+    time: "25 min ago",
+    sensitive: true,
+  }),
+  mk({
+    id: "d14",
+    name: "redacted_statement.pdf",
+    note: "Redact PII + flatten",
+    product: "Editor",
+    user: "mike.r",
+    status: "processed",
+    time: "30 min ago",
+    sensitive: true,
+  }),
+  mk({
+    id: "d15",
+    name: "w4_form_chen.pdf",
+    classification: "Tax Document",
+    auto: true,
+    product: "API",
+    action: "tax document",
+    user: "matt",
+    status: "processed",
+    time: "35 min ago",
+  }),
+  mk({
+    id: "d16",
+    name: "offer_letter_draft.pdf",
+    classification: "Contract",
+    note: "Missing signature block",
+    product: "API",
+    action: "contract",
+    user: "john.d",
+    status: "flagged",
+    time: "40 min ago",
+  }),
+  mk({
+    id: "d17",
+    name: "compressed_brochure.pdf",
+    note: "Compress + convert to PDF",
+    product: "Editor",
+    user: "sarah.k",
+    status: "processed",
+    time: "48 min ago",
+  }),
+  mk({
+    id: "d18",
+    name: "blurry_receipt.pdf",
+    classification: "Unclassified",
+    note: "Image too low-res to classify",
+    product: "API",
+    action: "documents",
+    user: "matt",
+    status: "flagged",
+    time: "52 min ago",
+  }),
+  mk({
+    id: "d19",
+    name: "signed_nda_partner.pdf",
+    classification: "Contract",
+    auto: true,
+    product: "API",
+    action: "contract",
+    user: "",
+    status: "processed",
+    time: "1 h ago",
+  }),
+  mk({
+    id: "d20",
+    name: "bank_statement_june.pdf",
+    classification: "Closing Disclosure",
+    auto: true,
+    product: "API",
+    action: "closing disclosure",
+    user: "lisa.m",
+    status: "processed",
+    time: "1 h ago",
+    sensitive: true,
+  }),
+];
+
+/** Documents for a given tier. Free is a slim queue; pro/enterprise get all. */
+export function documentsFor(tier: Tier): ReviewDocument[] {
+  if (tier === "free") return DOCS.filter((d) => !d.sensitive).slice(0, 6);
+  return DOCS;
 }
 
-/** Summary strip derived from the tier's queue so the KPIs always reconcile. */
 export function summaryFor(tier: Tier): DocumentsSummary {
   const docs = documentsFor(tier);
-  const needsReview = docs.filter((d) => d.status === "needs-review").length;
-  const avgConfidence =
-    docs.length === 0
-      ? 0
-      : docs.reduce((sum, d) => sum + d.confidence, 0) / docs.length;
-  // "Processed today" approximates same-day throughput from the visible queue;
-  // a real backend would count against an actual calendar boundary.
-  const processedToday = docs.filter(
-    (d) => d.status === "processed" || d.status === "archived",
-  ).length;
+  const processed = docs.filter((d) => d.status === "processed").length;
   return {
     totalInQueue: docs.length,
-    needsReview,
-    avgConfidence,
-    processedToday,
+    processed,
+    errors: docs.filter((d) => d.status === "error").length,
+    processedToday: processed,
   };
 }
 
diff --git a/frontend/editor/src/portal/mocks/handlers/documents.ts b/frontend/editor/src/portal/mocks/handlers/documents.ts
index 0f072aa1bd..dca9a0a6af 100644
--- a/frontend/editor/src/portal/mocks/handlers/documents.ts
+++ b/frontend/editor/src/portal/mocks/handlers/documents.ts
@@ -3,7 +3,9 @@ import type { Tier } from "@portal/contexts/TierContext";
 import { buildDocumentsResponse } from "@portal/mocks/documents";
 
 export const documentsHandlers = [
-  http.get("/v1/documents", async ({ request }) => {
+  // Wildcard prefix so it intercepts both apiClient.local (same-origin) and
+  // apiClient.saas (absolute VITE_SAAS_API_URL) calls.
+  http.get("*/api/v1/proprietary/ui-data/documents", async ({ request }) => {
     await delay(120);
     const url = new URL(request.url);
     const tier = (url.searchParams.get("tier") ?? "pro") as Tier;
diff --git a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
index 3b3029cb2a..f885a39a1f 100644
--- a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
@@ -45,8 +45,65 @@ export const infrastructureHandlers = [
     return HttpResponse.json(storageFor(tierFrom(request)));
   }),
 
-  http.get("/v1/infrastructure/audit-log", async ({ request }) => {
-    await delay(120);
-    return HttpResponse.json(auditLogFor(tierFrom(request)));
+  // Mirrors the real backend route. Wildcard prefix so it intercepts both the
+  // self-hosted apiClient.local call (same-origin) and the SaaS apiClient.saas
+  // call (absolute VITE_SAAS_API_URL).
+  http.get(
+    "*/api/v1/proprietary/ui-data/infrastructure/audit-log",
+    async ({ request }) => {
+      await delay(120);
+      return HttpResponse.json(auditLogFor(tierFrom(request)));
+    },
+  ),
+
+  // Sample audit export so the export modal downloads something with mocks on.
+  http.get("*/api/v1/proprietary/ui-data/audit-export", async ({ request }) => {
+    await delay(200);
+    const format = new URL(request.url).searchParams.get("format") ?? "csv";
+    const rows = [
+      {
+        date: "2026-07-07 18:59:31",
+        username: "carol.diaz@acme.com",
+        ipaddress: "10.0.3.21",
+        tool: "compress-pdf",
+        documentName: "purchase-order-6610.pdf",
+        outcome: "success",
+      },
+      {
+        date: "2026-07-07 18:40:50",
+        username: "alice.chen@acme.com",
+        ipaddress: "10.0.0.161",
+        tool: "login",
+        documentName: "",
+        outcome: "success",
+      },
+      {
+        date: "2026-07-07 15:25:06",
+        username: "admin@stirlingpdf.com",
+        ipaddress: "10.0.1.4",
+        tool: "add-password",
+        documentName: "scan-batch-0142.pdf",
+        outcome: "failure",
+      },
+    ];
+    if (format === "json") {
+      return HttpResponse.json(rows);
+    }
+    const header = "date,username,ipaddress,tool,documentName,outcome";
+    const body = rows
+      .map((r) =>
+        [
+          r.date,
+          r.username,
+          r.ipaddress,
+          r.tool,
+          r.documentName,
+          r.outcome,
+        ].join(","),
+      )
+      .join("\n");
+    return new HttpResponse(`${header}\n${body}\n`, {
+      headers: { "Content-Type": "text/csv" },
+    });
   }),
 ];
diff --git a/frontend/editor/src/portal/mocks/infrastructure.ts b/frontend/editor/src/portal/mocks/infrastructure.ts
index 47c0c664ab..5b33e324fb 100644
--- a/frontend/editor/src/portal/mocks/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/infrastructure.ts
@@ -655,126 +655,190 @@ export interface AuditEvent {
   latencyMs: number;
 }
 
+// Mirrors what the real backend (PortalInfraAuditService) returns: audit_events
+// mapped from real AuditEventType values to the tab's categories. Only real
+// types appear - there is no audited "elevation" event, so that category is
+// absent (its summary metric reads 0), matching the backend.
 const AUDIT_EVENTS_ALL: AuditEvent[] = [
   {
-    id: "a-1",
-    timestamp: "10:42:18",
+    id: "8841",
+    timestamp: "2026-07-07 18:59:31",
     category: "processing",
-    action: "Pipeline run completed",
-    actor: "ci-bot",
-    target: "COI Compliance",
+    action: "Compress PDF",
+    actor: "alice.chen@acme.com",
+    target: "acme-invoice-8841.pdf",
     status: "success",
-    latencyMs: 412,
+    latencyMs: 842,
   },
   {
-    id: "a-2",
-    timestamp: "10:38:02",
+    id: "8840",
+    timestamp: "2026-07-07 18:40:50",
     category: "auth",
-    action: "API key authenticated",
-    actor: "sk_live_a3f8…",
-    target: "us-east-1 gateway",
+    action: "User signed in",
+    actor: "carol.diaz@acme.com",
+    target: "Web session",
     status: "success",
-    latencyMs: 9,
+    latencyMs: 128,
   },
   {
-    id: "a-3",
-    timestamp: "10:31:55",
-    category: "elevation",
-    action: "Admin role assumed",
-    actor: "maria.chen",
-    target: "Security settings",
-    status: "warning",
-    latencyMs: 21,
-  },
-  {
-    id: "a-4",
-    timestamp: "10:24:40",
-    category: "config",
-    action: "Retention policy changed",
-    actor: "devon.park",
-    target: "30d → 90d",
-    status: "info",
-    latencyMs: 14,
-  },
-  {
-    id: "a-5",
-    timestamp: "10:19:07",
+    id: "8839",
+    timestamp: "2026-07-07 18:22:07",
     category: "security",
-    action: "IP allowlist updated",
-    actor: "maria.chen",
-    target: "203.0.113.7/32",
-    status: "info",
-    latencyMs: 11,
+    action: "Add password",
+    actor: "bob.martin@acme.com",
+    target: "MSA-Globex-2026.pdf",
+    status: "success",
+    latencyMs: 1203,
   },
   {
-    id: "a-6",
-    timestamp: "10:12:33",
+    id: "8838",
+    timestamp: "2026-07-07 17:58:44",
+    category: "config",
+    action: "Admin settings changed",
+    actor: "admin@stirlingpdf.com",
+    target: "/api/v1/admin/settings/update",
+    status: "info",
+    latencyMs: 210,
+  },
+  {
+    id: "8837",
+    timestamp: "2026-07-07 17:31:12",
+    category: "processing",
+    action: "Merge PDFs",
+    actor: "raj.patel@acme.com",
+    target: "onboarding-packet.pdf",
+    status: "success",
+    latencyMs: 2199,
+  },
+  {
+    id: "8836",
+    timestamp: "2026-07-07 17:04:55",
     category: "auth",
-    action: "Failed key authentication",
-    actor: "sk_live_d901…",
-    target: "us-west-2 gateway",
+    action: "Failed sign-in attempt",
+    actor: "bob.martn@acme.com",
+    target: "Web session",
     status: "danger",
-    latencyMs: 6,
+    latencyMs: 96,
   },
   {
-    id: "a-7",
-    timestamp: "10:04:51",
+    id: "8835",
+    timestamp: "2026-07-07 16:47:29",
     category: "processing",
-    action: "Redaction job queued",
-    actor: "ci-bot",
-    target: "Prior Auth batch",
+    action: "OCR PDF",
+    actor: "api-service@acme.com",
+    target: "scan-batch-0142.pdf",
     status: "success",
-    latencyMs: 188,
+    latencyMs: 8421,
   },
   {
-    id: "a-8",
-    timestamp: "09:58:12",
-    category: "elevation",
-    action: "Key rotation requested",
-    actor: "devon.park",
-    target: "Ops · admin (legacy)",
-    status: "warning",
-    latencyMs: 33,
-  },
-  {
-    id: "a-9",
-    timestamp: "09:51:44",
+    id: "8834",
+    timestamp: "2026-07-07 16:20:03",
     category: "security",
-    action: "Access policy set to HYOK",
-    actor: "maria.chen",
-    target: "Document encryption",
-    status: "info",
-    latencyMs: 27,
+    action: "Add watermark",
+    actor: "carol.diaz@acme.com",
+    target: "policy-handbook.pdf",
+    status: "success",
+    latencyMs: 640,
   },
   {
-    id: "a-10",
-    timestamp: "09:43:20",
+    id: "8833",
+    timestamp: "2026-07-07 15:58:41",
     category: "config",
-    action: "Region added",
-    actor: "ci-bot",
-    target: "eu-west-1",
-    status: "success",
-    latencyMs: 240,
+    action: "Profile settings updated",
+    actor: "alice.chen@acme.com",
+    target: "/api/v1/user/change-settings",
+    status: "info",
+    latencyMs: 175,
   },
   {
-    id: "a-11",
-    timestamp: "09:36:08",
+    id: "8832",
+    timestamp: "2026-07-07 15:29:18",
     category: "processing",
-    action: "Schema drift flagged",
-    actor: "extract-engine",
-    target: "Invoice v3",
-    status: "warning",
-    latencyMs: 95,
+    action: "Split pages",
+    actor: "bob.martin@acme.com",
+    target: "statement-june.pdf",
+    status: "success",
+    latencyMs: 410,
   },
   {
-    id: "a-12",
-    timestamp: "09:28:55",
-    category: "auth",
-    action: "SSO session started",
-    actor: "devon.park",
-    target: "Okta · acme.com",
+    id: "8831",
+    timestamp: "2026-07-07 15:02:37",
+    category: "processing",
+    action: "Compress PDF",
+    actor: "api-service@acme.com",
+    target: "purchase-order-6610.pdf",
+    status: "danger",
+    latencyMs: 1203,
+  },
+  {
+    id: "8830",
+    timestamp: "2026-07-07 14:41:50",
+    category: "security",
+    action: "Remove password",
+    actor: "raj.patel@acme.com",
+    target: "certificate-9001.pdf",
     status: "success",
-    latencyMs: 18,
+    latencyMs: 980,
+  },
+  {
+    id: "8829",
+    timestamp: "2026-07-07 14:15:22",
+    category: "processing",
+    action: "PDF to Image",
+    actor: "carol.diaz@acme.com",
+    target: "contract-amendment.pdf",
+    status: "warning",
+    latencyMs: 1560,
+  },
+  {
+    id: "8828",
+    timestamp: "2026-07-07 13:52:09",
+    category: "auth",
+    action: "User signed out",
+    actor: "alice.chen@acme.com",
+    target: "Web session",
+    status: "success",
+    latencyMs: 42,
+  },
+  {
+    id: "8827",
+    timestamp: "2026-07-07 13:30:44",
+    category: "config",
+    action: "Admin settings changed",
+    actor: "admin@stirlingpdf.com",
+    target: "/api/v1/admin/team/update",
+    status: "info",
+    latencyMs: 320,
+  },
+  {
+    id: "8826",
+    timestamp: "2026-07-07 13:03:58",
+    category: "processing",
+    action: "Extract images",
+    actor: "raj.patel@acme.com",
+    target: "expense-report-q2.pdf",
+    status: "success",
+    latencyMs: 2200,
+  },
+  {
+    id: "8825",
+    timestamp: "2026-07-07 12:38:11",
+    category: "auth",
+    action: "User signed in",
+    actor: "bob.martin@acme.com",
+    target: "Web session",
+    status: "success",
+    latencyMs: 110,
+  },
+  {
+    id: "8824",
+    timestamp: "2026-07-07 12:11:47",
+    category: "security",
+    action: "Add watermark",
+    actor: "alice.chen@acme.com",
+    target: "MSA-Globex-2026.pdf",
+    status: "success",
+    latencyMs: 705,
   },
 ];
 
@@ -788,6 +852,8 @@ export interface AuditSummary {
 export interface AuditLogResponse {
   summary: AuditSummary;
   events: AuditEvent[];
+  /** True for the whole-server (admin) view; gates the admin-only CSV export. */
+  fullServer: boolean;
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -1039,20 +1105,19 @@ export function modelsResponseFor(tier: Tier): ModelsResponse {
 export function auditLogFor(tier: Tier): AuditLogResponse {
   const events =
     tier === "free"
-      ? AUDIT_EVENTS_ALL.slice(0, 5)
+      ? AUDIT_EVENTS_ALL.slice(0, 6)
       : tier === "pro"
-        ? AUDIT_EVENTS_ALL.slice(0, 9)
+        ? AUDIT_EVENTS_ALL.slice(0, 12)
         : AUDIT_EVENTS_ALL;
 
-  // Headline counts reflect a full 24h window, not just the visible slice —
-  // the table shows the most recent events, the metrics show the day's totals.
-  const scale = tier === "free" ? 1 : tier === "pro" ? 21 : 86;
+  // Summary is derived from the returned events, exactly like the backend
+  // (PortalInfraAuditService) computes it - so mocks and real data reconcile.
   const summary: AuditSummary = {
-    totalEvents: events.length * scale,
-    processing:
-      events.filter((e) => e.category === "processing").length * scale,
-    elevation: events.filter((e) => e.category === "elevation").length * scale,
-    config: events.filter((e) => e.category === "config").length * scale,
+    totalEvents: events.length,
+    processing: events.filter((e) => e.category === "processing").length,
+    elevation: events.filter((e) => e.category === "elevation").length,
+    config: events.filter((e) => e.category === "config").length,
   };
-  return { summary, events };
+  // The mock represents the admin (whole-server) view, so export is offered.
+  return { summary, events, fullServer: true };
 }
diff --git a/frontend/editor/src/portal/views/Documents.css b/frontend/editor/src/portal/views/Documents.css
index a655289567..13cbf33c3c 100644
--- a/frontend/editor/src/portal/views/Documents.css
+++ b/frontend/editor/src/portal/views/Documents.css
@@ -9,6 +9,13 @@
 
 /* Header */
 .portal-documents__head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+}
+
+.portal-documents__head-text {
   display: flex;
   flex-direction: column;
   gap: 0.25rem;
@@ -36,25 +43,50 @@
   gap: 1.25rem;
 }
 
+/* Toolbar: filter pills left, filename search right */
+.portal-documents__toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+.portal-documents__search {
+  width: 18rem;
+  max-width: 100%;
+}
+
 .portal-documents__table-skeleton {
   display: flex;
   flex-direction: column;
   gap: 0.5rem;
 }
 
-/* Table cells */
-.portal-documents__name-cell {
+/* Document cell: name + chips + descriptive sub-line */
+.portal-documents__doc-cell {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+  min-width: 0;
+}
+
+.portal-documents__doc-head {
   display: flex;
   align-items: center;
-  gap: 0.4375rem;
+  gap: 0.5rem;
+  flex-wrap: wrap;
   min-width: 0;
 }
 
 .portal-documents__name {
   font-weight: 600;
   color: var(--color-text-1);
-  overflow: hidden;
-  text-overflow: ellipsis;
+}
+
+.portal-documents__note {
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
 }
 
 .portal-documents__lock {
@@ -68,32 +100,15 @@
   color: var(--color-text-4);
 }
 
-.portal-documents__mono {
-  font-family: var(--font-mono);
+.portal-documents__action {
   font-size: 0.8125rem;
   color: var(--color-text-2);
 }
 
-.portal-documents__confidence {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-documents__confidence-pct {
-  font-family: var(--font-mono);
-  font-size: 0.75rem;
-  white-space: nowrap;
-}
-
-.portal-documents__confidence-pct--success {
-  color: var(--color-green-dark);
-}
-.portal-documents__confidence-pct--warning {
-  color: var(--color-amber-dark);
-}
-.portal-documents__confidence-pct--danger {
-  color: var(--color-red);
+.portal-documents__editor-action {
+  font-size: 0.8125rem;
+  font-style: italic;
+  color: var(--color-text-4);
 }
 
 /* Drawer body */
diff --git a/frontend/editor/src/portal/views/Documents.tsx b/frontend/editor/src/portal/views/Documents.tsx
index e73b4960a1..b94102bd4f 100644
--- a/frontend/editor/src/portal/views/Documents.tsx
+++ b/frontend/editor/src/portal/views/Documents.tsx
@@ -1,26 +1,107 @@
 import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import { useTier } from "@portal/contexts/TierContext";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  fetchDocuments,
+  DOCUMENT_STATUS_LABEL,
+  type DocumentsResponse,
+  type ReviewDocument,
+} from "@portal/api/documents";
 import { ReviewQueue } from "@portal/components/documents/ReviewQueue";
 import "@portal/views/Documents.css";
 
+function DownloadIcon() {
+  return (
+    <svg width="15" height="15" viewBox="0 0 24 24" fill="none" aria-hidden>
+      <path
+        d="M12 3v12m0 0 4-4m-4 4-4-4M5 21h14"
+        stroke="currentColor"
+        strokeWidth="2"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+      />
+    </svg>
+  );
+}
+
+function csvCell(value: string): string {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+
+/** Flatten the visible columns to CSV, matching the on-screen table. */
+function toCsv(docs: ReviewDocument[]): string {
+  const header = [
+    "Document",
+    "Product",
+    "Pipeline / Action",
+    "User",
+    "Status",
+    "Time",
+  ];
+  const lines = [header.map(csvCell).join(",")];
+  for (const d of docs) {
+    const action = d.product === "Editor" || !d.action ? "Editor" : d.action;
+    const status =
+      DOCUMENT_STATUS_LABEL[d.status] +
+      (d.status === "in-review" && d.reviewer ? ` · ${d.reviewer}` : "");
+    lines.push(
+      [d.name, d.product, action, d.user || "", status, d.time]
+        .map((v) => csvCell(String(v)))
+        .join(","),
+    );
+  }
+  return lines.join("\n");
+}
+
 /**
- * Documents surface — the review/approval queue: documents flowing through the
- * org's pipelines awaiting a decision, with filters, a detail drawer, and
- * zero-standing-access elevation for sensitive files.
+ * Documents surface - the processing record for every file the org has run,
+ * with status filters, a filename search, a CSV export, and a detail drawer
+ * (content is request-gated behind zero-standing-access for sensitive files).
  */
 export function Documents() {
   const { t } = useTranslation();
+  const { tier } = useTier();
+  const state = useAsync<DocumentsResponse>(() => fetchDocuments(tier), [tier]);
+  const documents = state.data?.documents ?? [];
+
+  function exportCsv() {
+    const blob = new Blob([toCsv(documents)], {
+      type: "text/csv;charset=utf-8",
+    });
+    const url = URL.createObjectURL(blob);
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = "documents.csv";
+    document.body.appendChild(link);
+    link.click();
+    document.body.removeChild(link);
+    URL.revokeObjectURL(url);
+  }
+
   return (
     <div className="portal-documents">
       <header className="portal-documents__head">
-        <h1 className="portal-documents__title">
-          {t("portal.documents.title")}
-        </h1>
-        <p className="portal-documents__sub">
-          {t("portal.documents.subtitle")}
-        </p>
+        <div className="portal-documents__head-text">
+          <h1 className="portal-documents__title">
+            {t("portal.documents.title")}
+          </h1>
+          <p className="portal-documents__sub">
+            {t("portal.documents.subtitle")}
+          </p>
+        </div>
+        <Button
+          variant="secondary"
+          size="sm"
+          leftSection={<DownloadIcon />}
+          onClick={exportCsv}
+          disabled={documents.length === 0}
+        >
+          {t("portal.documents.exportCsv")}
+        </Button>
       </header>
 
-      <ReviewQueue />
+      <ReviewQueue documents={documents} loading={state.loading} />
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/views/Infrastructure.css b/frontend/editor/src/portal/views/Infrastructure.css
index fd893694d3..f0a2f55da9 100644
--- a/frontend/editor/src/portal/views/Infrastructure.css
+++ b/frontend/editor/src/portal/views/Infrastructure.css
@@ -71,6 +71,51 @@
   color: var(--color-text-4);
 }
 
+/* Audit tab header row: section heading + Export action */
+.portal-infra__audit-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+}
+
+/* Export modal body */
+.portal-infra__export {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+}
+
+.portal-infra__export-group {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.portal-infra__export-label {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+}
+
+.portal-infra__export-fields {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 0.5rem 1rem;
+}
+
+.portal-infra__export-error {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--color-danger, #e5484d);
+}
+
+.portal-infra__export-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.75rem;
+}
+
 /* Two-column split */
 .portal-infra__split {
   display: grid;

From 3fa0f30d43c08e7afb52d05fb62083a76d9dcd0e Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:39:37 +0100
Subject: [PATCH 34/35] =?UTF-8?q?Portal:=20prep=20for=20SaaS=20launch=20?=
 =?UTF-8?q?=E2=80=94=20hide=20unfinished=20sections,=20fix=20api=20client,?=
 =?UTF-8?q?=20docs=20link=20(#6921)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What this changes

Getting the portal ready to show the world on SaaS. A few things bundled
in here:

**Developer docs tab** — now opens https://docs.stirlingpdf.com/ in a
new tab instead of taking you to an empty page (we haven't built the
in-app docs page yet).

**Hid the bits that aren't finished yet — SaaS only:**
- Took the Agent Builder button off the Sources page.
- Removed the Components page.
- Infrastructure: the tabs that aren't ready (Deployments, Security,
Models, Storage) are greyed out as "coming soon". API keys and Audit
stay live. Also dropped the "Manage editor deployment" button.
- Removed the floating AI assistant blob.

**Fixed the SaaS api client.** Before this, only the usage/billing page
actually reached the backend — everything else (sources, users,
policies, etc.) was going to the vite dev server with the wrong login,
so it never worked. Now every portal call goes to the one SaaS backend
using the Supabase login.

Self-hosted is left exactly as it was — all the SaaS hides go through
the saas override layer, so self-hosted still shows everything.

## Testing
typecheck (all variants), full test suite, both builds, lint + format —
all green.
---
 .../public/locales/en-US/translation.toml     |  3 +
 .../src/portal-saas/api/localBackend.test.ts  | 32 +++++++
 .../src/portal-saas/api/localBackend.ts       | 22 +++++
 .../components/AssistantMount.test.tsx        | 10 +++
 .../portal-saas/components/AssistantMount.tsx |  7 ++
 .../components/sidebarGroups.test.ts          | 32 +++++++
 .../portal-saas/components/sidebarGroups.tsx  | 18 ++++
 .../sources/AgentBuilderAction.test.tsx       | 10 +++
 .../components/sources/AgentBuilderAction.tsx |  7 ++
 .../src/portal-saas/views/AgentBuilder.tsx    | 10 +++
 .../src/portal-saas/views/Components.tsx      | 10 +++
 .../portal-saas/views/Infrastructure.test.tsx | 44 ++++++++++
 .../src/portal-saas/views/Infrastructure.tsx  | 86 +++++++++++++++++++
 frontend/editor/src/portal/api/http.ts        | 44 +++++-----
 .../editor/src/portal/api/localBackend.ts     | 33 +++++++
 .../src/portal/components/AssistantMount.tsx  | 15 ++++
 .../src/portal/components/PortalChrome.tsx    |  6 +-
 .../editor/src/portal/components/Sidebar.tsx  | 48 +++--------
 .../src/portal/components/sidebarGroups.tsx   | 44 ++++++++++
 .../components/sources/AgentBuilderAction.tsx | 22 +++++
 frontend/editor/src/portal/views/Sources.tsx  | 12 +--
 21 files changed, 445 insertions(+), 70 deletions(-)
 create mode 100644 frontend/editor/src/portal-saas/api/localBackend.test.ts
 create mode 100644 frontend/editor/src/portal-saas/api/localBackend.ts
 create mode 100644 frontend/editor/src/portal-saas/components/AssistantMount.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/AssistantMount.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
 create mode 100644 frontend/editor/src/portal-saas/components/sidebarGroups.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
 create mode 100644 frontend/editor/src/portal-saas/views/AgentBuilder.tsx
 create mode 100644 frontend/editor/src/portal-saas/views/Components.tsx
 create mode 100644 frontend/editor/src/portal-saas/views/Infrastructure.test.tsx
 create mode 100644 frontend/editor/src/portal-saas/views/Infrastructure.tsx
 create mode 100644 frontend/editor/src/portal/api/localBackend.ts
 create mode 100644 frontend/editor/src/portal/components/AssistantMount.tsx
 create mode 100644 frontend/editor/src/portal/components/sidebarGroups.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 6c301dac25..7e0ca0116b 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6070,6 +6070,9 @@ dismiss = "Dismiss overlay"
 enforcingTitle = "Enforcing policy..."
 viewAnyway = "View file (policy still enforcing)"
 
+[portal]
+comingSoon = "Coming soon"
+
 [portal.accountLink.card]
 billingNote = "Unattended processing bills against your org wallet."
 eyebrow = "Account link"
diff --git a/frontend/editor/src/portal-saas/api/localBackend.test.ts b/frontend/editor/src/portal-saas/api/localBackend.test.ts
new file mode 100644
index 0000000000..0c7fa21058
--- /dev/null
+++ b/frontend/editor/src/portal-saas/api/localBackend.test.ts
@@ -0,0 +1,32 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const getPortalSaasToken = vi.fn();
+vi.mock("@portal/auth/portalSaasSession", () => ({
+  getPortalSaasToken: () => getPortalSaasToken(),
+}));
+vi.mock("@portal/api/saasApiBase", () => ({
+  saasApiBase: () => "https://saas.example",
+}));
+
+// Resolves to the SaaS override (src/portal-saas) via the @portal cascade.
+import { localBaseUrl, localAuthHeader } from "@portal/api/localBackend";
+
+describe("localBackend (SaaS) — apiClient.local IS the SaaS backend", () => {
+  afterEach(() => getPortalSaasToken.mockReset());
+
+  it("targets the SaaS backend base, not same-origin", () => {
+    expect(localBaseUrl()).toBe("https://saas.example");
+  });
+
+  it("authenticates with the Supabase JWT", async () => {
+    getPortalSaasToken.mockResolvedValue("supabase-jwt");
+    expect(await localAuthHeader()).toEqual({
+      Authorization: "Bearer supabase-jwt",
+    });
+  });
+
+  it("sends no auth header when there is no session", async () => {
+    getPortalSaasToken.mockResolvedValue(null);
+    expect(await localAuthHeader()).toEqual({});
+  });
+});
diff --git a/frontend/editor/src/portal-saas/api/localBackend.ts b/frontend/editor/src/portal-saas/api/localBackend.ts
new file mode 100644
index 0000000000..35671b519a
--- /dev/null
+++ b/frontend/editor/src/portal-saas/api/localBackend.ts
@@ -0,0 +1,22 @@
+import { saasApiBase } from "@portal/api/saasApiBase";
+import { getPortalSaasToken } from "@portal/auth/portalSaasSession";
+
+/**
+ * SaaS build: there is no separate local instance — {@code apiClient.local} IS the
+ * SaaS backend. Route it at the one backend (VITE_API_BASE_URL, via saasApiBase)
+ * with the admin's Supabase JWT, identical to {@code apiClient.saas}. So "local"
+ * and "saas" calls both reach the SaaS backend authenticated; there is no
+ * same-origin + Spring path on SaaS.
+ */
+export function localBaseUrl(): string {
+  return saasApiBase();
+}
+
+export async function localAuthHeader(): Promise<Record<string, string>> {
+  const token = await getPortalSaasToken();
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+
+export function onLocalUnauthorized(): void {
+  // No Spring token on SaaS; PortalAuthBoundary handles Supabase session expiry.
+}
diff --git a/frontend/editor/src/portal-saas/components/AssistantMount.test.tsx b/frontend/editor/src/portal-saas/components/AssistantMount.test.tsx
new file mode 100644
index 0000000000..331c23c219
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/AssistantMount.test.tsx
@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { AssistantMount } from "@portal/components/AssistantMount";
+
+describe("AssistantMount (SaaS)", () => {
+  it("renders nothing — the AI assistant blob is hidden pre-release", () => {
+    const { container } = render(<AssistantMount />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/AssistantMount.tsx b/frontend/editor/src/portal-saas/components/AssistantMount.tsx
new file mode 100644
index 0000000000..87fe740d1d
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/AssistantMount.tsx
@@ -0,0 +1,7 @@
+/**
+ * SaaS pre-release: the AI assistant isn't shipped yet, so the floating blob +
+ * panel are hidden.
+ */
+export function AssistantMount() {
+  return null;
+}
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
new file mode 100644
index 0000000000..892d1b0514
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+// Resolves to the SaaS override (src/portal-saas) via the @portal cascade.
+import {
+  GROUP_PRIMARY,
+  GROUP_OPERATIONAL,
+  GROUP_PLATFORM,
+} from "@portal/components/sidebarGroups";
+
+describe("sidebarGroups (SaaS)", () => {
+  it("drops Components from the operational nav", () => {
+    expect(GROUP_OPERATIONAL.map((e) => e.id)).not.toContain("components");
+  });
+
+  it("inherits the other operational items from base", () => {
+    expect(GROUP_OPERATIONAL.map((e) => e.id)).toEqual([
+      "users",
+      "sources",
+      "policies",
+      "pipelines",
+      "documents",
+    ]);
+  });
+
+  it("inherits the primary + platform groups unchanged", () => {
+    expect(GROUP_PRIMARY.map((e) => e.id)).toEqual(["home"]);
+    expect(GROUP_PLATFORM.map((e) => e.id)).toEqual([
+      "infrastructure",
+      "usage",
+      "docs",
+    ]);
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.tsx b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
new file mode 100644
index 0000000000..1503d6a1e3
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
@@ -0,0 +1,18 @@
+import {
+  GROUP_PRIMARY,
+  GROUP_OPERATIONAL as BASE_OPERATIONAL,
+  GROUP_PLATFORM,
+  type NavEntry,
+} from "@portal-proprietary/components/sidebarGroups";
+
+export { GROUP_PRIMARY, GROUP_PLATFORM };
+export type { NavEntry };
+
+/**
+ * SaaS pre-release: the Components section isn't shipped there yet, so drop it
+ * from the operational nav. Everything else is inherited from the base groups, so
+ * new nav items appear in SaaS automatically — only Components is removed here.
+ */
+export const GROUP_OPERATIONAL: NavEntry[] = BASE_OPERATIONAL.filter(
+  (entry) => entry.id !== "components",
+);
diff --git a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
new file mode 100644
index 0000000000..2dcafa1dcf
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { AgentBuilderAction } from "@portal/components/sources/AgentBuilderAction";
+
+describe("AgentBuilderAction (SaaS)", () => {
+  it("renders nothing — Agent Builder is hidden pre-release", () => {
+    const { container } = render(<AgentBuilderAction />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
new file mode 100644
index 0000000000..0576cf45e9
--- /dev/null
+++ b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
@@ -0,0 +1,7 @@
+/**
+ * SaaS pre-release: Agent Builder isn't shipped yet, so its Sources-header entry
+ * point is hidden.
+ */
+export function AgentBuilderAction() {
+  return null;
+}
diff --git a/frontend/editor/src/portal-saas/views/AgentBuilder.tsx b/frontend/editor/src/portal-saas/views/AgentBuilder.tsx
new file mode 100644
index 0000000000..e6d4dbb15b
--- /dev/null
+++ b/frontend/editor/src/portal-saas/views/AgentBuilder.tsx
@@ -0,0 +1,10 @@
+import { Navigate } from "react-router-dom";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+
+/**
+ * SaaS pre-release: Agent Builder isn't shipped yet and its Sources entry point is
+ * hidden, so redirect any /agent-builder deep link back to Home.
+ */
+export function AgentBuilder() {
+  return <Navigate to={toPortalPath(VIEW_PATHS.home)} replace />;
+}
diff --git a/frontend/editor/src/portal-saas/views/Components.tsx b/frontend/editor/src/portal-saas/views/Components.tsx
new file mode 100644
index 0000000000..4eb700e4cf
--- /dev/null
+++ b/frontend/editor/src/portal-saas/views/Components.tsx
@@ -0,0 +1,10 @@
+import { Navigate } from "react-router-dom";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+
+/**
+ * SaaS pre-release: the Components page isn't shipped yet and its nav item is
+ * hidden, so redirect any /components deep link back to Home.
+ */
+export function Components() {
+  return <Navigate to={toPortalPath(VIEW_PATHS.home)} replace />;
+}
diff --git a/frontend/editor/src/portal-saas/views/Infrastructure.test.tsx b/frontend/editor/src/portal-saas/views/Infrastructure.test.tsx
new file mode 100644
index 0000000000..f884d7e6f4
--- /dev/null
+++ b/frontend/editor/src/portal-saas/views/Infrastructure.test.tsx
@@ -0,0 +1,44 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string, def?: string) => def ?? key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+// Stub the live tab panels so the test doesn't pull their data dependencies.
+vi.mock("@portal/components/infrastructure/ApiKeysTab", () => ({
+  ApiKeysTab: () => <div data-testid="api-keys-tab" />,
+}));
+vi.mock("@portal/components/infrastructure/AuditTab", () => ({
+  AuditTab: () => <div data-testid="audit-tab" />,
+}));
+
+import { Infrastructure } from "@portal/views/Infrastructure";
+
+describe("Infrastructure (SaaS)", () => {
+  it("defaults to the live API keys tab and drops the manage-editor button", () => {
+    render(<Infrastructure />);
+    expect(screen.getByTestId("api-keys-tab")).toBeInTheDocument();
+    expect(
+      screen.queryByText("portal.infrastructure.manageEditorDeployment"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("renders the not-yet-shipped tabs as disabled 'coming soon'", () => {
+    render(<Infrastructure />);
+    for (const tab of ["deployments", "security", "models", "storage"]) {
+      const btn = screen.getByRole("button", {
+        name: new RegExp(`portal.infrastructure.tabs.${tab}`),
+      });
+      expect(btn).toBeDisabled();
+    }
+    // The live tabs are not disabled.
+    expect(
+      screen.getByRole("button", {
+        name: /portal.infrastructure.tabs.apiKeys/,
+      }),
+    ).toBeEnabled();
+  });
+});
diff --git a/frontend/editor/src/portal-saas/views/Infrastructure.tsx b/frontend/editor/src/portal-saas/views/Infrastructure.tsx
new file mode 100644
index 0000000000..f52453e716
--- /dev/null
+++ b/frontend/editor/src/portal-saas/views/Infrastructure.tsx
@@ -0,0 +1,86 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Tabs, type TabItem } from "@app/ui";
+import { ApiKeysTab } from "@portal/components/infrastructure/ApiKeysTab";
+import { AuditTab } from "@portal/components/infrastructure/AuditTab";
+import "@portal/views/Infrastructure.css";
+
+// SaaS pre-release: only API keys + Audit are shipped. Deployments, Security,
+// Models and Storage are shown as disabled "coming soon" tabs (greyed, to the
+// right of the live ones), and the self-hosted-only "Manage editor deployment"
+// header button is dropped. Selection is never one of the coming-soon keys — the
+// Tabs primitive renders them as native-disabled buttons, so onChange can't fire.
+type InfraTab =
+  | "api-keys"
+  | "audit"
+  | "deployments"
+  | "security"
+  | "models"
+  | "storage";
+
+export function Infrastructure() {
+  const { t } = useTranslation();
+  const [tab, setTab] = useState<InfraTab>("api-keys");
+
+  const comingSoon = (labelKey: string) => (
+    <>
+      {t(labelKey)}{" "}
+      <span style={{ opacity: 0.6, fontWeight: 400, fontSize: "0.8em" }}>
+        · {t("portal.comingSoon", "Coming soon")}
+      </span>
+    </>
+  );
+
+  const tabs: TabItem<InfraTab>[] = [
+    { key: "api-keys", label: t("portal.infrastructure.tabs.apiKeys") },
+    { key: "audit", label: t("portal.infrastructure.tabs.audit") },
+    {
+      key: "deployments",
+      label: comingSoon("portal.infrastructure.tabs.deployments"),
+      disabled: true,
+    },
+    {
+      key: "security",
+      label: comingSoon("portal.infrastructure.tabs.security"),
+      disabled: true,
+    },
+    {
+      key: "models",
+      label: comingSoon("portal.infrastructure.tabs.models"),
+      disabled: true,
+    },
+    {
+      key: "storage",
+      label: comingSoon("portal.infrastructure.tabs.storage"),
+      disabled: true,
+    },
+  ];
+
+  return (
+    <div className="portal-infra">
+      <header className="portal-infra__head">
+        <div className="portal-infra__head-text">
+          <h1 className="portal-infra__title">
+            {t("portal.infrastructure.title")}
+          </h1>
+          <p className="portal-infra__sub">
+            {t("portal.infrastructure.subtitle")}
+          </p>
+        </div>
+      </header>
+
+      <Tabs<InfraTab>
+        items={tabs}
+        activeKey={tab}
+        onChange={setTab}
+        variant="underline"
+        ariaLabel={t("portal.infrastructure.sectionsAriaLabel")}
+      />
+
+      <div className="portal-infra__panel">
+        {tab === "api-keys" && <ApiKeysTab />}
+        {tab === "audit" && <AuditTab />}
+      </div>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/api/http.ts b/frontend/editor/src/portal/api/http.ts
index 17bc55a530..ac48cccf08 100644
--- a/frontend/editor/src/portal/api/http.ts
+++ b/frontend/editor/src/portal/api/http.ts
@@ -3,9 +3,11 @@
  *
  * ## Domains
  *
- *   apiClient.local           Same-origin (vite proxy → this instance's local
- *                             Stirling backend on :8080). Spring admin bearer
- *                             (`stirling_jwt` from @app/auth) auto-attached.
+ *   apiClient.local           This instance's backend, via the localBackend seam.
+ *                             Self-hosted: same-origin (vite proxy → local Stirling
+ *                             backend on :8080), Spring admin bearer. SaaS: there is
+ *                             no separate local instance, so it targets the one SaaS
+ *                             backend with the Supabase JWT (same as .saas).
  *                             USE FOR: actions on this instance —
  *                             /api/v1/account-link/{status,link,unlink}, etc.
  *
@@ -39,9 +41,13 @@
  * entitlement calls. It never enters the portal — the browser is the human
  * admin and uses the Supabase JWT for SaaS reads. Don't add it here.
  */
-import { clearStoredToken, getStoredToken } from "@app/auth";
 import { getPortalSaasToken } from "@portal/auth/portalSaasSession";
 import { saasApiBase } from "@portal/api/saasApiBase";
+import {
+  localAuthHeader,
+  localBaseUrl,
+  onLocalUnauthorized,
+} from "@portal/api/localBackend";
 
 /**
  * SaaS base URL via the flavor seam: self-hosted reads VITE_SAAS_API_URL (a
@@ -134,53 +140,49 @@ async function unwrap<T>(res: Response): Promise<T> {
 }
 
 // ────────────────────────────────────────────────────────────────────────────
-// local — same-origin Stirling backend, Spring admin bearer
+// local — this instance's backend, via the localBackend seam (base URL + auth).
+// Self-hosted: same-origin + Spring bearer. SaaS: the SaaS backend + Supabase JWT.
 // ────────────────────────────────────────────────────────────────────────────
 
-function localAuthHeader(): Record<string, string> {
-  const token = getStoredToken();
-  return token ? { Authorization: `Bearer ${token}` } : {};
-}
-
 async function localJson<T>(
   path: string,
   options: HttpRequestOptions = {},
 ): Promise<T> {
-  const res = await fetch(path, {
+  const res = await fetch(`${localBaseUrl()}${path}`, {
     method: options.method ?? "GET",
     headers: {
       Accept: "application/json",
       ...(options.body !== undefined
         ? { "Content-Type": "application/json" }
         : {}),
-      ...localAuthHeader(),
+      ...(await localAuthHeader()),
       ...options.headers,
     },
     body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
     signal: options.signal,
   });
   if (res.status === 401) {
-    // Stale or invalid JWT — clear it so the auth provider re-initialises and
-    // shows the login screen rather than leaving the user stuck with a banner.
-    clearStoredToken();
-    window.dispatchEvent(new CustomEvent("jwt-available"));
+    // Stale/invalid credential — let the flavor decide (self-hosted clears the
+    // Spring token to re-show login; SaaS lets the auth boundary handle it).
+    onLocalUnauthorized();
   }
   return unwrap<T>(res);
 }
 
-/** Same-origin GET returning a binary Blob (e.g. a CSV/JSON export download). */
+/** GET returning a binary Blob (e.g. a CSV/JSON export download), via the
+ * localBackend seam — same base + auth as localJson (SaaS backend + Supabase JWT
+ * on SaaS, same-origin + Spring bearer self-hosted). */
 async function localBlob(
   path: string,
   options: HttpRequestOptions = {},
 ): Promise<Blob> {
-  const res = await fetch(path, {
+  const res = await fetch(`${localBaseUrl()}${path}`, {
     method: options.method ?? "GET",
-    headers: { ...localAuthHeader(), ...options.headers },
+    headers: { ...(await localAuthHeader()), ...options.headers },
     signal: options.signal,
   });
   if (res.status === 401) {
-    clearStoredToken();
-    window.dispatchEvent(new CustomEvent("jwt-available"));
+    onLocalUnauthorized();
   }
   if (!res.ok) throw new HttpError(res.status, res.statusText, null);
   return res.blob();
diff --git a/frontend/editor/src/portal/api/localBackend.ts b/frontend/editor/src/portal/api/localBackend.ts
new file mode 100644
index 0000000000..3716c2562c
--- /dev/null
+++ b/frontend/editor/src/portal/api/localBackend.ts
@@ -0,0 +1,33 @@
+import { clearStoredToken, getStoredToken } from "@app/auth";
+
+/**
+ * Transport config for {@code apiClient.local} — the flavor seam behind "this
+ * instance's backend".
+ *
+ * Self-hosted (this base): same-origin (the local Stirling backend, vite-proxied
+ * to :8080 in dev), authenticated with the Spring admin bearer.
+ *
+ * The SaaS build shadows this file: there is no separate local instance, so
+ * {@code apiClient.local} targets the one SaaS backend (VITE_API_BASE_URL, via
+ * saasApiBase) with the admin's Supabase JWT — the same transport as
+ * {@code apiClient.saas}. There is no same-origin + Spring path in SaaS.
+ */
+export function localBaseUrl(): string {
+  return "";
+}
+
+/** Auth header for apiClient.local — the Spring admin bearer, when present. */
+export async function localAuthHeader(): Promise<Record<string, string>> {
+  const token = getStoredToken();
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+
+/**
+ * Called on a 401 from apiClient.local. Self-hosted: drop the stale Spring token
+ * so the auth provider re-initialises and shows the login screen rather than
+ * leaving the user stuck with a banner.
+ */
+export function onLocalUnauthorized(): void {
+  clearStoredToken();
+  window.dispatchEvent(new CustomEvent("jwt-available"));
+}
diff --git a/frontend/editor/src/portal/components/AssistantMount.tsx b/frontend/editor/src/portal/components/AssistantMount.tsx
new file mode 100644
index 0000000000..97de389c95
--- /dev/null
+++ b/frontend/editor/src/portal/components/AssistantMount.tsx
@@ -0,0 +1,15 @@
+import { AssistantButton } from "@portal/components/AssistantButton";
+import { AssistantPanel } from "@portal/components/AssistantPanel";
+
+/**
+ * Mounts the floating AI assistant (blob button + slide-in panel). A flavor seam:
+ * the SaaS build shadows this with a no-op so the assistant is hidden pre-release.
+ */
+export function AssistantMount() {
+  return (
+    <>
+      <AssistantButton />
+      <AssistantPanel />
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/PortalChrome.tsx b/frontend/editor/src/portal/components/PortalChrome.tsx
index 2066e740d8..f5b524145d 100644
--- a/frontend/editor/src/portal/components/PortalChrome.tsx
+++ b/frontend/editor/src/portal/components/PortalChrome.tsx
@@ -4,8 +4,7 @@ import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 import { ErrorBoundary } from "@portal/components/ErrorBoundary";
 import { useUI } from "@portal/contexts/UIContext";
 import { AppShell } from "@portal/components/AppShell";
-import { AssistantButton } from "@portal/components/AssistantButton";
-import { AssistantPanel } from "@portal/components/AssistantPanel";
+import { AssistantMount } from "@portal/components/AssistantMount";
 import { SearchModal } from "@portal/components/SearchModal";
 import { SettingsModal } from "@portal/components/SettingsModal";
 import { ViewRouter } from "@portal/ViewRouter";
@@ -79,8 +78,7 @@ export function PortalChrome() {
           <RoutedContent />
         </AppShell>
       </ToolRegistryProvider>
-      <AssistantButton />
-      <AssistantPanel />
+      <AssistantMount />
       <SearchModal />
       <SettingsHost />
     </>
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index fed5d7f68e..fdb5a61b03 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -12,43 +12,15 @@ import { fetchHomeKpis, type KpiEntry } from "@portal/api/home";
 import { EDITOR_URL, EDITOR_IS_SAME_APP } from "@portal/auth/editorUrl";
 import markLight from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextLight.svg";
 import markDark from "@app/assets/brand/modern-logo/StirlingPDFLogoNoTextDark.svg";
+import { SettingsIcon } from "@portal/components/icons";
 import {
-  HomeIcon,
-  UsersIcon,
-  SourcesIcon,
-  PoliciesIcon,
-  PipelinesIcon,
-  DocumentsIcon,
-  ComponentsIcon,
-  InfrastructureIcon,
-  UsageIcon,
-  DocsIcon,
-  SettingsIcon,
-} from "@portal/components/icons";
+  GROUP_PRIMARY,
+  GROUP_OPERATIONAL,
+  GROUP_PLATFORM,
+  type NavEntry,
+} from "@portal/components/sidebarGroups";
 import "@portal/components/Sidebar.css";
 
-interface NavEntry {
-  id: ViewId;
-  icon: React.ReactNode;
-}
-
-const GROUP_PRIMARY: NavEntry[] = [{ id: "home", icon: <HomeIcon /> }];
-
-const GROUP_OPERATIONAL: NavEntry[] = [
-  { id: "users", icon: <UsersIcon /> },
-  { id: "sources", icon: <SourcesIcon /> },
-  { id: "policies", icon: <PoliciesIcon /> },
-  { id: "pipelines", icon: <PipelinesIcon /> },
-  { id: "documents", icon: <DocumentsIcon /> },
-  { id: "components", icon: <ComponentsIcon /> },
-];
-
-const GROUP_PLATFORM: NavEntry[] = [
-  { id: "infrastructure", icon: <InfrastructureIcon /> },
-  { id: "usage", icon: <UsageIcon /> },
-  { id: "docs", icon: <DocsIcon /> },
-];
-
 function UsageFooter() {
   const { tier } = useTier();
   const { t } = useTranslation();
@@ -136,7 +108,13 @@ export function Sidebar() {
         label={t(`portal.nav.${entry.id}`)}
         icon={entry.icon}
         isActive={activeView === entry.id}
-        onClick={(id) => setActiveView(id as ViewId)}
+        onClick={(id) => {
+          if (entry.externalUrl) {
+            window.open(entry.externalUrl, "_blank", "noopener,noreferrer");
+          } else {
+            setActiveView(id as ViewId);
+          }
+        }}
       />
     ));
   }
diff --git a/frontend/editor/src/portal/components/sidebarGroups.tsx b/frontend/editor/src/portal/components/sidebarGroups.tsx
new file mode 100644
index 0000000000..71b7539412
--- /dev/null
+++ b/frontend/editor/src/portal/components/sidebarGroups.tsx
@@ -0,0 +1,44 @@
+import { type ReactNode } from "react";
+import { type ViewId } from "@portal/contexts/ViewContext";
+import {
+  HomeIcon,
+  UsersIcon,
+  SourcesIcon,
+  PoliciesIcon,
+  PipelinesIcon,
+  DocumentsIcon,
+  ComponentsIcon,
+  InfrastructureIcon,
+  UsageIcon,
+  DocsIcon,
+} from "@portal/components/icons";
+
+export interface NavEntry {
+  id: ViewId;
+  icon: ReactNode;
+  /** When set, the tab opens this URL in a new tab instead of navigating in-app. */
+  externalUrl?: string;
+}
+
+// Developer docs has no built-in portal page yet, so the tab opens the hosted docs
+// site in a new tab rather than routing to an empty page.
+const DEVELOPER_DOCS_URL = "https://docs.stirlingpdf.com/";
+
+// Sidebar nav groups. This is a flavor seam: the SaaS build shadows this file to
+// drop sections not yet shipped there (see src/portal-saas/components/sidebarGroups).
+export const GROUP_PRIMARY: NavEntry[] = [{ id: "home", icon: <HomeIcon /> }];
+
+export const GROUP_OPERATIONAL: NavEntry[] = [
+  { id: "users", icon: <UsersIcon /> },
+  { id: "sources", icon: <SourcesIcon /> },
+  { id: "policies", icon: <PoliciesIcon /> },
+  { id: "pipelines", icon: <PipelinesIcon /> },
+  { id: "documents", icon: <DocumentsIcon /> },
+  { id: "components", icon: <ComponentsIcon /> },
+];
+
+export const GROUP_PLATFORM: NavEntry[] = [
+  { id: "infrastructure", icon: <InfrastructureIcon /> },
+  { id: "usage", icon: <UsageIcon /> },
+  { id: "docs", icon: <DocsIcon />, externalUrl: DEVELOPER_DOCS_URL },
+];
diff --git a/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx b/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx
new file mode 100644
index 0000000000..5e3885e5fc
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx
@@ -0,0 +1,22 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import { useView } from "@portal/contexts/ViewContext";
+import { AgentBuilderIcon } from "@portal/components/icons";
+
+/**
+ * The "Agent Builder" action in the Sources header. A flavor seam: the SaaS build
+ * shadows this with a no-op (Agent Builder isn't shipped there yet).
+ */
+export function AgentBuilderAction() {
+  const { t } = useTranslation();
+  const { setActiveView } = useView();
+  return (
+    <Button
+      variant="secondary"
+      onClick={() => setActiveView("agent-builder")}
+      leftSection={<AgentBuilderIcon size={16} />}
+    >
+      {t("portal.sources.actions.agentBuilder")}
+    </Button>
+  );
+}
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index a7dd47136a..56ec5b4459 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -2,7 +2,6 @@ import { useCallback, useEffect, useState } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, EmptyState, Modal, Skeleton } from "@app/ui";
-import { useView } from "@portal/contexts/ViewContext";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import { errorMessage } from "@portal/api/http";
 import {
@@ -15,7 +14,7 @@ import {
   type SourcesResponse,
   type SourceView,
 } from "@portal/api/sources";
-import { AgentBuilderIcon } from "@portal/components/icons";
+import { AgentBuilderAction } from "@portal/components/sources/AgentBuilderAction";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
 import { SourcesTable } from "@portal/components/sources/SourcesTable";
 import { SourceDetailCard } from "@portal/components/sources/SourceDetailCard";
@@ -24,7 +23,6 @@ import "@portal/views/Sources.css";
 
 export function Sources() {
   const { t } = useTranslation();
-  const { setActiveView } = useView();
   const [searchParams, setSearchParams] = useSearchParams();
   // Refetch after every mutation by bumping this counter, so the table reflects
   // the in-memory store the handlers maintain (mirrors the Policies view).
@@ -139,13 +137,7 @@ export function Sources() {
           <p className="portal-sources__sub">{t("portal.sources.subtitle")}</p>
         </div>
         <div className="portal-sources__actions">
-          <Button
-            variant="secondary"
-            onClick={() => setActiveView("agent-builder")}
-            leftSection={<AgentBuilderIcon size={16} />}
-          >
-            {t("portal.sources.actions.agentBuilder")}
-          </Button>
+          <AgentBuilderAction />
           <Button onClick={openCreate} leftSection={<span aria-hidden>+</span>}>
             {t("portal.sources.actions.connectSource")}
           </Button>

From b53aaa7d03cc8fb35c2b56fa244c512c8e2b460c Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 8 Jul 2026 20:31:26 +0100
Subject: [PATCH 35/35] Portal procurement: enterprise licence-key mechanism
 (generate at trial, upgrade on subscription, view/download) (#6902)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Builds on the procurement vertical slice (#6861). Adds the **enterprise
licence-key mechanism**: a Keygen licence is generated at trial,
upgraded in place when the committed subscription is created, and is
viewable/downloadable in the portal. Flag-gated — ships with the mock as
default until Keygen env vars are wired.

### What it does
- **Offline / air-gapped licence** is a new **priced add-on** on the
quote ($12k/yr, flat, alongside indemnification / training / QBR).
- **Licence key visible from the trial step** — the portal shows the key
with **Copy**, and (when the offline add-on is bought) a **Download
offline licence (.lic)** button.
- **Real Keygen client, called directly from Java**
(`KeygenEnterpriseLicenseService`), behind `stirling.keygen.enabled`;
`MockEnterpriseLicenseService` stays the default. All creds are env vars
(`STIRLING_KEYGEN_*`) — nothing committed.
- **Provisioning is driven by the Stripe `customer.subscription.created`
event** (source of truth), not a UI action — so a sales-led deal entered
manually in Stripe provisions a licence too. The webhook calls a new
admin `POST /api/v1/procurement/provision`, which upgrades the trial
licence **in place** to the committed annual term, **valid immediately**
(no wait for payment). The deal stays in the payment step so the
outstanding invoice remains visible.
- Offline `.lic` is checked out `base64+ed25519` (signed, unencrypted)
so the self-hosted `KeygenLicenseVerifier` validates it fully offline.

### Not in scope (deliberate, follow-ups)
- Cloud entitlement flip — a **cloud** customer sees/downloads the key
but the running cloud product doesn't unlock yet (self-hosted/air-gap
**are** unlocked by the key). Immediate next PR.
- `invoice.paid → fully-live` / `payment_failed → suspend` webhook
safety-net.

### Companion change (separate repo)
- The Stripe-webhook wiring that calls `/provision` lives in the
**Stirling-PDF-SaaS** repo (committed on `v3`, not part of this PR):
`stripe-webhook` routes enterprise-committed `subscription.created` →
`provisionProcurement()` → the Java admin endpoint.

### Prod setup required
- Create the committed-enterprise **Keygen policy with
`scheme=ed25519`** under the existing account, set
`STIRLING_KEYGEN_ENABLED=true` + account/token/policy env vars.

### Verified
saas `:saas:test` (procurement) · portal typecheck / eslint / prettier ·
82 portal tests · `deno check` on the webhook handler.

### Review follow-ups (PR review, tracked)
Low-hardening fixes applied in `85369633ed`: keep Keygen response bodies
out of thrown/logged messages; fail-fast at startup when the flag is on
but creds are missing; gate the offline `.lic` on the *accepted* quote
(not the latest draft).

Deliberately deferred, tracked here:
- **Pre-flag verification.** Before `stirling.keygen.enabled=true`,
confirm the id-vs-key addressing against live Keygen. (The shipping
self-hosted edge addresses licences by URL-safe key in the path and
Keygen docs allow it, so the client mirrors that — but confirm
empirically with the real committed-enterprise policy.)
- **No auto-revoke on non-payment.** Provision issues an
immediately-valid annual licence before payment settles; `invoice.paid →
live` and `payment_failed → suspend` are out of scope here. Note the
offline `.lic`, once downloaded, verifies offline for the full term and
**can't be revoked** — so the real mitigation for the offline case is a
shorter bridge term until `invoice.paid`, not just wiring `suspend`.
Enterprise is sales-led/ADMIN-gated, so this is a collections concern,
not mass abuse.
---
 .../api/ProcurementController.java            | 107 ++++--
 .../config/KeygenConfigurationProperties.java |  55 ++++
 .../license/EnterpriseLicenseService.java     |  30 +-
 .../KeygenEnterpriseLicenseService.java       | 304 ++++++++++++++++++
 .../license/LicenseEntitlements.java          |  21 ++
 .../license/MockEnterpriseLicenseService.java |  41 ++-
 .../procurement/model/ProcurementQuote.java   |   7 +
 .../procurement/pricing/PricingRates.java     |  61 ++--
 .../pricing/ProcurementPricingService.java    | 155 ++++++---
 .../saas/procurement/pricing/QuoteConfig.java |  12 +-
 .../service/ProcurementService.java           | 132 ++++++--
 .../resources/application-saas.properties     |   9 +
 .../saas/V30__procurement_offline_license.sql |   6 +
 .../saas/V31__procurement_intensity.sql       |   6 +
 .../ProcurementPricingServiceTest.java        | 142 +++++---
 .../public/locales/en-US/translation.toml     |  12 +-
 frontend/editor/src/portal/api/http.ts        |  26 ++
 frontend/editor/src/portal/api/procurement.ts |  12 +
 .../procurement/DealStatusHero.stories.tsx    |   1 +
 .../procurement/ProcurementFlow.tsx           |  12 +
 .../procurement/ProcurementStages.tsx         |  55 ++++
 .../components/procurement/QuoteBuilder.tsx   |  16 +-
 .../components/procurement/useProcurement.ts  |  27 ++
 .../portal/mocks/handlers/procurementSaas.ts  |  25 +-
 .../editor/src/portal/views/Procurement.css   |  31 ++
 25 files changed, 1121 insertions(+), 184 deletions(-)
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/config/KeygenConfigurationProperties.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/license/KeygenEnterpriseLicenseService.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/procurement/license/LicenseEntitlements.java
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql

diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java b/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
index 1f27896b87..f92267da33 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/api/ProcurementController.java
@@ -2,9 +2,12 @@ package stirling.software.saas.procurement.api;
 
 import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
 
 import org.springframework.context.annotation.Profile;
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
@@ -12,6 +15,7 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -72,24 +76,28 @@ public class ProcurementController {
     public record QuoteRequest(
             long volume,
             int users,
+            int intensity, // policy posture (runs/PDF): 2 / 4 / 7; 0 → default Governed
             String deployment,
             int termYears,
             String serviceLevel,
             boolean indemnification,
             boolean training,
             boolean qbr,
+            boolean offlineLicense,
             String currency,
             String businessName) {
         QuoteConfig toConfig() {
             return new QuoteConfig(
                     volume,
                     users,
+                    intensity,
                     deployment,
                     termYears,
                     serviceLevel,
                     indemnification,
                     training,
                     qbr,
+                    offlineLicense,
                     currency);
         }
     }
@@ -115,12 +123,14 @@ public class ProcurementController {
     public record QuoteConfigEcho(
             long volume,
             int users,
+            int intensity,
             String deployment,
             int termYears,
             String serviceLevel,
             boolean indemnification,
             boolean training,
             boolean qbr,
+            boolean offlineLicense,
             String currency,
             String businessName) {}
 
@@ -131,6 +141,7 @@ public class ProcurementController {
             String trialEndsAt,
             int trialExtensionsUsed,
             boolean licensed,
+            String licenseKey,
             QuoteResponse latestQuote) {}
 
     // ---- endpoints ----------------------------------------------------------
@@ -143,21 +154,49 @@ public class ProcurementController {
     @GetMapping
     @PreAuthorize("isAuthenticated()")
     public ResponseEntity<SnapshotResponse> snapshot(Authentication auth) {
-        Long teamId = resolveTeam(auth);
-        if (teamId == null) return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        Optional<TeamMembership> membership = primaryMembership(auth);
+        if (membership.isEmpty()) return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
+        Long teamId = membership.get().getTeam().getId();
+        // The licence key is the team's secret entitlement — leader-only. Members still see the
+        // journey (stage, trial, quote) but the key is withheld; the .lic file is likewise gated.
+        boolean leader = membership.get().getRole() == TeamRole.LEADER;
         return ResponseEntity.ok(
-                procurement.getDeal(teamId).map(this::toSnapshot).orElse(EMPTY_SNAPSHOT));
+                procurement.getDeal(teamId).map(d -> toSnapshot(d, leader)).orElse(EMPTY_SNAPSHOT));
     }
 
     private static final SnapshotResponse EMPTY_SNAPSHOT =
-            new SnapshotResponse(null, null, null, null, 0, false, null);
+            new SnapshotResponse(null, null, null, null, 0, false, null, null);
+
+    /**
+     * Download the offline / air-gapped licence file (.lic) for the team, when the paid offline
+     * add-on was purchased. 404 when there's no licence or the add-on wasn't taken — we don't leak
+     * that a licence exists to a team without the add-on.
+     */
+    @GetMapping("/license/file")
+    @PreAuthorize("isAuthenticated()")
+    public ResponseEntity<String> licenseFile(Authentication auth) {
+        // Leader-only: the offline .lic is the team's portable entitlement, not a member artefact.
+        Long teamId = requireLeader(auth);
+        if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        return procurement
+                .offlineLicenseFile(teamId)
+                .<ResponseEntity<String>>map(
+                        cert ->
+                                ResponseEntity.ok()
+                                        .header(
+                                                HttpHeaders.CONTENT_DISPOSITION,
+                                                "attachment; filename=\"stirling-enterprise.lic\"")
+                                        .contentType(MediaType.TEXT_PLAIN)
+                                        .body(cert))
+                .orElseGet(() -> ResponseEntity.notFound().build());
+    }
 
     @PostMapping("/trial/start")
     @PreAuthorize("isAuthenticated()")
     public ResponseEntity<SnapshotResponse> startTrial(Authentication auth) {
         Long teamId = requireLeader(auth);
         if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        return ResponseEntity.ok(toSnapshot(procurement.startTrial(teamId)));
+        return ResponseEntity.ok(toSnapshot(procurement.startTrial(teamId), true));
     }
 
     @PostMapping("/trial/extend")
@@ -166,7 +205,7 @@ public class ProcurementController {
         Long teamId = requireLeader(auth);
         if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
         try {
-            return ResponseEntity.ok(toSnapshot(procurement.extendTrial(teamId)));
+            return ResponseEntity.ok(toSnapshot(procurement.extendTrial(teamId), true));
         } catch (IllegalStateException e) {
             return ResponseEntity.status(HttpStatus.CONFLICT).build();
         }
@@ -197,12 +236,30 @@ public class ProcurementController {
         Long teamId = requireLeader(auth);
         if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
         try {
-            return ResponseEntity.ok(toSnapshot(procurement.startAgreement(teamId)));
+            return ResponseEntity.ok(toSnapshot(procurement.startAgreement(teamId), true));
         } catch (IllegalStateException e) {
             return ResponseEntity.status(HttpStatus.CONFLICT).build();
         }
     }
 
+    /**
+     * Provision on accept: upgrade the team's licence to the committed annual term, valid
+     * immediately. Called server-side by the accept edge function (ROLE_ADMIN via X-API-Key) once
+     * the subscription + invoice exist, so the buyer is licensed the moment they accept — the deal
+     * stays in the payment step until the invoice settles. Idempotent.
+     */
+    @PostMapping("/provision")
+    @PreAuthorize("hasRole('ADMIN')")
+    public ResponseEntity<Void> provision(@RequestParam("teamId") long teamId) {
+        try {
+            procurement.provisionLicense(teamId);
+            return ResponseEntity.ok().build();
+        } catch (IllegalStateException e) {
+            log.warn("[procurement] provision rejected team={}: {}", teamId, e.getMessage());
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        }
+    }
+
     /**
      * Demo/manual stand-in for the {@code invoice.paid} webhook: mark the deal live (issue the
      * annual licence, advance to active). The real go-live is webhook-driven once payment settles.
@@ -214,7 +271,7 @@ public class ProcurementController {
         Long teamId = requireLeader(auth);
         if (teamId == null) return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
         try {
-            return ResponseEntity.ok(toSnapshot(procurement.markLive(teamId)));
+            return ResponseEntity.ok(toSnapshot(procurement.markLive(teamId), true));
         } catch (IllegalStateException e) {
             return ResponseEntity.status(HttpStatus.CONFLICT).build();
         }
@@ -233,34 +290,31 @@ public class ProcurementController {
 
     // ---- helpers ------------------------------------------------------------
 
-    /**
-     * Resolve the caller's team from their primary membership; null when unauthenticated/teamless.
-     */
-    private Long resolveTeam(Authentication auth) {
+    /** The caller's primary team membership; empty when unauthenticated/teamless. */
+    private Optional<TeamMembership> primaryMembership(Authentication auth) {
         User user;
         try {
             user = AuthenticationUtils.getCurrentUser(auth, userRepository);
         } catch (SecurityException e) {
-            return null;
+            return Optional.empty();
         }
-        List<TeamMembership> rows = memberRepo.findPrimaryMembership(user.getId());
-        return rows.isEmpty() ? null : rows.get(0).getTeam().getId();
+        return memberRepo.findPrimaryMembership(user.getId()).stream().findFirst();
     }
 
     /** Team id only when the caller is the team leader; null otherwise (commercial actions). */
     private Long requireLeader(Authentication auth) {
-        User user;
-        try {
-            user = AuthenticationUtils.getCurrentUser(auth, userRepository);
-        } catch (SecurityException e) {
-            return null;
-        }
-        List<TeamMembership> rows = memberRepo.findPrimaryMembership(user.getId());
-        if (rows.isEmpty() || rows.get(0).getRole() != TeamRole.LEADER) return null;
-        return rows.get(0).getTeam().getId();
+        return primaryMembership(auth)
+                .filter(m -> m.getRole() == TeamRole.LEADER)
+                .map(m -> m.getTeam().getId())
+                .orElse(null);
     }
 
-    private SnapshotResponse toSnapshot(ProcurementDeal deal) {
+    /**
+     * Build the snapshot for a deal. {@code includeLicenseKey} is true only for the team leader; a
+     * member sees {@code licensed} but not the key itself (see {@link #snapshot}). Mutation
+     * endpoints are leader-gated, so they always pass true.
+     */
+    private SnapshotResponse toSnapshot(ProcurementDeal deal, boolean includeLicenseKey) {
         QuoteResponse latest =
                 procurement.quotesForDeal(deal.getDealId()).stream()
                         .findFirst()
@@ -273,6 +327,7 @@ public class ProcurementController {
                 str(deal.getTrialEndsAt()),
                 deal.getTrialExtensionsUsed(),
                 deal.getLicenseRef() != null,
+                includeLicenseKey ? deal.getLicenseRef() : null,
                 latest);
     }
 
@@ -291,12 +346,14 @@ public class ProcurementController {
                 new QuoteConfigEcho(
                         q.getVolume(),
                         0,
+                        q.getIntensity(),
                         q.getDeployment(),
                         q.getTermYears(),
                         q.getServiceLevel(),
                         q.isIndemnification(),
                         q.isTraining(),
                         q.isQbr(),
+                        q.isOfflineLicense(),
                         q.getCurrency(),
                         q.getBusinessName()));
     }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/config/KeygenConfigurationProperties.java b/app/saas/src/main/java/stirling/software/saas/procurement/config/KeygenConfigurationProperties.java
new file mode 100644
index 0000000000..40ee2ba2c3
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/config/KeygenConfigurationProperties.java
@@ -0,0 +1,55 @@
+package stirling.software.saas.procurement.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * Keygen credentials + policy for issuing enterprise procurement licences directly from Java.
+ * Prefix {@code stirling.keygen}. All secrets come from the environment (relaxed binding: {@code
+ * STIRLING_KEYGEN_ACCOUNT_ID}, {@code STIRLING_KEYGEN_API_TOKEN}, …) — never committed.
+ *
+ * <p>{@code enabled} is the switch between {@code MockEnterpriseLicenseService} (default) and the
+ * real {@code KeygenEnterpriseLicenseService}; the mock stays in place until the env vars are
+ * wired.
+ */
+@Getter
+@Setter
+@Component
+@Profile("saas")
+@ConfigurationProperties(prefix = "stirling.keygen")
+public class KeygenConfigurationProperties {
+
+    /** Master switch: when true, the real Keygen client replaces the mock licence service. */
+    private boolean enabled = false;
+
+    /** Keygen account id (UUID or slug). From {@code STIRLING_KEYGEN_ACCOUNT_ID}. */
+    private String accountId;
+
+    /** Keygen admin API token. From {@code STIRLING_KEYGEN_API_TOKEN}. Never log this. */
+    private String apiToken;
+
+    /** Policy the committed-enterprise licences are created under. From {@code ..._POLICY_ID}. */
+    private String policyId;
+
+    /** API base; overridable for self-hosted Keygen, defaults to the hosted service. */
+    private String apiBase = "https://api.keygen.sh/v1";
+
+    /**
+     * License-file check-out algorithm. Must stay {@code base64+ed25519} — the self-hosted {@code
+     * KeygenLicenseVerifier} only verifies that scheme (signed, unencrypted) offline.
+     */
+    private String licenseFileAlgorithm = "base64+ed25519";
+
+    /** True when the credentials needed to talk to Keygen are all present. */
+    public boolean isConfigured() {
+        return notBlank(accountId) && notBlank(apiToken) && notBlank(policyId);
+    }
+
+    private static boolean notBlank(String s) {
+        return s != null && !s.isBlank();
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
index 0f0c242601..0c3d547d4c 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/EnterpriseLicenseService.java
@@ -11,15 +11,37 @@ import java.time.LocalDateTime;
  */
 public interface EnterpriseLicenseService {
 
-    /** Issue a time-boxed trial licence for the team; returns the licence reference. */
-    String issueTrialLicense(Long teamId, LocalDateTime expiresAt);
+    /**
+     * Issue a time-boxed trial licence for the team, owned by {@code ownerEmail} (the team leader);
+     * returns the licence reference (the Keygen key, stored on the deal).
+     */
+    String issueTrialLicense(Long teamId, String ownerEmail, LocalDateTime expiresAt);
 
     /** Move a licence's expiry out (trial extension). */
     void extendLicense(String licenseRef, LocalDateTime newExpiry);
 
-    /** Issue/upgrade to a committed annual licence with the quote's entitlements. */
-    String issueAnnualLicense(Long teamId, String deployment, LocalDateTime expiresAt);
+    /**
+     * Issue/upgrade to a committed annual licence carrying the deal's {@link LicenseEntitlements}
+     * ({@code seats} = 0 means unlimited). When {@code existingRef} is non-null (the team already
+     * has a trial licence), that licence is upgraded in place so the key the buyer already holds
+     * keeps working; otherwise a new licence is created. Owned by {@code ownerEmail}; returns the
+     * licence reference.
+     */
+    String issueAnnualLicense(
+            Long teamId,
+            String ownerEmail,
+            LocalDateTime expiresAt,
+            String existingRef,
+            LicenseEntitlements entitlements);
 
     /** Suspend a licence (e.g. payment failed, deal lost). */
     void suspendLicense(String licenseRef);
+
+    /**
+     * Check out a signed, offline-verifiable licence file (a {@code -----BEGIN LICENSE FILE-----}
+     * certificate) for the given licence, for an air-gapped self-hosted instance. The paid offline
+     * add-on gates whether this is offered; the certificate itself is generated on demand and never
+     * stored.
+     */
+    String checkOutLicenseFile(String licenseRef);
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/KeygenEnterpriseLicenseService.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/KeygenEnterpriseLicenseService.java
new file mode 100644
index 0000000000..a11ad05755
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/KeygenEnterpriseLicenseService.java
@@ -0,0 +1,304 @@
+package stirling.software.saas.procurement.license;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.saas.procurement.config.KeygenConfigurationProperties;
+
+/**
+ * Real {@link EnterpriseLicenseService}: manages the team's enterprise licence directly against the
+ * Keygen API (the "call Keygen from Java" direction), rather than via the Supabase edge functions
+ * the self-hosted checkout uses. Active only when {@code stirling.keygen.enabled=true}; otherwise
+ * {@link MockEnterpriseLicenseService} is the bean.
+ *
+ * <p>Licences are owned by the team leader (a Keygen user, found or created by email) and created
+ * under the committed-enterprise policy. Metadata carries {@code isEnterprise} + {@code users} so a
+ * checked-out offline licence file satisfies the self-hosted {@code KeygenLicenseVerifier}. The
+ * licence key returned is stored on the deal as its {@code license_ref}.
+ */
+@Slf4j
+@Service
+@Profile("saas")
+@ConditionalOnProperty(name = "stirling.keygen.enabled", havingValue = "true")
+public class KeygenEnterpriseLicenseService implements EnterpriseLicenseService {
+
+    private static final String VND_JSON = "application/vnd.api+json";
+
+    private final ObjectMapper mapper = new ObjectMapper();
+    private final HttpClient http =
+            HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).build();
+    private final KeygenConfigurationProperties config;
+
+    public KeygenEnterpriseLicenseService(KeygenConfigurationProperties config) {
+        this.config = config;
+        // Fail fast: if the flag is on but creds are missing, a misconfigured prod deploy should be
+        // caught at startup, not at the first trial/provision. (Flag off → Mock bean, never here.)
+        if (!config.isConfigured()) {
+            throw new IllegalStateException(
+                    "stirling.keygen.enabled=true but Keygen is not fully configured — set "
+                            + "STIRLING_KEYGEN_ACCOUNT_ID / _API_TOKEN / _POLICY_ID, or turn the flag off");
+        }
+    }
+
+    @Override
+    public String issueTrialLicense(Long teamId, String ownerEmail, LocalDateTime expiresAt) {
+        String ownerId = findOrCreateUser(ownerEmail);
+        // Trial: enterprise entitlement, unlimited users, expiring at the trial end. No committed
+        // volume/add-ons yet — those are stamped on the annual licence at provision.
+        return createLicense(ownerId, expiresAt, trialMetadata(teamId));
+    }
+
+    @Override
+    public void extendLicense(String licenseRef, LocalDateTime newExpiry) {
+        Map<String, Object> attrs = new LinkedHashMap<>();
+        attrs.put("expiry", iso(newExpiry));
+        patchLicense(licenseRef, attrs);
+    }
+
+    @Override
+    public String issueAnnualLicense(
+            Long teamId,
+            String ownerEmail,
+            LocalDateTime expiresAt,
+            String existingRef,
+            LicenseEntitlements ent) {
+        Map<String, Object> metadata = annualMetadata(teamId, ent);
+        // Upgrade the trial licence in place so the key the buyer already holds keeps working.
+        if (existingRef != null && !existingRef.isBlank()) {
+            Map<String, Object> attrs = new LinkedHashMap<>();
+            attrs.put("expiry", iso(expiresAt));
+            attrs.put("suspended", false);
+            attrs.put("metadata", metadata);
+            patchLicense(existingRef, attrs);
+            return existingRef;
+        }
+        String ownerId = findOrCreateUser(ownerEmail);
+        return createLicense(ownerId, expiresAt, metadata);
+    }
+
+    @Override
+    public void suspendLicense(String licenseRef) {
+        HttpResponse<String> res =
+                send(
+                        authed(licenseUrl(licenseRef) + "/actions/suspend")
+                                .POST(HttpRequest.BodyPublishers.noBody())
+                                .build());
+        expect(res, 200, "suspend licence");
+    }
+
+    @Override
+    public String checkOutLicenseFile(String licenseRef) {
+        // Signed, unencrypted (base64+ed25519) so the self-hosted verifier can validate it offline;
+        // include entitlements in the snapshot. Never encrypt — the verifier only reads
+        // base64+ed25519.
+        String url =
+                licenseUrl(licenseRef)
+                        + "/actions/check-out?include=entitlements&algorithm="
+                        + enc(config.getLicenseFileAlgorithm());
+        HttpResponse<String> res =
+                send(authed(url).POST(HttpRequest.BodyPublishers.noBody()).build());
+        expect(res, 200, "check-out licence file");
+        JsonNode cert = readJson(res).at("/data/attributes/certificate");
+        if (cert.isMissingNode() || cert.asText().isBlank()) {
+            throw new IllegalStateException("Keygen check-out returned no certificate");
+        }
+        return cert.asText();
+    }
+
+    // ---- Keygen primitives --------------------------------------------------
+
+    /** Find the Keygen user by email, creating it if absent; returns the user id. */
+    private String findOrCreateUser(String email) {
+        if (email == null || email.isBlank()) {
+            throw new IllegalArgumentException("Cannot own a licence without an owner email");
+        }
+        HttpResponse<String> find =
+                send(authed(accountUrl() + "/users/" + enc(email)).GET().build());
+        if (find.statusCode() == 200) {
+            return readJson(find).at("/data/id").asText();
+        }
+        if (find.statusCode() != 404) {
+            expect(find, 200, "find Keygen user"); // throws with the real status
+        }
+        Map<String, Object> body =
+                jsonApi("users", Map.of("email", email), null); // no relationships
+        HttpResponse<String> create =
+                send(
+                        authed(accountUrl() + "/users")
+                                .POST(HttpRequest.BodyPublishers.ofString(write(body)))
+                                .build());
+        expect(create, 201, "create Keygen user");
+        return readJson(create).at("/data/id").asText();
+    }
+
+    private String createLicense(
+            String ownerId, LocalDateTime expiresAt, Map<String, Object> metadata) {
+        Map<String, Object> attributes = new LinkedHashMap<>();
+        attributes.put("expiry", iso(expiresAt));
+        attributes.put("metadata", metadata);
+        Map<String, Object> relationships =
+                Map.of(
+                        "policy",
+                        Map.of("data", Map.of("type", "policies", "id", config.getPolicyId())),
+                        "owner",
+                        Map.of("data", Map.of("type", "users", "id", ownerId)));
+        Map<String, Object> body = jsonApi("licenses", attributes, relationships);
+        HttpResponse<String> res =
+                send(
+                        authed(accountUrl() + "/licenses")
+                                .POST(HttpRequest.BodyPublishers.ofString(write(body)))
+                                .build());
+        expect(res, 201, "create licence");
+        return readJson(res).at("/data/attributes/key").asText();
+    }
+
+    private void patchLicense(String licenseRef, Map<String, Object> attributes) {
+        Map<String, Object> body = jsonApi("licenses", attributes, null);
+        HttpResponse<String> res =
+                send(
+                        authed(licenseUrl(licenseRef))
+                                .method("PATCH", HttpRequest.BodyPublishers.ofString(write(body)))
+                                .build());
+        expect(res, 200, "update licence");
+    }
+
+    // ---- helpers ------------------------------------------------------------
+
+    // The self-hosted verifier only reads isEnterprise + users; everything else is informational
+    // (dashboard / reconciliation) but kept so the licence is a self-describing record of the deal.
+
+    /** Trial licence: enterprise, unlimited users, no committed volume/add-ons yet. */
+    private Map<String, Object> trialMetadata(Long teamId) {
+        Map<String, Object> m = baseMetadata(teamId, true);
+        m.put("users", 0); // 0 = unlimited during the trial
+        m.put("seat_count", 0);
+        return m;
+    }
+
+    /** Committed annual licence: the full entitlement snapshot from the accepted quote + deal. */
+    private Map<String, Object> annualMetadata(Long teamId, LicenseEntitlements ent) {
+        Map<String, Object> m = baseMetadata(teamId, false);
+        int seats = Math.max(0, ent.seats());
+        m.put("users", seats); // 0 = unlimited
+        m.put("seat_count", seats); // parity with the self-hosted edge's metadata
+        m.put("volume", ent.volume()); // committed PDFs / year
+        m.put("term_years", ent.termYears());
+        if (ent.serviceLevel() != null && !ent.serviceLevel().isBlank()) {
+            m.put("service_level", ent.serviceLevel());
+        }
+        m.put("indemnification", ent.indemnification());
+        m.put("training", ent.training());
+        m.put("qbr", ent.qbr());
+        m.put("offline_license", ent.offlineLicense());
+        if (ent.deployment() != null && !ent.deployment().isBlank()) {
+            m.put("deployment", ent.deployment());
+        }
+        if (ent.dealId() != null) m.put("deal_id", ent.dealId());
+        if (ent.subscriptionId() != null && !ent.subscriptionId().isBlank()) {
+            m.put("subscription_id", ent.subscriptionId());
+        }
+        return m;
+    }
+
+    private Map<String, Object> baseMetadata(Long teamId, boolean trial) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("team_id", teamId);
+        m.put("plan_type", "enterprise");
+        m.put("isEnterprise", true);
+        m.put("trial", trial);
+        return m;
+    }
+
+    private Map<String, Object> jsonApi(
+            String type, Map<String, Object> attributes, Map<String, Object> relationships) {
+        Map<String, Object> data = new LinkedHashMap<>();
+        data.put("type", type);
+        data.put("attributes", attributes);
+        if (relationships != null) data.put("relationships", relationships);
+        return Map.of("data", data);
+    }
+
+    private HttpRequest.Builder authed(String url) {
+        return HttpRequest.newBuilder()
+                .uri(URI.create(url))
+                .header("Authorization", "Bearer " + config.getApiToken())
+                .header("Content-Type", VND_JSON)
+                .header("Accept", VND_JSON)
+                .timeout(Duration.ofSeconds(30));
+    }
+
+    private HttpResponse<String> send(HttpRequest request) {
+        try {
+            return http.send(request, HttpResponse.BodyHandlers.ofString());
+        } catch (java.io.IOException e) {
+            throw new IllegalStateException("Keygen request failed: " + e.getMessage(), e);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("Keygen request interrupted", e);
+        }
+    }
+
+    private void expect(HttpResponse<String> res, int status, String action) {
+        if (res.statusCode() != status) {
+            // Keep the response body out of the thrown message: it never carries the token, but can
+            // echo owner emails / metadata, and the message reaches warn-level logs. Body at debug.
+            log.debug(
+                    "[procurement][keygen] {} failed: HTTP {} body={}",
+                    action,
+                    res.statusCode(),
+                    res.body());
+            throw new IllegalStateException(
+                    "Keygen " + action + " failed: HTTP " + res.statusCode());
+        }
+    }
+
+    private JsonNode readJson(HttpResponse<String> res) {
+        try {
+            return mapper.readTree(res.body());
+        } catch (Exception e) {
+            throw new IllegalStateException("Keygen returned unparseable JSON", e);
+        }
+    }
+
+    private String write(Map<String, Object> body) {
+        try {
+            return mapper.writeValueAsString(body);
+        } catch (Exception e) {
+            throw new IllegalStateException("Failed to serialise Keygen request", e);
+        }
+    }
+
+    private String accountUrl() {
+        return config.getApiBase() + "/accounts/" + config.getAccountId();
+    }
+
+    private String licenseUrl(String licenseRef) {
+        return accountUrl() + "/licenses/" + enc(licenseRef);
+    }
+
+    private static String enc(String s) {
+        return URLEncoder.encode(s, StandardCharsets.UTF_8);
+    }
+
+    private static String iso(LocalDateTime dt) {
+        return dt.toInstant(ZoneOffset.UTC).toString();
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/LicenseEntitlements.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/LicenseEntitlements.java
new file mode 100644
index 0000000000..0b7a0be6c9
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/LicenseEntitlements.java
@@ -0,0 +1,21 @@
+package stirling.software.saas.procurement.license;
+
+/**
+ * The committed deal's entitlements, stamped onto the annual Keygen licence's metadata so the
+ * licence is a self-describing record of what was bought. Only {@code seats} (as {@code users}) and
+ * the enterprise flag are read by the self-hosted verifier; the rest is informational — kept "for
+ * good measure" so the Keygen dashboard and any downstream reconciliation can see the full picture.
+ * Built by {@code ProcurementService} from the accepted quote + deal.
+ */
+public record LicenseEntitlements(
+        long volume, // committed PDFs / year
+        int seats, // 0 = unlimited
+        String deployment, // cloud | selfhost | airgap
+        int termYears,
+        String serviceLevel, // standard | priority | dedicated
+        boolean indemnification,
+        boolean training,
+        boolean qbr,
+        boolean offlineLicense,
+        Long dealId,
+        String subscriptionId) {}
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java b/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
index bde31a4119..511d67cd08 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/license/MockEnterpriseLicenseService.java
@@ -3,6 +3,7 @@ package stirling.software.saas.procurement.license;
 import java.time.LocalDateTime;
 import java.util.UUID;
 
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Profile;
 import org.springframework.stereotype.Service;
 
@@ -13,15 +14,23 @@ import lombok.extern.slf4j.Slf4j;
  * returns a synthetic reference, without calling Keygen. Lets the whole procurement journey run
  * end-to-end while the real Keygen management client is a later drop-in — the seam and the stored
  * {@code license_ref} on the deal stay identical.
+ *
+ * <p>This is the default; it steps aside for {@code KeygenEnterpriseLicenseService} when {@code
+ * stirling.keygen.enabled=true} (real Keygen secrets are wired).
  */
 @Slf4j
 @Service
 @Profile("saas")
+@ConditionalOnProperty(
+        name = "stirling.keygen.enabled",
+        havingValue = "false",
+        matchIfMissing = true)
 public class MockEnterpriseLicenseService implements EnterpriseLicenseService {
 
     @Override
-    public String issueTrialLicense(Long teamId, LocalDateTime expiresAt) {
+    public String issueTrialLicense(Long teamId, String ownerEmail, LocalDateTime expiresAt) {
         String ref = "mock-trial-" + UUID.randomUUID();
+        // Owner email is deliberately not logged — it's PII and adds nothing to the mock trace.
         log.info(
                 "[procurement][mock-license] issue trial team={} expires={} ref={}",
                 teamId,
@@ -36,14 +45,24 @@ public class MockEnterpriseLicenseService implements EnterpriseLicenseService {
     }
 
     @Override
-    public String issueAnnualLicense(Long teamId, String deployment, LocalDateTime expiresAt) {
-        String ref = "mock-annual-" + UUID.randomUUID();
+    public String issueAnnualLicense(
+            Long teamId,
+            String ownerEmail,
+            LocalDateTime expiresAt,
+            String existingRef,
+            LicenseEntitlements ent) {
+        // Upgrade in place when a trial licence already exists, so the key stays stable.
+        String ref = existingRef != null ? existingRef : "mock-annual-" + UUID.randomUUID();
+        // Owner email is deliberately not logged — it's PII and adds nothing to the mock trace.
         log.info(
-                "[procurement][mock-license] issue annual team={} deployment={} expires={} ref={}",
+                "[procurement][mock-license] issue annual team={} seats={} volume={} deployment={} expires={} ref={} upgrade={}",
                 teamId,
-                deployment,
+                ent.seats(),
+                ent.volume(),
+                ent.deployment(),
                 expiresAt,
-                ref);
+                ref,
+                existingRef != null);
         return ref;
     }
 
@@ -51,4 +70,14 @@ public class MockEnterpriseLicenseService implements EnterpriseLicenseService {
     public void suspendLicense(String licenseRef) {
         log.info("[procurement][mock-license] suspend ref={}", licenseRef);
     }
+
+    @Override
+    public String checkOutLicenseFile(String licenseRef) {
+        log.info("[procurement][mock-license] check-out licence file ref={}", licenseRef);
+        // A syntactically shaped stand-in so the portal download path is exercisable without
+        // Keygen; not a valid certificate.
+        return "-----BEGIN LICENSE FILE-----\nmock-offline-license-for-"
+                + licenseRef
+                + "\n-----END LICENSE FILE-----\n";
+    }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
index d8f4c3edb7..dd635a2cf6 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/model/ProcurementQuote.java
@@ -62,6 +62,10 @@ public class ProcurementQuote implements Serializable {
     @Column(name = "seats")
     private Integer seats;
 
+    /** Policy posture as runs-per-PDF: Essentials 2, Governed 4, Regulated 7. Defaults Governed. */
+    @Column(name = "intensity", nullable = false)
+    private int intensity = 4;
+
     @Column(name = "deployment", length = 24)
     private String deployment;
 
@@ -80,6 +84,9 @@ public class ProcurementQuote implements Serializable {
     @Column(name = "qbr", nullable = false)
     private boolean qbr;
 
+    @Column(name = "offline_license", nullable = false)
+    private boolean offlineLicense;
+
     @Column(name = "annual_net_minor", nullable = false)
     private long annualNetMinor;
 
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
index 19a3ab759d..d10f216e8a 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/PricingRates.java
@@ -1,53 +1,44 @@
 package stirling.software.saas.procurement.pricing;
 
 /**
- * The enterprise rate card: the inputs pricing multiplies against. In production these are read
- * from the Stripe price mirror (see {@code StripeMirrorPriceCatalog}); {@link #defaults()} is the
- * fallback used when the {@code stripe} schema isn't synced (dev / tests) and is the single source
- * of the numbers the marketing prototype encodes.
+ * The enterprise rate card (D71): the inputs pricing derives a quote from. In production these are
+ * read from the Stripe price mirror; {@link #defaults()} is the fallback used when the {@code
+ * stripe} schema isn't synced (dev / tests) and is the single source of the numbers the marketing
+ * prototype ({@code quotePricing}) encodes.
  *
- * <p>Per-PDF rates are in minor units (cents) per document. Multipliers are fractions (e.g. 0.15 =
- * +15%). Flat/one-time fees are in minor units.
+ * <p>The meter is denominated in <b>runs</b> (a PDF running N policies is N runs). The per-run rate
+ * is a fraction of a dollar, so it lives here as a {@code double} in dollars; flat and one-time
+ * fees are whole-dollar amounts held in minor units (cents). See {@link ProcurementPricingService}
+ * for how they combine.
  */
 public record PricingRates(
-        long perPdfMinorUnder1M,
-        long perPdfMinorUnder5M,
-        long perPdfMinor5MPlus,
-        double priorityUplift,
-        double dedicatedUplift,
-        double indemnificationUplift,
-        double[] termDiscountByYear, // index 0 = 1yr … index 4 = 5yr
-        long qbrAnnualMinor,
-        long trainingOneTimeMinor) {
+        double listRatePerRun, // $0.01 list per run
+        double floorRatePerRun, // $0.005 asymptotic floor (cost + margin)
+        double discountPerDoubling, // 0.06 = 6% off the per-run rate per doubling past 1M runs/yr
+        double[] termDiscountByYear, // meter-only discount; index 0 = 1yr … index 4 = 5yr
+        double indemnificationRate, // fraction of the net meter (legal exposure scales with usage)
+        long dedicatedSupportMinor, // flat: dedicated SE/CSM (standard + priority are included)
+        long selfHostDeployMinor, // flat: self-hosted deployment
+        long airgapDeployMinor, // flat: air-gapped deployment
+        long qbrAnnualMinor, // flat: quarterly business reviews
+        long trainingOneTimeMinor) { // one-time: onboarding & training
 
     public static PricingRates defaults() {
         return new PricingRates(
-                5, // $0.05 / PDF under 1M/yr
-                4, // $0.04 / PDF at 1M–5M/yr
-                3, // $0.03 / PDF at 5M+/yr
-                0.15, // priority +15%
-                0.30, // dedicated +30%
-                0.05, // IP indemnification +5%
-                new double[] {0.0, 0.05, 0.10, 0.12, 0.15},
+                0.01, // $0.01 / run list
+                0.005, // $0.005 / run floor
+                0.06, // 6% off per doubling of committed runs past 1M/yr
+                new double[] {0.0, 0.03, 0.05, 0.06, 0.07}, // 1–5 year term, meter only
+                0.05, // IP indemnification = 5% of the net meter
+                3_000_000, // dedicated SE/CSM $30,000 / yr
+                1_200_000, // self-hosted $12,000 / yr
+                3_600_000, // air-gapped $36,000 / yr
                 800_000, // QBRs $8,000 / yr
                 750_000); // onboarding & training $7,500 one-time
     }
 
-    /** Volume-banded per-PDF rate for an annual volume, in minor units. */
-    public long perPdfMinor(long annualVolume) {
-        if (annualVolume >= 5_000_000) return perPdfMinor5MPlus;
-        if (annualVolume >= 1_000_000) return perPdfMinorUnder5M;
-        return perPdfMinorUnder1M;
-    }
-
     public double termDiscount(int termYears) {
         int idx = Math.max(1, Math.min(termYears, 5)) - 1;
         return termDiscountByYear[idx];
     }
-
-    public double serviceLevelUplift(String serviceLevel) {
-        if ("priority".equalsIgnoreCase(serviceLevel)) return priorityUplift;
-        if ("dedicated".equalsIgnoreCase(serviceLevel)) return dedicatedUplift;
-        return 0.0;
-    }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
index 62d5baed9d..4707c94197 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/ProcurementPricingService.java
@@ -2,34 +2,39 @@ package stirling.software.saas.procurement.pricing;
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Locale;
 
 import org.springframework.stereotype.Service;
 
 /**
- * The canonical enterprise pricing engine — the single server-side definition the quote builder,
- * the order form, and the Stripe checkout all derive from. A faithful port of the marketing
+ * The canonical enterprise pricing engine (D71) — the single server-side definition the quote
+ * builder, the order form, and Stripe checkout all derive from. A faithful port of the marketing
  * prototype's {@code quotePricing}:
  *
  * <pre>
- *   annual        = volume x perPdfRate x serviceLevelMult x (indemnification ? 1.05 : 1)
- *   annualNet     = round(annual x (1 - termDiscount)) + qbr
- *   tcv           = annualNet x termYears + training
+ *   runVol    = volume x intensity            // posture: Essentials x2, Governed x4, Regulated x7
+ *   volDisc   = min(0.5, 0.06 x log2(runVol / 1M))   // 6% off the per-run rate per doubling past 1M
+ *   rate      = max($0.005, $0.01 x (1 - volDisc))   // continuous curve, floors at half a cent
+ *   meterNet  = round(runVol x rate x (1 - termDisc))    // whole dollars; term discounts the meter only
+ *   annualNet = meterNet + dedicated + deployment + indemnification + qbr   // needs priced flat
+ *   tcv       = annualNet x termYears + training
  * </pre>
  *
- * The multi-year discount applies to usage + service level + indemnification, but NOT to the flat
- * QBR fee (added after), and one-time training sits outside the recurring total. All money is in
- * minor units (cents). Rates come from {@link PricingRates} (Stripe-backed in prod).
+ * <p>No volume tiers, no service-level multipliers, no ACV floor — those were the retired model.
+ * Deployment (self-hosted / air-gapped) and dedicated support are flat line items at cost basis;
+ * SSO / SCIM / RBAC / audit are always included. Money is USD only; amounts are in minor units
+ * (cents). Rates come from {@link PricingRates} (Stripe-backed in prod).
  */
 @Service
 public class ProcurementPricingService {
 
-    /** Bespoke/committed deals don't price below this ACV; the builder floors against it. */
-    public static final long MIN_ACV_MINOR = 5_000_000L; // $50,000
+    private static final double LOG2 = Math.log(2.0);
+    private static final long RUN_CURVE_KNEE = 1_000_000L; // discount starts past 1M committed runs
 
     /**
      * Estimated annual PDF volume from seat count (~2,012.5 PDFs/user/yr = 5 docs/day x 230 working
-     * days x 1.75), used to prefill the builder's volume step. Rounded, matching the prototype's
-     * {@code users x 5 x 230 x 1.75}.
+     * days x 1.75), used to prefill the builder's volume step. Matches the prototype's {@code users
+     * x 5 x 230 x 1.75}.
      */
     public long estimateAnnualVolume(int users) {
         return Math.round(Math.max(0, users) * 5.0 * 230.0 * 1.75);
@@ -40,55 +45,95 @@ public class ProcurementPricingService {
     }
 
     public QuoteBreakdown price(QuoteConfig cfg, PricingRates rates) {
-        // Never trust the client's volume: clamp to non-negative so a tampered request can't drive
-        // a
-        // negative amount. The rate card and formula are server-side, so the browser can't lower
-        // the
-        // price — only pick a smaller, legitimate config. (See MIN_ACV_MINOR for the committed
-        // floor,
-        // a policy decision that is intentionally not force-applied here — see the review notes.)
+        // Never trust the client's volume/intensity: clamp so a tampered request can't drive a
+        // negative amount. The curve and flat fees are server-side, so the browser can only pick a
+        // smaller legitimate config, never a cheaper rate.
         long volume = Math.max(0, cfg.volume());
-        long perPdf = rates.perPdfMinor(volume);
-        long usage = Math.round(volume * (double) perPdf); // base, pre-service-level
-        double slaUplift = rates.serviceLevelUplift(cfg.serviceLevel());
-        long withSla = Math.round(usage * (1.0 + slaUplift));
-        long withIndemnity =
-                cfg.indemnification()
-                        ? Math.round(withSla * (1.0 + rates.indemnificationUplift()))
-                        : withSla;
+        int intensity = Math.max(1, cfg.intensity());
+        long runVol = volume * (long) intensity;
 
-        double termDiscount = rates.termDiscount(cfg.termYears());
-        long discount = Math.round(withIndemnity * termDiscount);
+        // Committed-volume curve: continuous, no cliffs. Floors at the per-run cost + margin.
+        double volDisc =
+                runVol > RUN_CURVE_KNEE
+                        ? Math.min(
+                                0.5,
+                                rates.discountPerDoubling()
+                                        * (Math.log(runVol / (double) RUN_CURVE_KNEE) / LOG2))
+                        : 0.0;
+        double rate = Math.max(rates.floorRatePerRun(), rates.listRatePerRun() * (1.0 - volDisc));
+        double termDisc = rates.termDiscount(cfg.termYears());
+
+        // The meter is a whole-dollar figure (the quote reads in dollars), then minor units.
+        long annualBaseMinor = Math.round((double) runVol * rate) * 100L;
+        long meterNetMinor = Math.round((double) runVol * rate * (1.0 - termDisc)) * 100L;
+        long termDiscountMinor = meterNetMinor - annualBaseMinor; // <= 0
+
+        long support =
+                "dedicated".equalsIgnoreCase(cfg.serviceLevel())
+                        ? rates.dedicatedSupportMinor()
+                        : 0L;
+        long deploy = deployFeeMinor(cfg.deployment(), rates);
+        long indemnity =
+                cfg.indemnification()
+                        ? Math.round(meterNetMinor * rates.indemnificationRate())
+                        : 0L;
         long qbr = cfg.qbr() ? rates.qbrAnnualMinor() : 0L;
         long training = cfg.training() ? rates.trainingOneTimeMinor() : 0L;
 
-        long annualNet = (withIndemnity - discount) + qbr;
+        long annualNet = meterNetMinor + support + deploy + indemnity + qbr;
         long tcv = annualNet * cfg.termYears() + training;
 
+        double effectivePerPdf = rate * intensity; // quotes speak per-PDF-at-posture, never per-run
+
         List<QuoteLineItem> lines = new ArrayList<>();
         lines.add(
-                new QuoteLineItem("usage", "PDF processing", QuoteLineItem.Kind.RECURRING, usage));
+                new QuoteLineItem(
+                        "usage",
+                        String.format(
+                                Locale.ROOT,
+                                "PDF processing — %,d PDFs/yr at $%.4f/PDF (%s posture)",
+                                volume,
+                                effectivePerPdf,
+                                postureLabel(intensity)),
+                        QuoteLineItem.Kind.RECURRING,
+                        annualBaseMinor));
         lines.add(
                 new QuoteLineItem(
                         "seats",
-                        "Unlimited users + SSO / SCIM / RBAC",
+                        "Unlimited users + SSO / SCIM / RBAC / audit",
                         QuoteLineItem.Kind.INCLUDED,
                         0L));
-        if (withSla != usage) {
+        if (termDiscountMinor < 0) {
             lines.add(
                     new QuoteLineItem(
-                            "service-level",
-                            serviceLevelLabel(cfg.serviceLevel()),
-                            QuoteLineItem.Kind.RECURRING,
-                            withSla - usage));
+                            "multi-year",
+                            cfg.termYears() + "-year commitment",
+                            QuoteLineItem.Kind.DISCOUNT,
+                            termDiscountMinor));
         }
-        if (withIndemnity != withSla) {
+        if (support > 0) {
+            lines.add(
+                    new QuoteLineItem(
+                            "support",
+                            "Dedicated SE / CSM",
+                            QuoteLineItem.Kind.RECURRING,
+                            support));
+        }
+        if (deploy > 0) {
+            lines.add(
+                    new QuoteLineItem(
+                            "deployment",
+                            deploymentLabel(cfg.deployment()) + " deployment",
+                            QuoteLineItem.Kind.RECURRING,
+                            deploy));
+        }
+        if (indemnity > 0) {
             lines.add(
                     new QuoteLineItem(
                             "indemnification",
                             "IP indemnification",
                             QuoteLineItem.Kind.RECURRING,
-                            withIndemnity - withSla));
+                            indemnity));
         }
         if (qbr > 0) {
             lines.add(
@@ -98,14 +143,6 @@ public class ProcurementPricingService {
                             QuoteLineItem.Kind.RECURRING,
                             qbr));
         }
-        if (discount > 0) {
-            lines.add(
-                    new QuoteLineItem(
-                            "multi-year",
-                            cfg.termYears() + "-year commitment",
-                            QuoteLineItem.Kind.DISCOUNT,
-                            -discount));
-        }
         if (training > 0) {
             lines.add(
                     new QuoteLineItem(
@@ -117,9 +154,25 @@ public class ProcurementPricingService {
         return new QuoteBreakdown(lines, annualNet, tcv, cfg.currency());
     }
 
-    private static String serviceLevelLabel(String serviceLevel) {
-        if ("priority".equalsIgnoreCase(serviceLevel)) return "Priority service level";
-        if ("dedicated".equalsIgnoreCase(serviceLevel)) return "Dedicated service level";
-        return "Standard service level";
+    private static long deployFeeMinor(String deployment, PricingRates rates) {
+        if ("airgap".equalsIgnoreCase(deployment)) return rates.airgapDeployMinor();
+        if ("selfhost".equalsIgnoreCase(deployment)) return rates.selfHostDeployMinor();
+        return 0L; // cloud (managed) has no deployment fee
+    }
+
+    /** Buyer-facing posture name for the intensity (policy count); the demo's POLICY_POSTURES. */
+    private static String postureLabel(int intensity) {
+        return switch (intensity) {
+            case 2 -> "Essentials";
+            case 4 -> "Governed";
+            case 7 -> "Regulated";
+            default -> intensity + "-policy";
+        };
+    }
+
+    private static String deploymentLabel(String deployment) {
+        if ("airgap".equalsIgnoreCase(deployment)) return "Air-gapped";
+        if ("selfhost".equalsIgnoreCase(deployment)) return "Self-hosted";
+        return "Stirling Cloud";
     }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
index 30917a73a6..cc6612c530 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/pricing/QuoteConfig.java
@@ -9,17 +9,23 @@ package stirling.software.saas.procurement.pricing;
 public record QuoteConfig(
         long volume, // committed PDFs per year
         int users, // seats (drives the volume auto-estimate when the buyer hasn't overridden)
-        String deployment, // cloud | selfhost | airgap (inherited from the trial; not priced)
+        int intensity, // policy posture: runs per PDF — Essentials 2, Governed 4, Regulated 7
+        String deployment, // cloud | selfhost | airgap (priced flat; inherited from the trial)
         int termYears, // 1..5
-        String serviceLevel, // standard | priority | dedicated
+        String serviceLevel, // standard | priority (both included) | dedicated (flat SE/CSM fee)
         boolean indemnification,
         boolean training,
         boolean qbr,
-        String currency) { // USD | EUR | GBP
+        boolean offlineLicense, // offline .lic availability (gates download; no longer priced here)
+        String currency) { // USD only for now
+
+    /** Default posture when none is chosen — Governed (x4), per the pricing alignment decision. */
+    public static final int DEFAULT_INTENSITY = 4;
 
     public QuoteConfig {
         if (termYears < 1) termYears = 1;
         if (termYears > 5) termYears = 5;
+        if (intensity < 1) intensity = DEFAULT_INTENSITY;
         if (serviceLevel == null || serviceLevel.isBlank()) serviceLevel = "standard";
         if (currency == null || currency.isBlank()) currency = "USD";
     }
diff --git a/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java b/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
index 52e19f751e..57f530cc9a 100644
--- a/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
+++ b/app/saas/src/main/java/stirling/software/saas/procurement/service/ProcurementService.java
@@ -16,8 +16,11 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.model.enumeration.TeamRole;
+import stirling.software.saas.model.TeamMembership;
 import stirling.software.saas.procurement.config.ProcurementConfigurationProperties;
 import stirling.software.saas.procurement.license.EnterpriseLicenseService;
+import stirling.software.saas.procurement.license.LicenseEntitlements;
 import stirling.software.saas.procurement.model.ProcurementDeal;
 import stirling.software.saas.procurement.model.ProcurementQuote;
 import stirling.software.saas.procurement.pricing.ProcurementPricingService;
@@ -25,6 +28,7 @@ import stirling.software.saas.procurement.pricing.QuoteBreakdown;
 import stirling.software.saas.procurement.pricing.QuoteConfig;
 import stirling.software.saas.procurement.repository.ProcurementDealRepository;
 import stirling.software.saas.procurement.repository.ProcurementQuoteRepository;
+import stirling.software.saas.repository.TeamMembershipRepository;
 
 /**
  * Orchestrates a linked team's procurement journey: start a (mock-licensed) trial, build a
@@ -46,18 +50,37 @@ public class ProcurementService {
     private final ProcurementPricingService pricing;
     private final EnterpriseLicenseService licenses;
     private final ProcurementConfigurationProperties config;
+    private final TeamMembershipRepository memberRepo;
 
     public ProcurementService(
             ProcurementDealRepository dealRepo,
             ProcurementQuoteRepository quoteRepo,
             ProcurementPricingService pricing,
             EnterpriseLicenseService licenses,
-            ProcurementConfigurationProperties config) {
+            ProcurementConfigurationProperties config,
+            TeamMembershipRepository memberRepo) {
         this.dealRepo = dealRepo;
         this.quoteRepo = quoteRepo;
         this.pricing = pricing;
         this.licenses = licenses;
         this.config = config;
+        this.memberRepo = memberRepo;
+    }
+
+    /**
+     * The team leader's email — the natural owner of the team's Keygen licence. Falls back to the
+     * username when no email is set; null when the team has no leader.
+     */
+    private String leaderEmail(Long teamId) {
+        return memberRepo.findByTeamIdAndRole(teamId, TeamRole.LEADER).stream()
+                .findFirst()
+                .map(TeamMembership::getUser)
+                .map(
+                        u ->
+                                u.getEmail() != null && !u.getEmail().isBlank()
+                                        ? u.getEmail()
+                                        : u.getUsername())
+                .orElse(null);
     }
 
     @Transactional(readOnly = true)
@@ -85,7 +108,7 @@ public class ProcurementService {
         deal.setTrialStartedAt(now);
         deal.setTrialEndsAt(ends);
         deal.setTrialExtensionsUsed(0);
-        deal.setLicenseRef(licenses.issueTrialLicense(teamId, ends));
+        deal.setLicenseRef(licenses.issueTrialLicense(teamId, leaderEmail(teamId), ends));
         deal = dealRepo.save(deal);
         log.info(
                 "[procurement] trial started team={} deal={} ends={}",
@@ -144,12 +167,14 @@ public class ProcurementService {
         quote.setCurrency(cfg.currency());
         quote.setVolume(cfg.volume());
         quote.setSeats(cfg.users() > 0 ? cfg.users() : null);
+        quote.setIntensity(cfg.intensity());
         quote.setDeployment(cfg.deployment());
         quote.setTermYears(cfg.termYears());
         quote.setServiceLevel(cfg.serviceLevel());
         quote.setIndemnification(cfg.indemnification());
         quote.setTraining(cfg.training());
         quote.setQbr(cfg.qbr());
+        quote.setOfflineLicense(cfg.offlineLicense());
         quote.setBusinessName(businessName);
         quote.setAnnualNetMinor(breakdown.annualNetMinor());
         quote.setTcvMinor(breakdown.tcvMinor());
@@ -188,35 +213,104 @@ public class ProcurementService {
     }
 
     /**
-     * Mark the deal live: issue the annual licence and advance to the active stage. In production
-     * this is driven by the {@code invoice.paid} webhook once the first invoice is settled; this
-     * method is the demo/manual stand-in until that webhook lands.
+     * Provision on accept: upgrade the team's licence to the committed annual term (valid
+     * immediately), so the buyer can get going the moment they accept — before the invoice is paid.
+     * Driven by the accept edge function once the subscription + invoice are created. Idempotent
+     * (upgrades the existing licence in place); deliberately does NOT change the stage — the deal
+     * stays in the payment step so the outstanding invoice remains visible until it settles.
+     */
+    @Transactional
+    public ProcurementDeal provisionLicense(Long teamId) {
+        ProcurementDeal deal =
+                dealRepo.findByTeamId(teamId)
+                        .orElseThrow(() -> new IllegalStateException("No deal for team " + teamId));
+        deal.setLicenseRef(issueOrUpgradeAnnual(deal));
+        deal = dealRepo.save(deal);
+        log.info("[procurement] licence provisioned team={} deal={}", teamId, deal.getDealId());
+        return deal;
+    }
+
+    /**
+     * Mark the deal fully live (advance to the active stage) once payment settles. In production
+     * this is the {@code invoice.paid} webhook; here it's the demo/manual stand-in. Re-affirms the
+     * annual licence in case provisioning didn't run at accept.
      */
     @Transactional
     public ProcurementDeal markLive(Long teamId) {
         ProcurementDeal deal =
                 dealRepo.findByTeamId(teamId)
                         .orElseThrow(() -> new IllegalStateException("No deal for team " + teamId));
-        int term = 1;
-        String deployment = "cloud";
-        if (deal.getAcceptedQuoteId() != null) {
-            ProcurementQuote q = quoteRepo.findById(deal.getAcceptedQuoteId()).orElse(null);
-            if (q != null) {
-                term = Math.max(1, q.getTermYears());
-                if (q.getDeployment() != null && !q.getDeployment().isBlank()) {
-                    deployment = q.getDeployment();
-                }
-            }
-        }
-        deal.setLicenseRef(
-                licenses.issueAnnualLicense(
-                        teamId, deployment, LocalDateTime.now().plusYears(term)));
+        deal.setLicenseRef(issueOrUpgradeAnnual(deal));
         deal.setStage(ProcurementDeal.STAGE_LIVE);
         deal = dealRepo.save(deal);
         log.info("[procurement] deal live team={} deal={}", teamId, deal.getDealId());
         return deal;
     }
 
+    /**
+     * Issue or upgrade the committed annual licence from the deal's accepted (else latest) quote,
+     * stamping the full entitlement snapshot onto it and upgrading the trial licence in place when
+     * one exists.
+     */
+    private String issueOrUpgradeAnnual(ProcurementDeal deal) {
+        ProcurementQuote q =
+                deal.getAcceptedQuoteId() != null
+                        ? quoteRepo.findById(deal.getAcceptedQuoteId()).orElse(null)
+                        : quoteRepo.findByDealIdOrderByCreatedAtDesc(deal.getDealId()).stream()
+                                .findFirst()
+                                .orElse(null);
+        int term = q != null ? Math.max(1, q.getTermYears()) : 1;
+        String deployment =
+                q != null && q.getDeployment() != null && !q.getDeployment().isBlank()
+                        ? q.getDeployment()
+                        : "cloud";
+        int seats = q != null && q.getSeats() != null ? q.getSeats() : 0; // 0 = unlimited
+        LicenseEntitlements entitlements =
+                new LicenseEntitlements(
+                        q != null ? q.getVolume() : 0,
+                        seats,
+                        deployment,
+                        term,
+                        q != null ? q.getServiceLevel() : null,
+                        q != null && q.isIndemnification(),
+                        q != null && q.isTraining(),
+                        q != null && q.isQbr(),
+                        q != null && q.isOfflineLicense(),
+                        deal.getDealId(),
+                        deal.getSubscriptionId());
+        return licenses.issueAnnualLicense(
+                deal.getTeamId(),
+                leaderEmail(deal.getTeamId()),
+                LocalDateTime.now().plusYears(term),
+                deal.getLicenseRef(),
+                entitlements);
+    }
+
+    /**
+     * Check out the offline/air-gapped licence file for a team, when the offline add-on was
+     * purchased. Requires an issued licence on the deal and the accepted quote to carry the offline
+     * add-on; returns empty otherwise (so the controller can 404 rather than leak that a licence
+     * exists). The certificate is generated on demand by Keygen and never stored.
+     */
+    @Transactional(readOnly = true)
+    public Optional<String> offlineLicenseFile(Long teamId) {
+        ProcurementDeal deal = dealRepo.findByTeamId(teamId).orElse(null);
+        if (deal == null || deal.getLicenseRef() == null) return Optional.empty();
+        if (!hasOfflineAddOn(deal)) return Optional.empty();
+        return Optional.of(licenses.checkOutLicenseFile(deal.getLicenseRef()));
+    }
+
+    /**
+     * Whether the deal's <b>accepted</b> quote carries the paid offline-licence add-on. Gated on
+     * the accepted quote (not the latest) so merely toggling the add-on on an unaccepted draft
+     * can't unlock the offline file — it's only available once the add-on has actually been bought.
+     */
+    private boolean hasOfflineAddOn(ProcurementDeal deal) {
+        if (deal.getAcceptedQuoteId() == null) return false;
+        ProcurementQuote quote = quoteRepo.findById(deal.getAcceptedQuoteId()).orElse(null);
+        return quote != null && quote.isOfflineLicense();
+    }
+
     /**
      * Reset a team's procurement: delete the deal (quotes + activity cascade). For
      * re-demos/testing.
diff --git a/app/saas/src/main/resources/application-saas.properties b/app/saas/src/main/resources/application-saas.properties
index 1984974fef..49798d64cd 100644
--- a/app/saas/src/main/resources/application-saas.properties
+++ b/app/saas/src/main/resources/application-saas.properties
@@ -35,6 +35,15 @@ app.supabase.clock-skew-seconds=${app.jwt.clock-skew-seconds:120}
 app.supabase.edge-function-url=https://${app.supabase.project-ref}.supabase.co/functions/v1
 app.supabase.edge-function-secret=${SUPABASE_EDGE_FUNCTION_SECRET:}
 
+# ---------- Enterprise procurement licences (Keygen) ----------
+# Off by default → MockEnterpriseLicenseService (no real Keygen calls). Set enabled=true + the
+# three creds to switch to the real KeygenEnterpriseLicenseService. Same account/policy as the
+# self-hosted products; env names match the edge functions' KEYGEN_* for consistency.
+stirling.keygen.enabled=${STIRLING_KEYGEN_ENABLED:false}
+stirling.keygen.account-id=${KEYGEN_ACCOUNT_ID:}
+stirling.keygen.api-token=${KEYGEN_API_TOKEN:}
+stirling.keygen.policy-id=${KEYGEN_POLICY_ID:}
+
 # ---------- PAYG meter reporting ----------
 # Posts billable usage to the Supabase `meter-payg-units` edge function in the JobChargeService
 # close() afterCommit hook. Defaults to empty so unit tests / local dev are no-ops; set
diff --git a/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql b/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
new file mode 100644
index 0000000000..e7ca0233a7
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
@@ -0,0 +1,6 @@
+-- Offline / air-gapped licence add-on flag on the quote (a paid add-on; priced like QBR). Written
+-- and read by the Java backend via JPA. Twin of Supabase migration
+-- 20260710000000_procurement_offline_license.sql.
+
+ALTER TABLE stirling_pdf.procurement_quote
+    ADD COLUMN IF NOT EXISTS offline_license BOOLEAN NOT NULL DEFAULT false;
diff --git a/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql b/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql
new file mode 100644
index 0000000000..4920d52d26
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql
@@ -0,0 +1,6 @@
+-- Policy posture (runs per PDF) on the quote: the D71 meter is denominated in runs, so a quote
+-- must remember the posture it was priced at (Essentials 2, Governed 4, Regulated 7). Defaults to
+-- Governed (4). Written and read by the Java backend via JPA. A Supabase twin migration mirrors it.
+
+ALTER TABLE stirling_pdf.procurement_quote
+    ADD COLUMN IF NOT EXISTS intensity INTEGER NOT NULL DEFAULT 4;
diff --git a/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java b/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
index 1f903a1ee2..1676541db2 100644
--- a/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/procurement/pricing/ProcurementPricingServiceTest.java
@@ -7,72 +7,138 @@ import org.junit.jupiter.api.Test;
 import stirling.software.saas.procurement.pricing.QuoteLineItem.Kind;
 
 /**
- * Locks the pricing engine to the numbers the marketing prototype encodes — most importantly the
- * canonical quote QT-AC9F-0001 (1M PDFs, priority, 3-year) = $41,400/yr, $124,200 TCV.
+ * Locks the D71 pricing engine to the numbers marketing publishes. The two anchor fixtures are the
+ * ones the demo memo foots against: acme (90M PDFs · Governed · self-hosted · dedicated · 3-yr =
+ * $1,752,000/yr, $5,256,000 TCV) and Northwind (6M · Governed · cloud · standard · 3-yr =
+ * $165,278/yr). If either moves, the engine has drifted from marketing.
  */
 class ProcurementPricingServiceTest {
 
     private final ProcurementPricingService pricing = new ProcurementPricingService();
 
-    private static QuoteConfig cfg(long volume, String sla, int term) {
-        return new QuoteConfig(volume, 0, "cloud", term, sla, false, false, false, "USD");
+    private static QuoteConfig cfg(
+            long volume, int intensity, String deployment, int term, String sla) {
+        return new QuoteConfig(
+                volume, 0, intensity, deployment, term, sla, false, false, false, false, "USD");
     }
 
     @Test
-    void canonicalQuoteMatchesPrototype() {
-        QuoteBreakdown q = pricing.price(cfg(1_000_000, "priority", 3));
+    void acmeFixtureFootsExactly() {
+        // 90M PDFs × Governed(×4) = 360M runs → curve floors at $0.005/run → $0.0200/PDF effective.
+        // meter $1.8M − 5% (3-yr) = $1,710,000 + self-hosted $12K + dedicated SE/CSM $30K.
+        QuoteBreakdown q = pricing.price(cfg(90_000_000, 4, "selfhost", 3, "dedicated"));
 
-        assertThat(q.annualNetMinor()).isEqualTo(4_140_000L); // $41,400
-        assertThat(q.tcvMinor()).isEqualTo(12_420_000L); // $124,200
-        assertThat(lineAmount(q, "usage")).isEqualTo(4_000_000L); // $40,000 @ $0.04
-        assertThat(lineAmount(q, "service-level")).isEqualTo(600_000L); // +15%
-        assertThat(lineAmount(q, "multi-year")).isEqualTo(-460_000L); // -10%
+        assertThat(q.annualNetMinor()).isEqualTo(175_200_000L); // $1,752,000
+        assertThat(q.tcvMinor()).isEqualTo(525_600_000L); // $5,256,000
+        assertThat(lineAmount(q, "support")).isEqualTo(3_000_000L); // dedicated SE/CSM $30K
+        assertThat(lineAmount(q, "deployment")).isEqualTo(1_200_000L); // self-hosted $12K
     }
 
     @Test
-    void volumeBandsPickTheRightPerPdfRate() {
-        assertThat(lineAmount(pricing.price(cfg(500_000, "standard", 1)), "usage"))
-                .isEqualTo(2_500_000L); // 500k @ $0.05
-        assertThat(lineAmount(pricing.price(cfg(1_000_000, "standard", 1)), "usage"))
-                .isEqualTo(4_000_000L); // 1M @ $0.04
-        assertThat(lineAmount(pricing.price(cfg(5_000_000, "standard", 1)), "usage"))
-                .isEqualTo(15_000_000L); // 5M @ $0.03
+    void northwindFixtureFootsExactly() {
+        // 6M × Governed(×4) = 24M runs → $0.0290/PDF effective → $165,278/yr at 3-yr.
+        QuoteBreakdown q = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard"));
+
+        assertThat(q.annualNetMinor()).isEqualTo(16_527_800L); // $165,278
+        assertThat(q.tcvMinor()).isEqualTo(49_583_400L); // × 3 years
+        // Cloud + standard: no deployment or support line.
+        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("deployment"));
+        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("support"));
     }
 
     @Test
-    void addOnsAndTermStack() {
+    void rateFloorsAtHalfACent() {
+        // 100M × Regulated(×7) = 700M runs — deep past the knee, so the per-run rate is pinned to
+        // the $0.005 floor: base meter = 700M × $0.005 = $3,500,000 (1-yr, no term discount).
+        QuoteBreakdown q = pricing.price(cfg(100_000_000, 7, "cloud", 1, "standard"));
+        assertThat(lineAmount(q, "usage")).isEqualTo(350_000_000L); // $3,500,000
+        assertThat(q.annualNetMinor()).isEqualTo(350_000_000L);
+    }
+
+    @Test
+    void postureDrivesThePrice() {
+        // Same PDFs, three postures — the meter scales with runs, so Regulated > Governed >
+        // Essentials. (This is what the retired flat-per-PDF model could not express.)
+        long essentials = pricing.price(cfg(6_000_000, 2, "cloud", 3, "standard")).annualNetMinor();
+        long governed = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
+        long regulated = pricing.price(cfg(6_000_000, 7, "cloud", 3, "standard")).annualNetMinor();
+
+        assertThat(essentials).isLessThan(governed);
+        assertThat(governed).isLessThan(regulated);
+        assertThat(governed).isEqualTo(16_527_800L); // Governed is the Northwind anchor
+    }
+
+    @Test
+    void deploymentIsAFlatFeeNotAMultiplier() {
+        long cloud = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
+        long selfhost =
+                pricing.price(cfg(6_000_000, 4, "selfhost", 3, "standard")).annualNetMinor();
+        long airgap = pricing.price(cfg(6_000_000, 4, "airgap", 3, "standard")).annualNetMinor();
+
+        assertThat(selfhost - cloud).isEqualTo(1_200_000L); // +$12,000 flat
+        assertThat(airgap - cloud).isEqualTo(3_600_000L); // +$36,000 flat
+    }
+
+    @Test
+    void standardAndPriorityIncludedDedicatedIsFlat() {
+        long standard = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
+        long priority = pricing.price(cfg(6_000_000, 4, "cloud", 3, "priority")).annualNetMinor();
+        long dedicated = pricing.price(cfg(6_000_000, 4, "cloud", 3, "dedicated")).annualNetMinor();
+
+        assertThat(priority).isEqualTo(standard); // both included, no uplift
+        assertThat(dedicated - standard).isEqualTo(3_000_000L); // dedicated SE/CSM +$30,000 flat
+    }
+
+    @Test
+    void termDiscountsTheMeterOnly() {
+        long oneYear = pricing.price(cfg(6_000_000, 4, "cloud", 1, "standard")).annualNetMinor();
+        long twoYear = pricing.price(cfg(6_000_000, 4, "cloud", 2, "standard")).annualNetMinor();
+        // 2-yr is 3% off the meter (discounted on the raw meter, then rounded to whole dollars).
+        assertThat(oneYear).isEqualTo(17_397_700L); // no discount
+        assertThat(twoYear).isEqualTo(16_875_700L); // −3% on the meter
+        assertThat(twoYear).isLessThan(oneYear);
+    }
+
+    @Test
+    void indemnificationIsFivePercentOfTheMeter() {
+        long base = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
         QuoteConfig c =
-                new QuoteConfig(1_000_000, 0, "cloud", 5, "dedicated", true, true, true, "USD");
+                new QuoteConfig(
+                        6_000_000, 0, 4, "cloud", 3, "standard", true, false, false, false, "USD");
         QuoteBreakdown q = pricing.price(c);
+        assertThat(lineAmount(q, "indemnification")).isEqualTo(Math.round(base * 0.05));
+    }
 
-        long usage = 4_000_000L;
-        long withSla = Math.round(usage * 1.30); // 5,200,000
-        long withIndemnity = Math.round(withSla * 1.05); // 5,460,000
-        long discount = Math.round(withIndemnity * 0.15); // 819,000
-        long qbr = 800_000L;
-        long expectedAnnual = (withIndemnity - discount) + qbr;
-        long expectedTcv = expectedAnnual * 5 + 750_000L; // + training one-time
+    @Test
+    void trainingIsOneTimeOutsideTheAnnual() {
+        QuoteConfig withTraining =
+                new QuoteConfig(
+                        6_000_000, 0, 4, "cloud", 3, "standard", false, true, false, false, "USD");
+        QuoteBreakdown q = pricing.price(withTraining);
+        long baseAnnual = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
 
-        assertThat(q.annualNetMinor()).isEqualTo(expectedAnnual);
-        assertThat(q.tcvMinor()).isEqualTo(expectedTcv);
+        assertThat(q.annualNetMinor()).isEqualTo(baseAnnual); // one-time never touches the annual
+        assertThat(q.tcvMinor()).isEqualTo(baseAnnual * 3 + 750_000L); // + $7,500 once
         assertThat(q.lineItems())
                 .anyMatch(l -> l.key().equals("training") && l.kind() == Kind.ONE_TIME);
-        assertThat(q.lineItems()).anyMatch(l -> l.key().equals("qbr"));
-        assertThat(q.lineItems()).anyMatch(l -> l.key().equals("indemnification"));
     }
 
     @Test
-    void standardSingleYearHasNoUpliftOrDiscountLines() {
-        QuoteBreakdown q = pricing.price(cfg(1_000_000, "standard", 1));
-        assertThat(q.annualNetMinor()).isEqualTo(4_000_000L);
-        assertThat(q.tcvMinor()).isEqualTo(4_000_000L);
-        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("service-level"));
-        assertThat(q.lineItems()).noneMatch(l -> l.key().equals("multi-year"));
+    void unsetPostureDefaultsToGoverned() {
+        long defaulted = pricing.price(cfg(6_000_000, 0, "cloud", 3, "standard")).annualNetMinor();
+        long governed = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard")).annualNetMinor();
+        assertThat(defaulted).isEqualTo(governed);
+    }
+
+    @Test
+    void ssoIsAlwaysAnIncludedZeroLine() {
+        QuoteBreakdown q = pricing.price(cfg(6_000_000, 4, "cloud", 3, "standard"));
+        assertThat(q.lineItems())
+                .anyMatch(l -> l.key().equals("seats") && l.kind() == Kind.INCLUDED);
     }
 
     @Test
     void volumeEstimateFromSeats() {
-        // ~2,013 PDFs/user/yr
         assertThat(pricing.estimateAnnualVolume(100)).isEqualTo(201_250L);
         assertThat(pricing.estimateAnnualVolume(0)).isZero();
     }
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 7e0ca0116b..e81f5eaebb 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7551,6 +7551,8 @@ generate = "Generate quote"
 included = "Included"
 indemnification = "IP indemnification"
 indemnificationSub = "We defend qualifying IP claims, per the EULA"
+offlineLicense = "Offline / air-gapped licence"
+offlineLicenseSub = "A downloadable licence file for an air-gapped self-hosted instance"
 qbr = "Quarterly business reviews"
 qbrSub = "Your SE reviews usage and roadmap each quarter"
 running = "{{annual}} / yr · {{years}}-yr {{tcv}}"
@@ -7636,6 +7638,14 @@ subtitle = "Your solutions engineer is on every step. One next action at a time;
 title = "From trial to live, one guided path"
 trialTitle = "Enterprise trial"
 
+[portal.procurement.license]
+copied = "Copied"
+copy = "Copy key"
+downloadError = "Could not generate the offline licence file just yet — please try again in a moment."
+downloadOffline = "Download offline licence (.lic)"
+hint = "Paste this key into a self-hosted instance to activate it, or keep it for your records. Keep it safe."
+label = "Your licence key"
+
 [portal.procurement.link]
 cta = "Link account"
 description = "Procurement runs on your linked Stirling account: it's how we provision the trial, price your quote, and start billing. Link an account to start."
@@ -7688,7 +7698,7 @@ uploadCta = "Upload purchase order"
 uploadTitle = "Upload your purchase order"
 
 [portal.procurement.payment]
-description = "Your quote is accepted and a committed annual subscription has been created. Pay the first invoice to go live — you can pay or download it right here, no email needed."
+description = "Your quote is accepted and your licence is already active — your team can start right away. Pay the first invoice when you're ready; you can pay or download it here, no email needed."
 downloadInvoice = "Download invoice"
 simulate = "Simulate payment received (demo)"
 title = "Subscription created"
diff --git a/frontend/editor/src/portal/api/http.ts b/frontend/editor/src/portal/api/http.ts
index ac48cccf08..d0398470eb 100644
--- a/frontend/editor/src/portal/api/http.ts
+++ b/frontend/editor/src/portal/api/http.ts
@@ -217,6 +217,31 @@ async function saasJson<T>(
   return unwrap<T>(res);
 }
 
+/** Fetch a plain-text SaaS response (e.g. a downloadable licence file). Throws on a non-2xx. */
+async function saasText(
+  path: string,
+  options: HttpRequestOptions = {},
+): Promise<string> {
+  const base = saasBaseUrl();
+  // null = unset (self-hosted, no VITE_SAAS_API_URL). "" is same-origin (SaaS) — valid.
+  if (base === null) throw new SaasUnconfiguredError();
+  const token = await getPortalSaasToken();
+  if (!token) throw new SaasNotLinkedError();
+  const res = await fetch(`${base}${path}`, {
+    method: options.method ?? "GET",
+    headers: {
+      Accept: "text/plain",
+      Authorization: `Bearer ${token}`,
+      ...options.headers,
+    },
+    signal: options.signal,
+  });
+  if (!res.ok) {
+    throw new Error(`SaaS request failed (${res.status})`);
+  }
+  return res.text();
+}
+
 /** SaaS GET returning a binary Blob, with the Supabase JWT attached. */
 async function saasBlob(
   path: string,
@@ -249,6 +274,7 @@ export const apiClient = {
   /** Hosted SaaS Java. Admin's Supabase JWT auto-attached. */
   saas: {
     json: saasJson,
+    text: saasText,
     blob: saasBlob,
     /** True when a SaaS base URL is resolvable. Doesn't check session liveness. */
     isConfigured: (): boolean => saasBaseUrl() !== null,
diff --git a/frontend/editor/src/portal/api/procurement.ts b/frontend/editor/src/portal/api/procurement.ts
index 9327179c03..05a903a8af 100644
--- a/frontend/editor/src/portal/api/procurement.ts
+++ b/frontend/editor/src/portal/api/procurement.ts
@@ -149,6 +149,8 @@ export interface ProcurementSnapshot {
   trialEndsAt: string | null;
   trialExtensionsUsed: number;
   licensed: boolean;
+  /** The team's Keygen licence key (present once licensed); shown in the portal to copy/install. */
+  licenseKey: string | null;
   latestQuote: QuoteResult | null;
 }
 
@@ -161,6 +163,8 @@ export interface QuoteConfigInput {
   indemnification: boolean;
   training: boolean;
   qbr: boolean;
+  /** Offline / air-gapped licence file — a paid add-on. */
+  offlineLicense: boolean;
   currency: string;
   /** Buyer's company name — shown on the quote/agreement and remembered when re-editing. */
   businessName: string;
@@ -170,6 +174,14 @@ export function fetchSnapshot(): Promise<ProcurementSnapshot> {
   return apiClient.saas.json<ProcurementSnapshot>("/api/v1/procurement");
 }
 
+/**
+ * Download the offline / air-gapped licence file (.lic) as text. Only available when the paid
+ * offline add-on was purchased; the server 404s (→ throws) otherwise.
+ */
+export function fetchLicenseFile(): Promise<string> {
+  return apiClient.saas.text("/api/v1/procurement/license/file");
+}
+
 export function startTrial(): Promise<ProcurementSnapshot> {
   return apiClient.saas.json<ProcurementSnapshot>(
     "/api/v1/procurement/trial/start",
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
index 2192d3b2ec..5035ec49b1 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.stories.tsx
@@ -9,6 +9,7 @@ const base: ProcurementSnapshot = {
   trialEndsAt: "2026-07-09T00:00:00Z",
   trialExtensionsUsed: 0,
   licensed: false,
+  licenseKey: null,
   latestQuote: null,
 };
 
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
index 9ba3ebeef2..94ee979b86 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementFlow.tsx
@@ -11,6 +11,7 @@ import {
 } from "@portal/components/procurement/ProcurementExtras";
 import { ProcurementModal } from "@portal/components/procurement/ProcurementModal";
 import {
+  LicensePanel,
   LiveStageCard,
   PaymentStageCard,
   QuoteMilestoneCard,
@@ -45,6 +46,7 @@ export function ProcurementFlow({
     isDraft,
     busy,
     downloading,
+    downloadingLicense,
     error,
     setError,
     open,
@@ -61,6 +63,7 @@ export function ProcurementFlow({
     onAgree,
     onGoLive,
     onDownloadPdf,
+    onDownloadOfflineLicense,
   } = controller;
 
   return (
@@ -145,6 +148,15 @@ export function ProcurementFlow({
 
             {!editing && stage === "active" && <LiveStageCard />}
 
+            {data?.licenseKey && (
+              <LicensePanel
+                licenseKey={data.licenseKey}
+                offlineAvailable={!!latest?.config.offlineLicense}
+                downloadingLicense={downloadingLicense}
+                onDownloadOffline={onDownloadOfflineLicense}
+              />
+            )}
+
             <div className="portal-proc__reset">
               <button type="button" onClick={onReset} disabled={busy}>
                 {t("portal.procurement.reset")}
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
index 174ed91154..bd5c0e3fc5 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementStages.tsx
@@ -1,3 +1,4 @@
+import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Button, Card } from "@app/ui";
 import type { QuoteResult } from "@portal/api/procurement";
@@ -158,3 +159,57 @@ export function LiveStageCard() {
     </Card>
   );
 }
+
+/**
+ * The team's licence key with Copy — and, when the paid offline add-on was taken, a download for
+ * the air-gapped licence file. Shown from the trial step onward (the key exists from the trial and
+ * is upgraded in place at accept), so it lives outside any single stage card.
+ */
+export function LicensePanel({
+  licenseKey,
+  offlineAvailable,
+  downloadingLicense,
+  onDownloadOffline,
+}: {
+  licenseKey: string;
+  offlineAvailable: boolean;
+  downloadingLicense: boolean;
+  onDownloadOffline: () => void;
+}) {
+  const { t } = useTranslation();
+  const [copied, setCopied] = useState(false);
+
+  const copyKey = () => {
+    void navigator.clipboard?.writeText(licenseKey);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
+  };
+
+  return (
+    <div className="portal-proc__license">
+      <span className="portal-proc__license-label">
+        {t("portal.procurement.license.label")}
+      </span>
+      <code className="portal-proc__license-key">{licenseKey}</code>
+      <div className="portal-proc__payment-actions">
+        <Button variant="secondary" onClick={copyKey}>
+          {copied
+            ? t("portal.procurement.license.copied")
+            : t("portal.procurement.license.copy")}
+        </Button>
+        {offlineAvailable && (
+          <Button
+            variant="tertiary"
+            loading={downloadingLicense}
+            onClick={onDownloadOffline}
+          >
+            {t("portal.procurement.license.downloadOffline")}
+          </Button>
+        )}
+      </div>
+      <p className="portal-proc__license-hint">
+        {t("portal.procurement.license.hint")}
+      </p>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
index d13aaaff06..1ba6016a4a 100644
--- a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
+++ b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
@@ -51,6 +51,7 @@ export function QuoteBuilder({
       indemnification: false,
       training: false,
       qbr: false,
+      offlineLicense: false,
       currency: "USD",
       businessName: "",
     },
@@ -223,6 +224,12 @@ export function QuoteBuilder({
                   sub={t("portal.procurement.builder.qbrSub")}
                   onClick={() => set("qbr", !cfg.qbr)}
                 />
+                <AddOn
+                  on={cfg.offlineLicense}
+                  title={t("portal.procurement.builder.offlineLicense")}
+                  sub={t("portal.procurement.builder.offlineLicenseSub")}
+                  onClick={() => set("offlineLicense", !cfg.offlineLicense)}
+                />
               </div>
             </Field>
           </Step>
@@ -432,5 +439,12 @@ function previewAnnualMinor(cfg: QuoteConfigInput): number {
   const disc = Math.round(
     withInd * TERM_DISCOUNT[Math.min(Math.max(cfg.termYears, 1), 5) - 1],
   );
-  return withInd - disc + (cfg.qbr ? 800_000 : 0);
+  // Flat annual add-ons (QBR, offline licence) sit outside the multi-year discount, mirroring the
+  // server (PricingRates: qbr 800_000, offline licence 1_200_000). TCV preview derives from this.
+  return (
+    withInd -
+    disc +
+    (cfg.qbr ? 800_000 : 0) +
+    (cfg.offlineLicense ? 1_200_000 : 0)
+  );
 }
diff --git a/frontend/editor/src/portal/components/procurement/useProcurement.ts b/frontend/editor/src/portal/components/procurement/useProcurement.ts
index 70f64f8f30..e2fdb922bf 100644
--- a/frontend/editor/src/portal/components/procurement/useProcurement.ts
+++ b/frontend/editor/src/portal/components/procurement/useProcurement.ts
@@ -5,6 +5,7 @@ import { useAsync } from "@portal/hooks/useAsync";
 import {
   acceptQuote,
   extendTrial,
+  fetchLicenseFile,
   fetchQuotePdf,
   fetchSnapshot,
   goLive,
@@ -35,6 +36,7 @@ export interface ProcurementController {
   isDraft: boolean;
   busy: boolean;
   downloading: boolean;
+  downloadingLicense: boolean;
   error: string | null;
   setError: (e: string | null) => void;
   open: boolean;
@@ -52,6 +54,7 @@ export interface ProcurementController {
   onAgree: () => void;
   onGoLive: () => void;
   onDownloadPdf: () => Promise<void>;
+  onDownloadOfflineLicense: () => Promise<void>;
 }
 
 export function useProcurement(autoOpen = false): ProcurementController {
@@ -67,6 +70,7 @@ export function useProcurement(autoOpen = false): ProcurementController {
   const [busy, setBusy] = useState(false);
   const [editing, setEditing] = useState(false);
   const [downloading, setDownloading] = useState(false);
+  const [downloadingLicense, setDownloadingLicense] = useState(false);
   const [invoicePdf, setInvoicePdf] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [extra, setExtra] = useState<ProcurementExtra>(null);
@@ -141,6 +145,27 @@ export function useProcurement(autoOpen = false): ProcurementController {
     }
   }
 
+  async function onDownloadOfflineLicense() {
+    setDownloadingLicense(true);
+    try {
+      const cert = await fetchLicenseFile();
+      const blob = new Blob([cert], { type: "text/plain" });
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = "stirling-enterprise.lic";
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      setTimeout(() => URL.revokeObjectURL(url), 60_000);
+    } catch (e) {
+      console.error("[procurement] offline licence download failed", e);
+      setError(t("portal.procurement.license.downloadError"));
+    } finally {
+      setDownloadingLicense(false);
+    }
+  }
+
   // A deep link (/procurement) opens the flow when a deal is already underway; if there's no deal
   // yet it must NOT silently start a trial — leave the modal closed so the Start-trial CTA shows.
   useEffect(() => {
@@ -158,6 +183,7 @@ export function useProcurement(autoOpen = false): ProcurementController {
     isDraft,
     busy,
     downloading,
+    downloadingLicense,
     error,
     setError,
     open,
@@ -175,5 +201,6 @@ export function useProcurement(autoOpen = false): ProcurementController {
     onAgree,
     onGoLive,
     onDownloadPdf,
+    onDownloadOfflineLicense,
   };
 }
diff --git a/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts b/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts
index 4a4cc4bcb8..0a0c2b5ca3 100644
--- a/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts
+++ b/frontend/editor/src/portal/mocks/handlers/procurementSaas.ts
@@ -14,6 +14,7 @@ const EMPTY = {
   trialEndsAt: null,
   trialExtensionsUsed: 0,
   licensed: false,
+  licenseKey: null,
   latestQuote: null,
 };
 
@@ -24,6 +25,7 @@ interface Cfg {
   indemnification: boolean;
   training: boolean;
   qbr: boolean;
+  offlineLicense: boolean;
   currency: string;
   businessName?: string;
 }
@@ -48,8 +50,9 @@ function priceQuote(cfg: Cfg) {
     withInd * TERM[Math.min(Math.max(cfg.termYears, 1), 5) - 1],
   );
   const qbr = cfg.qbr ? 800_000 : 0;
+  const offline = cfg.offlineLicense ? 1_200_000 : 0;
   const training = cfg.training ? 750_000 : 0;
-  const annualNetMinor = withInd - disc + qbr;
+  const annualNetMinor = withInd - disc + qbr + offline;
   const tcvMinor = annualNetMinor * cfg.termYears + training;
 
   type Kind = "RECURRING" | "ONE_TIME" | "DISCOUNT" | "INCLUDED";
@@ -96,6 +99,13 @@ function priceQuote(cfg: Cfg) {
       kind: "RECURRING",
       amountMinor: qbr,
     });
+  if (offline > 0)
+    lines.push({
+      key: "offline-license",
+      label: "Offline / air-gapped licence",
+      kind: "RECURRING",
+      amountMinor: offline,
+    });
   if (disc > 0)
     lines.push({
       key: "multi-year",
@@ -132,6 +142,7 @@ function priceQuote(cfg: Cfg) {
       indemnification: cfg.indemnification,
       training: cfg.training,
       qbr: cfg.qbr,
+      offlineLicense: cfg.offlineLicense,
       currency: cfg.currency || "USD",
       businessName: cfg.businessName ?? "",
     },
@@ -154,6 +165,7 @@ export const procurementSaasHandlers = [
       trialEndsAt: new Date(now + 14 * 86_400_000).toISOString(),
       trialExtensionsUsed: 0,
       licensed: true,
+      licenseKey: "MOCK-TRIAL-KEY-0001",
       latestQuote: null,
     };
     return HttpResponse.json(deal);
@@ -192,9 +204,20 @@ export const procurementSaasHandlers = [
     if (d.dealId) {
       d.stage = "active";
       d.licensed = true;
+      d.licenseKey = "MOCK-ENTERPRISE-KEY-0001";
     }
     return HttpResponse.json(deal);
   }),
+  http.get(`${SAAS}/api/v1/procurement/license/file`, () => {
+    const q = (deal as { latestQuote: { config?: Cfg } | null }).latestQuote;
+    if (!q?.config?.offlineLicense) {
+      return new HttpResponse(null, { status: 404 });
+    }
+    return new HttpResponse(
+      "-----BEGIN LICENSE FILE-----\nmock-offline-license\n-----END LICENSE FILE-----\n",
+      { headers: { "Content-Type": "text/plain" } },
+    );
+  }),
   http.post(`${SAAS}/api/v1/procurement/reset`, () => {
     resetProcurementSaasStore();
     return HttpResponse.json(EMPTY);
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index 0f827f9146..adc21fd79a 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -1119,6 +1119,37 @@
   flex-wrap: wrap;
   margin-top: 1rem;
 }
+.portal-proc__license {
+  margin-top: 1.25rem;
+  padding: 1rem;
+  border: 1px solid var(--color-border, rgba(0, 0, 0, 0.1));
+  border-radius: 0.6rem;
+  background: var(--color-surface-2, rgba(0, 0, 0, 0.02));
+}
+.portal-proc__license-label {
+  display: block;
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  color: var(--color-text-2);
+}
+.portal-proc__license-key {
+  display: block;
+  margin-top: 0.4rem;
+  padding: 0.55rem 0.7rem;
+  border-radius: 0.4rem;
+  background: var(--color-surface-3, rgba(0, 0, 0, 0.05));
+  font-family: var(--font-mono, monospace);
+  font-size: 0.85rem;
+  word-break: break-all;
+  color: var(--color-text-1);
+}
+.portal-proc__license-hint {
+  margin: 0.6rem 0 0;
+  font-size: 0.75rem;
+  color: var(--color-text-3, var(--color-text-2));
+}
 .portal-proc__milestone-for {
   margin: 0.15rem 0 0;
   font-size: 0.8125rem;